Privacy Policy

Your privacy matters to us. This Privacy Policy ("Policy") is issued by Innopay Money ("Company", "Innopay Money", "we", "us", "our"), operator of the website at www.innopaymoney.com and the "Innopay Money" mobile application (together, the "Platform"). It describes what data we collect, how we use and share it, and the choices and rights available to you.

We use "You" to refer to anyone visiting the Platform, registering an Account, or applying for a Loan through it ("User", "you", "your"). Innopay Money operates purely as a Lending Service Provider ("LSP"): we do not sanction or fund Loans ourselves. Data collected through the Platform is used to facilitate your application with our RBI-regulated Lending Partner(s), who make all credit decisions independently.

This Policy does not extend to third-party websites, apps, or services — including those of our Lending Partners — even where linked from our Platform; please review their own privacy notices separately. If you disagree with any practice described here, you should discontinue use of the Platform.

"Affiliate"

means an entity that controls, is controlled by, or is under common control with Innopay Money.

"Consent"

means your free, specific, informed, and unambiguous indication of agreement to a stated processing purpose, as required under the Digital Personal Data Protection Act, 2023 and associated rules, regulations and any subsequent modifications and amendments made thereof ("DPDP Act, 2023").

"Data"

means Personal Data and Other Data, collectively.

"Data Fiduciary"

means the entity determining the purpose and means of processing — the Company, for Platform-operation purposes; the relevant Lending Partner, for credit-assessment and lending purposes.

"Data Principal"

means the individual to whom the data relates.

"Lending Partner / RE"

means the RBI-regulated bank or NBFC that sanctions, funds, and owns a Loan facilitated through the Platform.

"Lending Service Provider"

means an agent engaged by an RE to perform one or more lending-related functions — such as sourcing, KYC facilitation, underwriting support, servicing, or recovery support on the RE's behalf. Innopay Money's role under these Terms is that of an LSP only.

"Other Data"

means data that does not, on its own or combined with other data reasonably available to us, identify you as an individual — such as aggregated device, browser, or usage data.

"Personal Data"

means any data that identifies, or could reasonably be used to identify, you as an individual, as defined under the DPDP Act, 2023.

"Platform"

means the Innopay Money website and mobile application, collectively.

"Service Provider"

means a third party engaged by us to help deliver the Services — for example, hosting, analytics, KYC-verification, or customer-support providers — bound by confidentiality and data-protection obligations.

"Services"

means the loan-discovery, application-facilitation, and servicing-support Services made available through the Platform.

What Data we collect depends on how you use the Platform. We receive Data directly from you — for example, when you register an Account, submit a Loan application, or contact customer support. We also collect using cookies and similar technologies as you use the Platform, and we receive Data from third parties, such as our Lending Partners, KYC/identity-verification services, and Credit Information Companies. Collecting Data from these varied sources is essential to assessing your Loan application, keeping the Platform secure, and reducing fraud.

Personal Data collected directly from you or from third parties such as KYC providers and Credit Information Companies:

Other Data collected through Cookies:

3.1 We collect only the Data reasonably necessary for the purposes disclosed to you (data minimisation), consistent with the DPDP Act, 2023 and RBI's Digital Lending Directions, 2025.

3.2 Consent-Based Optional Data is collected only through a clear, itemised, on-screen consent request, separate from your general acceptance of this Policy, and only where relevant to a specific loan product's underwriting or fraud-prevention needs. Declining it may affect the loan offers available to you but will not restrict your general access to the Platform.

3.3 Where Other Data is combined with other information such that it could identify you, we treat it as Personal Data for the purposes of this Policy.

We, and where applicable our Lending Partners and Service Providers, use Data to:

• verify your identity and complete KYC in accordance with RBI's KYC Master Direction;
• evaluate and process your Loan application, and support the Lending Partner's underwriting;
• detect, investigate, and prevent fraud, money laundering, and other harmful activity;
• respond to your queries, send Service notices, and provide customer support;
• meet audit, regulatory, and industry-compliance obligations;
• analyse and improve the Platform's products, systems, and user experience; and
• where you have opted in, send you marketing and promotional communications.

We do not sell or rent your Personal Data to marketers or unaffiliated third parties. We share Data only as follows:

• Lending Partner(s): to assess and process your Loan application, disbursement, and repayment. This is the core purpose for which most Personal Data is collected.
• Service Providers: entities that help us operate the Platform, such as KYC/identity-verification vendors, cloud hosting, analytics, and customer-support tools, bound by confidentiality obligations no less protective than this Policy.
• Credit Information Companies: CIBIL, Experian, Equifax, CRIF High Mark, and others, for credit assessment and reporting under the Credit Information Companies (Regulation) Act, 2005.
• Affiliates: group entities, where relevant, to help deliver the Services, subject to the same data-protection standards described here.
• Authorised Third Parties: any party you have directly authorised to access your Data (for example, a third-party app you've connected to your Account); such access is governed by that third party's own privacy notice.
• Business Transfers: in connection with a reorganisation, merger, sale, or transfer of business assets, on a need-to-know basis, subject to the transferee honouring this Policy.
• Legal, Safety and Regulatory Purposes: where required by law, to enforce our Terms and Conditions, to protect our or others' rights, safety, or property, or to respond to courts, law-enforcement, or regulatory authorities, including the RBI.

