1. Who we are
Finriseo is a loan comparison platform. We are not a bank or an NBFC and we do not lend money. We collect a small amount of information from you, show you indicative offers from RBI-registered lenders, and — only if you choose to proceed — pass your details to the lender you selected.
This policy explains what we collect, why, how long we keep it, and what you can ask us to do with it, under the Digital Personal Data Protection (DPDP) Act 2023.
2. What we actually collect
This is the complete list. We do not collect anything else.
- Mobile number — verified by OTP. This is how we identify you.
- Full name and email address.
- PIN code, from which we look up your district and state.
- Employment type, monthly income, how you are paid, employer name and years of experience — used to work out which lenders you qualify for.
- Loan amount requested and, where given, the purpose.
- PAN — collected at the last step, and required by lenders for any loan application.
- Consent record — the date, the version of this policy you agreed to, your IP address and browser user-agent at that moment. This exists so we can show a lender exactly what you agreed to.
- Technical data — your IP address (used for rate limiting and abuse prevention) and cookies needed to keep you signed in during the application.
We do not collect Aadhaar, your date of birth, bank statements, or your residential address.
3. Why we use it, and who sees it
- To verify your mobile number and keep your application secure.
- To calculate which lenders' criteria you meet and show you indicative offers.
- To pass your application to the lender you select, so they can assess it. They then handle your data under their own privacy policy.
- To contact you about your application.
We do not sell your data, and we do not share it with lenders you have not chosen.
4. Where your data is stored
Our database and application servers are located in India (Mumbai). Two service providers we rely on operate globally and may process some of your data outside India:
- Google Firebase Authentication — holds your mobile number in order to send and verify the OTP.
- Sentry — receives error reports. These are configured to exclude personal data.
Our other processors are Supabase (database, Mumbai), Google Cloud Run (application server, Mumbai) and Vercel (website hosting).
5. How long we keep it
- Unfinished applications are deleted automatically after 3 days of inactivity, and in any case within 30 days of being started.
- Submitted applications are kept as a business record. We are finalising a defined retention period for closed and rejected applications and will state it here.
- Messages you send us through the contact form are deleted 180 days after they are resolved.
- OTP logs (that a code was sent, not the code itself) are kept for 90 days.
- Once you have no applications left with us, your personal record is deleted entirely.
6. Security
All traffic is encrypted in transit. Your PAN is encrypted at rest using AES-256-GCM, is never written to logs or exports, and is shown in full only to authorised staff on a screen that records who viewed it. Other fields are stored without additional encryption beyond the database's own.
7. Your rights
Under the DPDP Act you can ask us to:
- tell you what personal data we hold about you and who we have shared it with;
- correct anything that is wrong or out of date;
- delete your data, unless we are required to keep it;
- withdraw your consent — after which we stop processing your data for the purposes you withdrew it for.
Email dpo@finriseo.com and we will respond within 30 days. If you are not satisfied, you may complain to the Data Protection Board of India.
8. Cookies
We use cookies that are necessary to keep you signed in while you complete an application, and analytics cookies to understand how the site is used. You can clear or block them in your browser, though the application flow will not work without the sign-in cookies.
9. Changes to this policy
If we change this policy materially we will publish a new version with a new effective date. The version you agreed to is recorded with your application.
10. Contact
Email: dpo@finriseo.com