Privacy Policy
How Credit Consultant collects, uses, safeguards, and respects your personal and credit data.
Your financial privacy is sacred. Credit Consultant operates in strict conformity with the Digital Personal Data Protection Act, 2023 (DPDP Act 2023) and the Credit Information Companies (Regulation) Act, 2005 (CICRA 2005). We process your credit information strictly pursuant to your express, informed consent. We NEVER sell, trade, or distribute your credit reports or personal records to marketing companies or telemarketers.
Identity of the Data Fiduciary & Scope
Credit Consultant ("Company", "We", "Us", "Our") operates as a Data Fiduciary within the meaning of Section 2(i) of the Digital Personal Data Protection Act, 2023. We determine the purpose and means of processing personal data provided by individuals accessing our Platform ("Data Principals", "Users", "Subscribers").
This Privacy Policy applies to all personal data and sensitive financial records collected through our website, mobile application interfaces, onboarding wizards, payment gateways, and client dashboards.
Categories of Personal Data Collected
We collect and process only the minimum necessary personal data required to authenticate you, retrieve your authorized credit information, and facilitate dispute rectification:
Full legal name, 10-digit Indian mobile number, email address, Permanent Account Number (PAN), Date of Birth (DOB), calculated age, gender, postal/residential addresses, and optional profile image.
Credit scores (300 to 900), account types (home loans, personal loans, credit cards, auto loans, commercial facilities), credit card limits and current balances, monthly repayment track records, Days Past Due (DPD) delinquency status, settlement/written-off markers, date of account opening and closure, member financial institution names, and hard credit enquiries. This data is retrieved from TransUnion CIBIL, Experian India, Equifax India, and CRIF High Mark pursuant to your statutory consent.
Dispute descriptions, disputed account numbers, priority impact ratings, and user-uploaded proof documentation including bank No-Dues Certificates (NOCs), foreclosure receipts, bank statement excerpts, or settlement letters (stored as encrypted records referenced in our dispute_documents vault).
Internet Protocol (IP) addresses, browser user agent strings, One-Time Password (OTP) verification audit logs (timestamp, delivery status, attempt counts in otp_audit_logs), Razorpay payment transaction IDs, order IDs, currency, and purchase audit histories (in payments and payment_audit_logs).
Purpose of Processing & Lawful Grounds under DPDP Act, 2023
Under Section 6 of the Digital Personal Data Protection Act, 2023 and the Credit Information Companies (Regulation) Act, 2005, we process your personal data based on your explicit, informed, and unbundled consent and for legitimate operational uses:
| Processing Purpose | Data Category Used | Statutory Legal Basis |
|---|---|---|
| Authentication & Account Registration | Mobile Number, OTP, IP Address | User Consent & Contractual Necessity |
| Mobile-to-Details Prefill & KYC Verification | Mobile Number, Name, PAN, DOB | Specific Statutory User Authorization |
| Retrieving Credit Bureau Reports & Analytics | PAN, Mobile, Credit Accounts, CIR Data | CICRA 2005 & DPDP Act 2023 Consent |
| Subscription Billing & Refresh Credit Accounting | Razorpay Order IDs, Contact, Amount | Contractual Performance & Tax Compliance |
| Rectification Dispute Management | Disputed Accounts, Uploaded Documents | Section 21 CICRA 2005 Assistance |
| Security Rate-Limiting & Fraud Prevention | IP Addresses, User Agent, Failed Logins | Legitimate Security Interest & IT Rules 2011 |
Third-Party Disclosures & Authorized Data Processors
We engage trusted, enterprise-grade third-party Data Processors solely to execute technical operations under strict confidentiality and non-disclosure obligations:
- Credit Information Companies (Bureaus): We share your PAN and mobile number with TransUnion CIBIL, Experian India, Equifax India, and CRIF High Mark (and our licensed technical integration partners) solely to query, retrieve, and decode your Credit Information Report.
