Privacy policy
Plain-language summary first; the detail follows. Governed by the Digital Personal Data Protection Act, 2023 and the RBI Digital Lending Directions, 2025.
What we collect, and why
| Data | Purpose | Legal basis |
|---|---|---|
| Mobile number | Login, application identity, resuming your form | Consent |
| Amount, purpose, employment, income band | Matching you to eligible lenders | Consent |
| PIN code, DOB, PAN | Lender eligibility, bureau soft pull (only after your explicit consent) | Consent |
| Bureau report (soft pull) | Pre-qualification without CIBIL impact | Separate, unticked consent |
| Bank/Account Aggregator data (optional) | Better offers via verified income | Separate, unticked consent, revocable at the AA |
What we never do
- No access to your contacts, call logs, photos or files — ever
- No selling of your data to marketers or non-regulated entities
- No storage of biometrics
- Your data is stored on servers located in India
Sharing
Only with: (a) the specific RBI-registered lenders you ask us to share with — named on the consent screen; (b) the credit bureau for your consented soft pull; (c) service providers under processor agreements (SMS, hosting) bound to these same rules.
Retention & deletion
Application data is retained as long as your account is live or as law requires, then deleted. Consent artefacts (what you agreed to, when, from which device) are retained as evidence of consent. Deletion requests: email privacy@kredbaba.com — we honour them within 30 days except where RBI/PMLA record-keeping law requires retention.
Your rights (DPDP Act 2023)
Access, correction, erasure, grievance, and nomination. Write to privacy@kredbaba.com. If unresolved, escalate via our grievance process and then to the Data Protection Board of India.