Your Privacy
Matters to Us

1 About This Policy

This privacy policy applies to the CreditPaisaSetu mobile application and any related services operated by Gurukrupa Apps (collectively, the "Application"). Gurukrupa Apps is referred to as the "Service Provider" throughout this document.

The Application assesses the information you provide and authorise, and uses it to offer you a credit limit — the maximum amount you are approved to borrow. You decide whether to use that limit, how much of it to withdraw, and when. This policy covers the data used to set your limit, the data collected when you withdraw cash against it, and the data used to manage your repayment.

By using the Application, you agree to the collection and use of information in accordance with this policy.

2 Information We Collect

Personal Information You Provide

• Phone number — used for account registration and login verification.
• Basic profile details — occupation, employment status, work tenure, monthly income, education level, marital status and similar information you fill in when applying for a limit.
• Identity documents — images of your Aadhaar card, PAN card, or other government-issued ID captured via camera or selected from your gallery.
• Contact references — up to 5 contacts you choose to provide as social references for your credit limit assessment. You select each contact individually through your device's own contact picker; only the name and phone number of the contacts you pick are collected. Your full address book is never read or uploaded.
• Bank card number — entered twice by you for confirmation, and used solely to disburse the amount you withdraw.
• Email address — used to send you your loan details, the applicable terms, and repayment reminders.

SMS Data (Financial Messages Only)

If you grant the SMS permission, the Application reads the messages in your SMS inbox to assess your financial standing — how regularly money comes in, how you spend it, and whether you repay loans on time. This is the single heaviest factor in the credit limit we offer you.

The Application applies a filter on your device and retains only messages from banks, payment platforms and lending institutions. For each retained message, the following fields are collected:

• Sender number or sender ID
• Message body
• Date and time the message was sent and received
• Message type and read / seen status flags

Messages that do not match the filter — personal chats, notifications, and anything unrelated to finance — are discarded on your device and are never transmitted to the Service Provider. SMS permission is optional: you may decline it or continue without granting it, in which case your credit limit assessment will be less accurate.

Loan & Repayment Information

When you withdraw cash against your credit limit, the Application records the details of that transaction: the amount borrowed, the tenure you selected, the repayment date, the interest and total repayment amounts, the status of that transaction, and your resulting available credit. This information is used to service the loan, send you repayment reminders, and track your remaining limit.

Device Hardware Information

The Application automatically collects the following device-level data for credit risk modeling and fraud prevention:

• Device model, brand, board name, and manufacturer
• Screen dimensions — width, height (pixels), and diagonal size (inches)
• Android OS version and SDK level
• Total and available RAM (memory)
• Total and available internal storage; external storage if present
• Android ID and Google Advertising ID (GAID)
• Network operator name and network type (2G / 3G / 4G / 5G / WiFi)
• WiFi network IP address
• Battery level and charging status (USB / AC)
• System time zone, language, and locale settings

Installed Application List

The Application reads the list of packages installed on your device, including each app's name, package identifier, version, install date, and update date. The Service Provider uses this data exclusively for credit risk modeling — analyzing the presence of financial, e-commerce, and utility applications to better assess your profile and set an appropriate limit. The Service Provider does not read any app content, messages, or usage data.

Location Information

Coarse (city-level) location is collected from your device's network provider. This helps verify that your location is consistent with your application details and detects unusual login patterns for fraud prevention.

Network and Usage Data

• Your device's Internet Protocol (IP) address
• The pages of the Application you visit, the date and time of your visit, and the time spent on those pages

What We Do Not Collect

To be explicit about the boundaries of the above:

• No call logs. The Application does not request or read your call history.
• No full address book. Only the individual contacts you pick are collected.
• No personal messages. Only financial messages that pass the filter leave your device.
• No app content. Only the installed package list is read, never what is inside those apps.

3 How We Use Your Data

• Credit Limit Assessment — Your basic profile details, identity documents, financial SMS data, contact references, location, device hardware information and installed application list are collectively analysed by the Service Provider's risk model to determine the credit limit the Service Provider is able to offer you. This assessment is the core service provided by the Application, and SMS data carries the heaviest weight in it.
• Identity Verification — Identity document images and liveness verification data confirm your identity and prevent impersonation.
• Loan Disbursement & Repayment — Your bank card number is used to disburse the amount you withdraw, and your email address is used to send you the loan details, the applicable terms, and repayment reminders. Withdrawals are recorded so your remaining available limit stays accurate.
• Fraud Detection and Security — Device fingerprints, location patterns, installed app data and financial message patterns help detect SIM swap, device cloning, identity fraud and other fraudulent activity.
• Service Improvement — Aggregated and anonymized usage data helps the Service Provider understand usage patterns and improve performance.
• Notifications — With your permission, push notifications are sent for repayment reminders, credit limit updates, and important account activity. The Service Provider does not use notifications for marketing without your consent.

4 Data Transmission & Storage

All data collected by the Application is encrypted using AES encryption during transmission and sent to the Service Provider's servers at:

Financial SMS messages are filtered on your device first; only the messages that match the filter are transmitted. Data is stored on servers operated by the Service Provider and its trusted infrastructure partners. The Service Provider implements physical, electronic, and procedural safeguards to protect your information against unauthorized access, alteration, or destruction.

