Privacy Policy

Last updated: 16 September 2026

This policy explains what personal information ActivPaisa collects when you use this website or apply through it, why we collect it, who we share it with, how long we keep it, and the choices you have. It is meant to be read rather than filed — if anything here is unclear, write to our Grievance Officer at the address in section 13.

1. Who we are

ActivPaisa is a digital financial services platform operated by NexQred Fintech Private Limited (“ActivPaisa”, “we”, “us”). Registered office: B-209, Tower B, Logix Technova, Sector 132, Noida, Uttar Pradesh – 201304, India. CIN: U62091UW2026PTC250727.

Under the Digital Personal Data Protection Act, 2023 and the rules made under it, we are the Data Fiduciary for the personal data described here, and you are the Data Principal.

We are not a bank or an NBFC, and we do not lend. Loans and credit facilities introduced through ActivPaisa are provided by regulated lending partners. Each partner decides your application under its own criteria and handles your data under its own privacy policy. Our partners, and links to their policies, are listed under Our Lending Partners.

2. What this policy covers

It covers activpaisa.com, its pages, and the customer portal. It does not cover:

• a lending partner’s own site, app or processing once your application reaches them — their privacy policy governs that, and each is linked from the partner’s card on our home page;
• a credit bureau’s own handling of your credit information, which is governed by the Credit Information Companies (Regulation) Act, 2005 and the bureau’s own policy;
• any other website you reach by following a link from ours.

3. What we collect

3.1 What you give us

• Identity — name, gender, date of birth and PAN.
• Contact — mobile number, email address, residential address, city, state and PIN code.
• Employment and income — whether you are salaried or self-employed, your employer or business name, monthly income, household income, years in business and GSTIN where these apply.
• What you are applying for — product, amount and tenure.
• What you tell us about your credit — existing EMIs, credit card outstanding and minimum due, time in your current job, recent loan enquiries and any missed payments. These are your own answers, and on their own they produce an estimate, which we label as an estimate.
• Documents you upload — such as identity and address proof, salary slips or bank statements, where a partner requires them.
• Your declarations and consents — the boxes you tick, recorded with the date, time, IP address and browser they were given from.

3.2 What we collect automatically

• Your IP address, browser and device type, and which pages you viewed.
• Cookies and similar technologies, including an advertising pixel — section 8.
• If you sign in to the customer portal, a session token stored in your browser so you stay signed in.

3.3 What we obtain from others

• PAN verification. We check the PAN you enter against the issuing records through a verification service, to confirm the name and date of birth on it. This is why those details can appear in the form without you typing them again.
• Your credit report — only if you authorise it. See section 5.
• Application outcomes from lending partners, so we can tell you what happened and help you with next steps.

4. Why we use it

We use your personal data for these purposes and no others:

• To confirm it is you — sending a one-time password to your mobile number, and verifying your PAN.
• To work out what you may be eligible for — matching what you have told us, and your credit report where you have authorised one, against our partners’ published criteria.
• To introduce you to a lending partner and pass on your application so they can decide it.
• To keep you informed about your application, by SMS, WhatsApp, email and telephone.
• To provide customer service, including handling complaints and, where you have agreed, recording calls for quality and evidence.
• To meet legal and regulatory obligations, including record-keeping, and to prevent and detect fraud.
• To improve the platform and to measure whether our advertising works, in aggregate.

We do not sell your personal data, and we do not share it with anyone for their own independent marketing.

5. Your credit report, and the consent it needs

Fetching your credit report is optional and separate from applying. On the application form it is an unticked box. Leave it unticked and your application proceeds exactly as it would otherwise; we then show you an estimate based on your own answers, and say so on the screen.

If you do tick it:

• we ask a credit bureau — CRIF High Mark, or TransUnion CIBIL — for your credit information;
• we use it to show you your actual score and a more realistic view of your approval chances, and to match you to partners whose criteria you genuinely meet;
• we record the authorisation itself — what you agreed to, when, and from which device — because we must be able to demonstrate to a bureau and to a regulator that you asked for it.

We request this report on your behalf, to show you your own position. Separately, a lending partner may run its own credit enquiry when it formally assesses your application; that enquiry is theirs, made under your agreement with them.