The Platform uses cookies and similar technologies to remember your preferences, keep you signed in, and understand how the Platform is used, so we can improve it. We do not use third-party behavioural-advertising cookies to build cross-site advertising profiles about you. You can control cookies through your browser or device settings; disabling them may limit certain features.

You have the right to accept or reject all/partial cookies, however, if you use your browser or device settings to disable or limit certain features, you may not be able to access all or parts of the Platform.

7.1 We store Personal Data in encrypted form, restrict access to sensitive systems to authorised personnel on a need-to-know basis, and apply reasonable technical and organisational safeguards, consistent with the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 and the Digital Personal Data Protection Act, 2023 and associated rules, regulations and any subsequent modifications and amendments made thereof.

7.2 No system can be guaranteed 100% secure. If you believe your Account has been compromised, please stop using the Platform and contact us immediately at support@innopay.in.

7.3 In the event of a Personal Data breach, we will manage the incident under our internal breach-response procedure, which includes timely notification to affected Users and, where required, to the Data Protection Board of India or other applicable authority.

Subject to the DPDP Act, 2023, you have the right to:

• know what Data we hold about you, and request a summary of the personal data being processed by the Company and the processing activities undertaken by the Company with respect to such personal data;
• correct or update Data that is inaccurate, incomplete, or outdated;
• withdraw your consent to a specific Data-processing purpose at any time, noting, this may limit or end our ability to continue certain Services to you;
• request erasure of Data — the Company shall delete the Personal Data of the User, unless retention of the same is necessary for a specified purpose or for compliance with any law for the time being in force;
• shall have adequate recourse for efficient grievance redressal;
• opt out of marketing communications at any time via the unsubscribe link or by contacting us. You will continue to receive essential Service and Account-related messages; and
• nominate another individual to exercise these rights on your behalf in the event of death or incapacity.

To exercise any of these rights, sign in to your Account or write to us at support@innopay.in, putting forth your Data related concerns. We may need to verify your identity before acting on a request, and we will respond within the timelines prescribed under applicable law.

9.1 We retain Personal Data only for as long as necessary to fulfil the purposes described in this Policy, or for such longer period as required under applicable law — including RBI's record-retention norms and anti-money-laundering requirements, which may require retention following the closure of your Account or Loan. You may request for Data deletion once the data retention is no longer necessary for the purpose it was collected, subject to our statutory retention obligations.

9.2 Even if you close your Account, we and our Lending Partner(s) will retain certain Data as necessary to meet legal, audit, and fraud-prevention obligations. Data no longer required is deleted, anonymised, or otherwise put beyond further use, subject to residual copies that may remain in backups until their scheduled overwrite.

The Platform is not directed at, and we do not knowingly collect Personal Data from, individuals under 18 years of age, consistent with the eligibility criteria in our Terms and Conditions. If we become aware that we have inadvertently collected Personal Data from a minor, we will delete it promptly. Parents and guardians are encouraged to monitor their children's online activities and to ensure that they do not submit personal data through the Platform. Parents and guardians who believe that we may have collected personal data from a child may contact us to request deletion of such data.

Where we process Data on the instructions of a Lending Partner — for example, forwarding your KYC documents for underwriting — we act as a Data Processor for that Lending Partner, who is the Data Fiduciary for that specific processing activity and is separately responsible for its own privacy disclosures to you. Our processing in that capacity is governed by our agreement with the relevant Lending Partner and applicable law.

We may revise this Policy from time to time to reflect changes in law, our practices, or our Lending Partners. Material changes will be notified through the Platform, email, or SMS; continued use of the Platform after such notice constitutes acceptance of the revised Policy.

By accepting this Policy, you confirm that you have read and understood it and consent to our collection, use, storage, disclosure, and processing of your Data as described. Where you provide Data relating to another individual (for example, a family member's contact details for reference purposes), you confirm that you have obtained that individual's consent to share their data with us for the purposes described in this Policy.

We will acknowledge privacy-related queries or complaints within 24–48 hours and aim to resolve them within timelines prescribed under applicable law. If unresolved, you may escalate to the Data Protection Board of India (once operational) or, for lending-related grievances, the RBI Integrated Ombudsman Scheme (cms.rbi.org.in) or the Sachet Portal (sachet.rbi.org.in). For general queries, write to support@innopay.in.

For the full escalation ladder, see our Grievance Redressal Mechanism.