Privacy Policy

1. Data We Collect

Account Information

• Email address (for login and communication)
• Full name and company name
• Persona type (business owner, advisor, DSA)
• Phone number (optional, only if you choose to share it)

Financial Documents

• Bank statements — used to extract transaction patterns, turnover, EMI outflows, and cash flow metrics.
• GSTIN / GST data — used to verify business identity, filing compliance, and credit intelligence signals.
• KYC documents (PAN, Aadhaar) — used for name matching and validation and retained in access-controlled storage while needed for the requested service.
• CIBIL self-reported data — approximate score range and credit history inputs you provide.

Usage Data

• Pages visited, features used, report downloads
• Device type, browser, and session identifiers
• Error logs for debugging and service improvement

2. How We Use Your Data

• Analysis only: Documents are parsed to generate your readiness score and lender match report.
• Consent before sharing: We require your explicit consent before sharing raw documents or parsed data with lenders, banks, or other third parties.
• Service improvement: We use synthetic test data and operational metrics to improve reliability. Customer documents are not used for parser-improvement experiments without separate explicit consent.
• Communication: We may send you transactional emails (reports, password resets). We will not send marketing emails without your opt-in.

3. Third-Party Services

• Google Gemini AI: Bank statement text and GST data may be sent to Google's Gemini API when required for parsing and analysis. Data is limited to what the configured processing step needs, and Google's applicable data-processing terms apply.
• IRIS GST API: Your GSTIN is sent to IRIS for fetching public GST filing data.
• Google OAuth: If you sign in with Google, we receive your name and email from Google. We do not access any other Google data.

4. Data Retention

• Uploaded documents, including KYC: Retained in access-controlled server storage while needed to provide the requested analysis, support report regeneration, or operate your account. You may request deletion.
• Generated reports: Retained while needed to provide the service or until you delete your account or request deletion.
• Account data: Retained until you request deletion.

5. Cookies

We use essential cookies for session management. Optional analytics tools, including PostHog and Sentry where configured, start only after you accept analytics cookies through the consent banner. You may decline optional analytics.

6. Security Measures

• All data transmitted over HTTPS (TLS 1.2+)
• Uploaded documents protected by access controls and restricted service permissions
• Access controls and role-based permissions
• Password hashing using bcrypt
• Regular security reviews

7. Your Rights

Under the Information Technology Act 2000 and the Digital Personal Data Protection (DPDP) Act 2023, you have the right to:

• Access: Request a copy of all personal data we hold about you.
• Correction: Update or correct inaccurate data.
• Deletion: Request deletion of your account and all associated data.
• Portability: Request your data in a machine-readable format.
• Withdraw consent: Revoke consent for data processing at any time.
• Grievance redressal: File a complaint with our Grievance Officer or the Data Protection Board of India.

8. Children's Privacy

Credilo is not intended for individuals under 18 years of age. We do not knowingly collect data from minors.

9. Changes to This Policy

We may update this Privacy Policy periodically. We will notify registered users via email of any material changes. The updated policy will be posted on this page with a revised date.

10. Contact & Grievance Officer

For privacy-related questions or to exercise your rights:
Email: support@credilo.in
Grievance Officer: support@credilo.in
Web: credilo.in/contact

Last updated: August 2026