Privacy Policy

CredLyf operates a digital distribution and technology platform (the Platform) through which registered Digital Partners source and submit leads for financial products. CredLyf is not a bank, NBFC, insurer or investment adviser. Financial products are offered, underwritten, approved, priced and serviced solely by the respective banks, NBFCs, insurers, financial institutions and other product providers (each a Lender / Financial Institution).

There is no customer registration, customer login, customer account or customer dashboard on the Platform. A person whose details are submitted by a Digital Partner is a Prospective Customer / Applicant, not a registered Platform user.

This policy applies to the CredLyf website (credlyf.com) and the CredLyf Pro Android app (package com.credlyf.app), both operated by CREDLYF FINTECH PRIVATE LIMITED (“CredLyf”, “we”). CredLyf is a financial-services referral and distribution platform. It is not a lender and does not itself approve, sanction or disburse loans.

• Digital Partners — the only external registered users of the Platform.
• Authorised internal CredLyf users — Operations, Admin, Super Admin, Finance, Compliance, Support and other authorised employees or contractors, each with role-based access limited to what their function requires.
• Prospective Customers / Applicants — individuals or entities whose information is submitted by a Digital Partner as a lead. They do not hold an account on the Platform.

From Digital Partners, we may process:

• Name, mobile number and email address.
• PAN and KYC information where applicable.
• Business or professional information (entity type, GST details where provided, place of business, experience).
• Bank and payment information required for commission and payout processing.
• Documents submitted during partner KYC and onboarding.
• Login and authentication information, including OTP verification records and session data.
• Technical information sent with requests, such as IP address and browser/WebView user-agent (device type and OS), recorded in login history, session and security logs. We do not collect advertising IDs or other persistent device identifiers.
• If you choose to use the Credy AI assistant: your messages and recent conversation history, the page you are on, your role, and the results of any data lookups the assistant runs for you. For Digital Partners these lookups can include your own application numbers, status, product, loan amount and dates, your commission/earnings and payout summary, and product/lender information. For authorised internal staff they can also include a shortened customer or partner name (first name and last initial), city, partner code and status, limited by role. Before anything is sent, a server-side filter removes PAN, mobile numbers, email addresses and internal IDs, and masks PAN, Aadhaar, mobile, account numbers, emails and OTPs typed into messages. Aadhaar, uploaded KYC documents and bank account details are never sent.
• Activity information such as leads created, status changes, actions performed (audit logs) and support communications.

For leads submitted by a Digital Partner, we may process:

• Name of the prospective customer / applicant.
• Mobile number and email address.
• Date of birth, city/PIN code and PAN where required for the selected product.
• Employment, income and product-specific details (for example property, business, course or vehicle details) and requested loan amount.
• The financial product or requirement selected.
• Any further information or documents voluntarily submitted by the Digital Partner or by the prospective customer in connection with the opportunity.

A lead is a prospective applicant record submitted by a Digital Partner. It does not create a CredLyf account for that person.

What we do not collect: the CredLyf Pro app does not access your location, contacts, call logs or SMS inbox, and does not use third-party advertising, analytics or crash-reporting SDKs. Camera and photo access are requested only when you choose to capture or upload a document. Information is collected only when you or your account actions provide it, is stored on our cloud infrastructure, and is shared only as described below.

• Partner onboarding, eligibility checks and partner KYC.
• Authentication, account security and access control.
• Lead submission, lead management and de-duplication.
• Processing financial-product opportunities and application tracking.
• Communication with Digital Partners and, where required, with prospective customers regarding a submitted lead.
• Coordination with banks, NBFCs and other financial institutions.
• Commission calculation, partner payout processing and related financial records.
• Fraud prevention, misuse detection, security monitoring and audit.
• Support, grievance handling and dispute resolution.
• Compliance with legal, regulatory, tax and record-keeping requirements.
• Maintaining reliability and diagnosing errors using server logs.

Lead information submitted by a Digital Partner may be shared with relevant banks, NBFCs, financial institutions, lending partners, insurance partners, banking partners and investment or other product partners, strictly where necessary to process the relevant financial-product opportunity and subject to applicable law and the applicable consent/authorisation requirements.