You can withdraw this authorisation at any time by writing to grievance@activpaisa.com. Withdrawal stops any further bureau checks. It cannot undo a report already obtained, or a decision a partner has already taken.

6. Who we share it with

• Lending partners. When you apply, your application is shared with the partner or partners able to consider it, so they can assess and decide it. From that point the partner holds your data in its own right, under its own privacy policy.
• Credit bureaus, where you have authorised a credit check.
• Service providers acting on our instructions and only for us — cloud hosting and document storage, SMS and WhatsApp messaging, email delivery, PAN verification, and error monitoring. They may use your data only to provide that service to us.
• Advertising and measurement platforms, in the limited way described in section 8.
• Authorities and regulators, where the law requires disclosure, or to establish, exercise or defend a legal claim.
• A successor, if our business or part of it is transferred — this policy continues to apply until you are told otherwise.

7. Where it is stored

Your data is held on servers located in India, operated for us by our cloud provider. Documents you upload are kept in encrypted storage. A small number of service providers may process limited data outside India; where they do, we transfer only what that service needs and require contractual protections over it.

8. Cookies, pixels and advertising

• Strictly necessary — to keep you signed in to the customer portal and to remember display preferences such as light or dark mode. The site does not work properly without these.
• Advertising measurement — we use the Meta (Facebook) pixel to understand which advertisements bring people to the site, and to show our advertisements on Meta’s platforms. It reports that a page was viewed, along with basic technical information such as your IP address and browser.
• Analytics — we use Google Analytics to understand how people find and use the site: which pages are viewed, in what order, from what kind of device, and from which broad geographic area. We use Google Tag Manager to manage these tags. This tells us which pages are confusing or broken; it is not used to make any decision about you or your application.

We do not send your PAN, income, employment details, documents, credit score or credit report to Meta, to Google, or to any other advertising or analytics platform.

You can control this through your browser’s cookie settings, your device’s advertising settings, the ad preferences in your own Facebook or Instagram account, and Google’s own opt-out at tools.google.com/dlpage/gaoptout.

9. How long we keep it

• Applications and their supporting documents — for the life of the facility and for at least five years afterwards, or after an application is declined or withdrawn, to meet record-keeping and anti-money-laundering requirements.
• Enquiries that never became an application — up to 24 months.
• Credit reports — only for as long as credit information law permits, after which they are deleted.
• Consent records — for as long as we hold the data the consent relates to, plus the limitation period, because they are the evidence of what you agreed to.
• Call recordings and message logs — up to 24 months.

When a retention period ends, we delete the data or irreversibly anonymise it.

10. Your rights

Under the Digital Personal Data Protection Act, 2023, you may:

• Ask what we hold about you, and who we have shared it with;
• Correct or complete anything inaccurate or out of date;
• Have it erased, where we are not required to keep it;
• Withdraw a consent as easily as you gave it — including the credit-check authorisation in section 5;
• Nominate someone to exercise these rights if you die or become incapacitated;
• Complain — to us first, and then to the Data Protection Board of India.

To exercise any of these, write to grievance@activpaisa.com from the email address on your application, or use the details in section 13. We respond within 30 days. Withdrawing a consent does not affect anything done lawfully before you withdrew it, and may mean we can no longer take an application forward.

11. How we protect it

Traffic to and from this site is encrypted in transit, and uploaded documents are encrypted at rest. Access is limited to staff who need it for their role, and is logged. We review these measures periodically.

If a personal data breach occurs, we will notify you and the Data Protection Board of India as required, within 72 hours of becoming aware of it.

No system is perfectly secure, and you can help us keep yours safe: we will never ask you for a password, for an OTP, or for a payment to release a loan. If anyone asks you for these in our name, stop and tell us immediately.

12. Children

Our services are for people aged 18 and over. We do not knowingly collect personal data from children. If you believe a child has given us their data, tell us and we will delete it.

13. Contact and grievances

We acknowledge complaints within 48 hours and aim to resolve them within 30 days. The full process, and where to escalate, is set out on our Grievance Redressal page. If your complaint is about a loan itself rather than about us, the lending partner handles it — each partner’s grievance route is on its card under Our Lending Partners.

14. Changes to this policy

We update this policy when our practices or the law change. The date at the top always shows when it last changed. Where a change materially affects how we use your data, we will tell you directly before it takes effect.