Privacy policy

1. Who we are and what this covers

Credmo Capital ("we", "us", "the platform") operates a referral and lead-management platform through which registered partners (DSAs and Connectors) refer customers to financial products offered by banks, NBFCs, asset management companies, brokers, insurers and fintech companies ("Providers"). This policy covers the website, the Android application and any customer forms opened through a partner's link.

We are a distribution partner. We do not lend money, issue cards, open accounts or underwrite insurance. Once an application is passed to a Provider, that Provider's own privacy policy also applies to the processing of the application.

2. Information we collect

2.1 From partners (DSAs and Connectors)

• Account details: name, mobile number, email address, city and pincode, password (stored only as a secure hash), date of registration, DSA code or referral code used.
• Identity and payout details: PAN number, bank account number, IFSC, account holder name and/or UPI ID, which you provide to receive payouts. A profile photo if you upload one.
• Activity data: leads created, product links shared, link clicks and submissions, wallet transactions, withdrawal requests, notifications, training videos watched, meetings joined, login history, IP address and device/browser information.

2.2 From customers referred by partners

• Details entered in a product application form: name, mobile number, email, city, pincode, PAN, date of birth, employment or business details, requested amount and any other field the Provider requires for that product.
• Documents uploaded in support of an application (for example identity proof, address proof, income proof).
• The partner link or partner account through which the application was created.

2.3 Collected automatically

• Server logs containing IP address, browser or app version, pages visited and timestamps, used for security and troubleshooting.
• Session cookies and secure "remember me" tokens required to keep you logged in.

3. How we use information

• To create and manage partner accounts, verify identity via one-time codes, and prevent duplicate or fraudulent registrations.
• To create, track and process customer applications with the relevant Provider and to show partners the status of their files.
• To calculate, credit and pay out partner earnings, maintain the wallet statement and process withdrawals, including any tax deduction required by law.
• To send transactional communications: OTPs, password resets, lead status updates, payout alerts, product assignments and meeting invites — by email, in-app notification and, where you have opted in, push notification.
• To provide support, respond to enquiries and resolve disputes.
• To keep the platform secure: detect abuse, limit login attempts, maintain audit logs.
• To comply with legal obligations, including tax, accounting and lawful requests from authorities.

We do not sell personal data. We do not use customer application data for advertising.

4. Who we share information with

Recipient	What	Why
Providers (banks, NBFCs, AMCs, brokers, insurers, fintechs)	Customer application details and documents for the product applied for	To process the application. Providers act under their own policies and regulatory obligations.
The partner who created a lead, and that partner's DSA	Customer name, contact and application status	So partners can follow up and track the file they referred.
Our hosting, email delivery and payment/banking service providers	Only the data needed to run the service (for example, your email address to deliver an OTP, your bank details to make a payout)	Infrastructure and operations, under contract.
Government, tax and law-enforcement authorities	As required by applicable law or a valid legal request	Legal compliance.

Partners see only the leads that belong to their own account or, for DSAs, their own team. Admin access is role-based and logged.

5. Storage and security

• All traffic between your device and our servers is encrypted using HTTPS.
• Passwords are stored using strong one-way hashing and are never visible to us.
• Uploaded documents are stored outside the public web directory with randomised file names and served only to authorised users after a server-side access check.
• Database access uses parameterised queries; every sensitive action is checked for authorisation on the server and recorded in an audit log.
• Login attempts are rate-limited and sessions use secure, HTTP-only cookies.

Data is stored on servers located in India or with cloud infrastructure providers that comply with applicable Indian law. No system is perfectly secure; if we become aware of a breach affecting your data we will notify you and the relevant authorities as required.

6. How long we keep data

• Partner account data — for as long as the account is active, and up to 30 days after a verified deletion request.
• Wallet, payout and withdrawal records — for the period required by Indian tax and accounting laws (generally 8 years), anonymised where possible after account deletion.
• Customer application data and documents — for as long as needed to complete the application and to meet the Provider's and our legal obligations, after which it is deleted or anonymised.
• Server and audit logs — typically up to 12 months, unless needed for an ongoing investigation.

7. Your rights and choices

• Access and correction: partners can view and update profile, bank and UPI details from the Profile and Wallet screens. For anything else, contact us.
• Deletion: request deletion of your account and personal data at any time from the Delete account page. Customers can request deletion of application data by contacting us; data already with a Provider must be requested from that Provider.
• Withdraw consent: you may stop using the platform at any time. Some processing (for example retaining payout records) continues as required by law.
• Grievance: if you believe your data has been mishandled, write to our grievance contact in section 12. We aim to respond within 7 working days.

8. Android app permissions

• Internet — required to use the service.
• Notifications — to deliver lead, payout and team alerts. You can switch this off in your device settings.
• Camera / photos / files — requested only when you choose to upload a profile photo or a document. We do not access your gallery otherwise.

The app does not read contacts, SMS, call logs or location. The app uses the same servers and the same data as the website; no additional data is collected by the app itself.

9. Cookies

We use a session cookie to keep you logged in and a secure "remember me" cookie if you choose to stay signed in on a device. These are essential cookies and are not used for tracking or advertising. Clearing cookies logs you out.

10. Children

The platform is for adults aged 18 and above. We do not knowingly collect data from minors. If you believe a minor has registered, contact us and we will remove the account.

11. Changes to this policy

We may update this policy from time to time. The "last updated" date at the top shows the current version. Significant changes will be announced in the app or by email.

12. Contact and grievance officer

For privacy questions, data requests or grievances:

• Credmo Capital
• Email: support@credmo.in
• Or use the contact form.