We may also share information with:

• Technology service providers acting on our instructions: cloud hosting, database, authentication and file storage (Lovable Cloud, built on Supabase); SMS/OTP delivery (MSG91); transactional email (Resend); application hosting/CDN (Cloudflare); and AI processing for the optional Credy AI assistant (OpenAI, which generates answers from the data described above, and Lovable AI Gateway, which processes search queries against our knowledge base).
• Authorised DSAs and referral partners only where necessary to process a specific opportunity. DSAs are intermediaries and are not lenders.
• Professional advisers, auditors and insurers, where reasonably required.
• Government, regulatory, judicial or law-enforcement authorities where disclosure is required by law or legal process.
• An acquirer or successor entity in the event of a merger, restructuring or business transfer, subject to this policy.

CredLyf does not sell personal information. CredLyf does not underwrite, sanction, price or disburse any financial product; those decisions rest solely with the relevant Lender / Financial Institution.

• Encryption of data in transit (HTTPS/TLS) and encryption at rest provided by our cloud infrastructure provider.
• Role-based access control, so internal users can access only the data required for their role.
• OTP-based authentication for partner access, with hashed one-time codes and session controls.
• Time-limited signed URLs for document access instead of public document links.
• Row-level database access policies, activity logging and audit trails for record changes.
• Private document storage (no public document links) and periodic review of access rights.

No system can be guaranteed absolutely secure. Digital Partners must keep their login credentials and OTPs confidential and notify us immediately of any suspected unauthorised access.

Information is retained for as long as reasonably necessary for:

• Operation of the Platform and the ongoing partner relationship.
• Lead and application processing and status tracking.
• Commission, payout, tax and accounting records.
• Legal, regulatory and audit obligations.
• Dispute resolution, grievance handling and fraud prevention.

Where information is no longer required for these purposes, it is deleted or anonymised in line with our internal retention schedule.

Digital Partners can request deletion of their CredLyf Pro account and associated data at any time through our Account Deletion Request page, or by emailing grievance@credlyf.com from the email or mobile number registered with us. Requests are verified and processed manually by our team, generally within 30 days.

On deletion we deactivate your login and delete or anonymise your profile, KYC documents and bank details, except records we are legally required to keep, such as commission/payout and tax records, audit logs, and records of leads already shared with financial institutions that are needed for regulatory, fraud-prevention or dispute purposes. Retained records are kept only for the period required by law and then deleted.

A Digital Partner who submits another person’s information must have the appropriate authority and, where required, the consent of that person to share the information with CredLyf and its financial-institution partners for the purpose of the relevant financial-product opportunity.

A Digital Partner must not:

• Submit false, fabricated, duplicate or fictitious information.
• Submit leads without proper authority or consent.
• Misuse, retain, resell or further share personal information obtained through the Platform.
• Upload documents that are not required for the relevant opportunity.
• Use the Platform for spam, unsolicited marketing or any fraudulent or unlawful activity.

Breach of these obligations may result in suspension or termination of the partner account and further action under applicable law. See the Partner Terms.

Subject to applicable Indian law, including the Information Technology Act, 2000 with the SPDI Rules, 2011 and the Digital Personal Data Protection Act, 2023 (as and when its provisions and rules come into force), you may write to us to:

• Request access to the personal information we hold about you.
• Request correction or updating of inaccurate or incomplete information.
• Withdraw a consent you previously provided, where processing is based on consent.
• Request erasure of information, where we are not required to retain it for legal, regulatory, contractual or dispute-resolution purposes.
• Raise a grievance about how your information has been handled.

Where a request relates to a lead, we may need to verify your identity and may need to coordinate with the Digital Partner who submitted the lead or with the relevant financial institution. Requests are actioned within a reasonable period. Withdrawing consent may mean an opportunity can no longer be processed.

The Platform uses cookies and similar technologies for authentication, session management, and security; we do not use advertising cookies. The CredLyf Pro app may request device permissions (such as camera or file access) solely to enable features like document upload; permissions can be managed in your device settings. Service communications relating to your partner account, leads and payouts are operational and cannot be opted out of while your account is active.

We may update this policy to reflect changes in our services, technology or legal obligations. Revisions are published on this page with an updated version number and “Last Updated” date. Continued use of the Platform after publication constitutes acceptance of the revised policy.

To raise a formal complaint, use the Grievance Redressal process.