- Payment Gateway (Razorpay): When you purchase a subscription plan or refresh quota, payment processing is executed securely by Razorpay Software Private Limited. Credit Consultant does not store raw credit/debit card numbers, CVV codes, or net banking passwords. Payment transactions are governed by Razorpay's PCI-DSS compliant infrastructure and RBI guidelines.
- SMS OTP Gateway (HanuOTP): We transmit One-Time Passwords via HanuOTP over Telecom Regulatory Authority of India (TRAI) compliant DLT routes for authentication.
- Law Enforcement & Statutory Bodies: We may disclose personal information when required to do so by a valid order of a court, law enforcement agency, regulatory authority, or under statutory compliance mandates under Indian law.
Data Security Practices & Encryption Safeguards
Pursuant to Section 8 of the DPDP Act, 2023 and Rule 8 of the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (SPDI Rules), we employ multi-layered technical and organizational safeguards:
All data in motion between your browser, our servers, and credit bureau APIs is encrypted using Transport Layer Security (TLS 1.3 / HTTPS).
Passwords are salted and hashed via Bcrypt (cost factor 12). Session state flow tokens are encrypted using authenticated AES-256-CBC cipher blocks.
Uploaded dispute documents are stored in private server directories and restricted behind owner-authenticated download endpoints.
Data Retention & Account Deletion Policy
We retain personal and credit data strictly for the period necessary to deliver our credit monitoring services and maintain dispute documentation:
- Active Account Data: Credit reports, dispute records, and account credentials remain active for the duration of your registered account and active subscription cycle.
- Statutory Accounting & Tax Records: Razorpay payment logs, invoices, and transaction audit trails are retained for 8 (eight) years as mandated by the Companies Act, 2013 and the Income Tax Act, 1961.
- Data Erasure: When you request account closure, we securely delete or anonymize your credit reports, personal profile, and uploaded dispute files, retaining only those records required by statutory law or active judicial proceedings.
Your Statutory Rights as a Data Principal
Under Chapter III of the Digital Personal Data Protection Act, 2023, you enjoy the following legal rights regarding your personal data processed by Credit Consultant:
1. Right to Access Information: You have the right to obtain a summary of your personal data being processed, identity of all third parties with whom data has been shared, and any other information specified by rules.
2. Right to Correction & Erasure: You have the right to request correction of inaccurate data, completion of incomplete records, or erasure of personal data that is no longer necessary for the purpose for which it was collected.
3. Right to Grievance Redressal: You have the right to have your data grievances resolved through our Grievance Redressal Officer within the statutory timeline.
4. Right to Nominate: You have the right to nominate another individual who shall exercise your rights in the event of your death or incapacity.
5. Right to Withdraw Consent: You may withdraw your consent at any time. Withdrawal operates prospectively and does not impact the lawfulness of processing carried out prior to withdrawal.
Cookies, Session Storage & Telemetry
The Platform uses strictly necessary cookies and local storage items:
laravel_session&XSRF-TOKEN: Encrypted HTTP cookies essential for session maintenance, authentication state, and protection against Cross-Site Request Forgery (CSRF).localStorage.theme: Client-side preference flag storing your Dark or Light interface display selection.
We do not employ cross-site tracking cookies, third-party advertising pixels, or invasive telemetry scripts.
Grievance Officer & Data Protection Redressal
If you have any questions, wish to exercise any of your statutory rights under the DPDP Act 2023, or have a privacy grievance, please address your communication to our designated Grievance Officer:
Officer: Nodal Grievance & Compliance Executive
Platform: Credit Consultant
Email: grievance@creditconsultant.in / support@creditconsultant.in
Operating Hours: Monday through Friday, 10:00 AM to 6:00 PM IST (Excluding National Holidays)
Statutory Resolution Timeline: Acknowledged within 48 hours; resolved within 30 days as stipulated under the DPDP Act, 2023 and the Information Technology Rules.