5 Device Permissions

The Application requests the following Android permissions. You may decline any permission; however, core features may not function without them. SMS permission in particular is optional — declining it lowers the accuracy of your credit limit assessment but does not block you from continuing.

• SMS Reading your SMS inbox to identify bank, payment and lending messages only. Used to assess your cash flow and repayment behaviour when setting your credit limit. Filtered on your device; personal messages are never read or uploaded. Encrypted in transit and storage.
• Location Coarse (city-level) location for identity verification and fraud detection. Encrypted and handled per data protection regulations.
• Camera & Photos Capturing and uploading identity documents for verification. Photos are encrypted and never shared with third parties.
• Device Info Device identifiers (Android ID, GAID), hardware specifications, network status, battery, and system settings are read for credit risk profiling and fraud prevention. Encrypted in transit and storage.
• Installed Apps App inventory is analyzed for financial behaviour patterns to improve credit limit accuracy. App content and usage data are never read. Used exclusively for credit risk modeling.
• Notifications Repayment reminders, credit limit status updates, and important account notifications.

6 Third-Party Services

Only aggregated, anonymized data is transmitted to external services for analytics and improvement. The Application integrates the following third-party SDKs, each governed by its own privacy policy:

• Google Play Services
• Google Analytics for Firebase
• Firebase Crashlytics
• Adjust

The Service Provider may also disclose information as required by law, to protect rights or safety, to investigate fraud, or to respond to a government request. Trusted service providers acting on the Service Provider's behalf are contractually bound to adhere to this privacy policy.

7 Cookies & Tracking Technologies

The Application or its third-party SDKs may use cookies, SDKs, pixels, and similar technologies to support functionality, analytics, or service delivery. Where required by applicable law, the Service Provider will obtain consent before using non-essential tracking technologies.

8 International Data Transfers

The Service Provider or its third-party service providers may transfer personal data to countries outside your country of residence, including outside the European Economic Area (EEA). Where applicable law requires safeguards, the Service Provider will use:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Adequacy decisions or other legally recognized transfer mechanisms
• Your consent, where required and legally permitted

Data protection laws in other countries may differ from those in your jurisdiction. Where required, the Service Provider applies appropriate safeguards and obtains required consent.

9 Data Retention

• User Provided Data — Duration of your use plus 12 months, unless longer retention is required by law.
• Financial SMS Data — Retained only for as long as needed to complete your credit limit assessment and meet legal obligations, and deleted thereafter. Once processed, the underlying message records are not kept for any other purpose.
• Loan & Repayment Records — Retained for the duration of your use plus 12 months, and longer where required by applicable financial or tax law.
• Automatically Collected Data (including device information and installed app list) — Up to 24 months from collection, unless longer retention is required for legal compliance.
• Aggregated and Anonymized Data — Retained indefinitely as it no longer identifies you.
• Legal compliance data — Retained as long as required by applicable law.

You may request deletion of your personal data at any time, subject to any legal obligation to retain it.

10 Your Rights & Choices

General Rights

You may request access to, correction of, or deletion of your personal data held by the Service Provider. To exercise these rights, or to withdraw consent where processing is based on consent, contact the Service Provider at akshaysantoki71@gmail.com.

Managing Permissions

You can revoke the SMS permission, location permission, or any other permission at any time in your device settings, and you can review your authorisations inside the Application. Revoking SMS permission after an assessment has been completed does not affect the credit limit already granted, but a future assessment will be less accurate.

California Privacy Rights (CCPA/CPRA)

California residents have the right to know what personal information is collected, to delete personal information, to opt out of the sale or sharing of personal information, and to non-discrimination for exercising these rights.

Opt-Out

You can stop all further data collection by uninstalling the Application. Uninstalling does not automatically delete data already transmitted. Deleting your account from within the Application removes your account data.

11 Security & Breach Notification

The Service Provider maintains physical, electronic, and procedural safeguards to protect your information. All data transmitted between the Application and the Service Provider's servers is encrypted using industry-standard AES encryption.

If a data breach occurs that affects your personal data, the Service Provider will notify you in accordance with applicable legal requirements, including information about the nature of the breach and the steps being taken to address it.

12 Children's Privacy

The Application is not intended for children under 16 years of age, or such higher age as required by applicable law. The Service Provider does not knowingly collect personally identifiable information from children. If the Service Provider discovers a child has provided personal information, it will be immediately deleted. Parents or guardians who become aware of such a situation should contact akshaysantoki71@gmail.com.

13 Changes to This Policy

The Service Provider may update this Privacy Policy from time to time. Material changes will be communicated by posting the updated policy with a new effective date. Where required by law, your consent will be sought before material changes take effect. Previous versions are available upon request.

This privacy policy is effective as of September 15, 2026.

14 Your Consent

Where processing is based on consent, you provide that consent by affirmatively opting in to the relevant feature or action — for example, granting the SMS permission through the authorisation prompt before any financial message is read. You may withdraw consent at any time without affecting processing carried out before withdrawal.

15 Contact Us

For questions about this privacy policy or to exercise your rights, contact the Service Provider at: