This Privacy Policy explains how Bharosa (“we”, “us”) collects, uses, stores, and shares personal information when you use our peer-to-peer microfinance platform. We process data in accordance with the Information Technology Act, 2000, the Digital Personal Data Protection Act, 2023 (as applicable), and RBI / KYC expectations for regulated lending marketplaces.
1. Data we collect
We collect identity data (name, date of birth, PAN, Aadhaar where lawfully obtained, photograph, live selfie, consent video, e-signature), contact data (mobile, email, address, pincode), emergency contact references the Borrower chooses to share, financial data (bank account, IFSC, stated income, employment, source of funds), device data (IP address, device fingerprint, approximate location), and transaction data (loan requests, EMIs, wallet ledger, Razorpay payment references).
2. Why we use it
We use this information to create and secure your account, complete KYC and AML checks, generate loan agreements, match Borrowers and Lenders, disburse and collect funds, apply late fees, operate the Risk Management Fund, prevent fraud, provide customer support, and meet legal, tax, and audit duties.
3. Sharing
We share data with: (a) Lenders or Borrowers to the limited extent needed to perform a loan; (b) payment partners such as Razorpay; (c) cloud storage providers that host KYC media under contract; (d) Credit Information Companies (including TransUnion CIBIL and other RBI-licensed CICs) for reporting repayment and default; (e) recovery agents and professional advisers; and (f) courts, regulators, or law-enforcement when legally required. We do not sell personal data for advertising.
4. KYC media
Selfies, identity-document photos, and consent videos are uploaded to a secured cloud bucket. Only the file URL is stored in our database. Media is retained for the period required for KYC, dispute, and statutory record-keeping, including after a loan is closed.
5. Retention and security
We use encryption in transit, access controls, and least-privilege admin roles. No method of transmission is perfectly secure. You must keep your Google account and device secure. We retain account and loan records for as long as the account is active and thereafter as required by law and legitimate recovery or tax needs.
6. Your rights
Subject to applicable law, you may request access, correction, or erasure of personal data, or withdraw consent where processing is based solely on consent. We may refuse erasure where we must keep records for an outstanding loan, dispute, or legal obligation. Contact in-app support or the grievance channel published in the app.
7. Children
The Platform is not directed at persons under 18. We do not knowingly onboard minors.