GrapLoan Privacy Policy

1. Policy Basis and Legal Framework

1.1 Policy Purpose

Grapeinfo Technology Private Limited (hereinafter referred to as "we," "us," or "our") respects and is committed to protecting your personal privacy. This Privacy Policy (hereinafter referred to as the "Policy") is intended to clearly and transparently explain to you how we collect, use, store, protect, and share your personal information through the GrapLoan application (hereinafter referred to as the "App").

1.2 Legal Basis

This Policy is formulated in accordance with India's Digital Personal Data Protection Act, 2023 (DPDP Act 2023) and the Digital Personal Data Protection Rules, 2025. We are committed to processing your personal data on the principles of lawfulness, fairness, transparency, necessity, and data minimization.

1.3 Scope of Application

This Policy applies to all of the following scenarios:

• 1.3.1 You download, register for, and use the GrapLoan mobile application.
• 1.3.2 You apply for a revolving credit line and conduct subsequent drawdown and repayment operations through the App.
• 1.3.3 You visit our official website and related digital channels.
• 1.3.4 All online interactions and customer service communications between you and us.

1.4 Your Consent

By using the App, you signify that you have read and understood all the contents of this Policy and voluntarily grant us your consent to process your personal information. In accordance with Article 6 of the DPDP Act, your consent must be freely given, specific, informed, unambiguous, and made through a clear affirmative action. If you do not agree to any term of this Policy, please immediately cease using the App and related services.

1.5 Description of Service Nature

GrapLoan is a personal revolving credit line service platform that provides you with a revolving credit line service. With just one credit assessment and credit approval review, you can obtain an exclusive revolving credit line, which you can draw down at any time and repay at any time during the validity period. After repayment, the credit line is automatically restored, enabling the revolving use of funds.

As the direct provider of this service, we are responsible for credit assessment, credit line granting, fund disbursement, and account management, ensuring that every fund flow is clearly traceable, compliant, and transparent.

2. Scope and Methods of Information Collection

2.1 Information You Voluntarily Provide

To complete credit assessment, credit line granting, and revolving loan services, you are required to provide the following categories of information. We collect only the minimum data necessary to achieve clear purposes and do not collect beyond that scope:

2.1.1 Identity Information:

• Your legal full name, date of birth, and gender.
• Your PAN card number, Aadhaar number, and other government-issued valid identification document information, used to verify your true identity.

2.1.2 Personal Background Information:

• Your educational background, marital status, and number of family members.
• Your email address, mobile phone number, and other contact information.

2.1.3 Financial and Employment Information:

• Your income details, occupation type, and employer name.
• Your bank account information and employment details, used to assess repayment capacity and credit status.

2.1.4 Credit Line Usage Information:

• The drawdown amount you apply for, your repayment term selections, historical repayment records, and other data directly related to the use of the revolving credit line.

2.2 Description of Device Permissions Obtained

To ensure service security, prevent fraud, and optimize user experience, we may request the following device permissions with your explicit authorization. All permissions are granted on a per-use basis, and you may enable or disable them at any time through your mobile device's system settings.

2.2.1 Camera Permission:

• Purpose: Strictly used for identity verification (KYC) processes, including identification document photography, facial comparison, and liveness detection.
• Scope: Photographing images of documents such as PAN cards and Aadhaar cards, as well as capturing user facial images during liveness detection.
• Restrictions: Used only in identity verification and risk control processes; does not involve continuous background operation; not used for advertising or marketing purposes.

2.2.2 Approximate Location Permission:

• Purpose: Used to determine service availability and assist in risk assessment and fraud detection.
• Scope: Approximate geographic location inferred from network, Wi-Fi, cell tower, or IP address.
• Restrictions: Used only to the extent necessary for providing relevant services; no continuous background tracking; not used for advertising.

2.2.3 SMS Permission:

• Purpose: Used for automatic recognition and filling of OTP verification codes during account registration, login, and identity verification processes.
• Scope: Limited to SMS content directly related to verification codes and related service verification.
• Restrictions: Used only to the extent necessary for identity verification and related services; does not read other SMS content; not used for advertising or marketing.

2.2.4 Important Compliance Statement:

In accordance with Google Play's specific requirements for personal loan applications in India, this App does not request the following prohibited sensitive permissions: Contacts (READ_CONTACTS), Precise Location (ACCESS_FINE_LOCATION), External Storage (READ_EXTERNAL_STORAGE), Media Files (READ_MEDIA_IMAGES), Phone Numbers (READ_PHONE_NUMBERS).

2.3 Information Automatically Collected by the System

During your use of the services, the system may automatically record the following technical information:

• 2.3.1 Basic device information, including device model, operating system version, and application version number.
• 2.3.2 Log information, including access time, operation paths, and feature click sequences.
• 2.3.3 Error reports and crash logs, used for problem diagnosis and system optimization.
• 2.3.4 Preference settings and usage behavior data collected through Cookies or similar technologies.

2.4 Information Collection by Third-Party SDKs

To ensure business security and risk control, we may use third-party SDKs for fraud risk identification. These SDKs may obtain device identifiers, network information, device type, and sensor data to construct device fingerprints and risk profiles. All third-party SDKs are used in accordance with the data minimization principle and collect information only to the extent necessary.

3. Purposes and Legal Bases for Using Information

3.1 Core Service Purposes

We use your information solely for lawful, clear, and necessary business purposes:

3.1.1 Identity Verification and KYC:

• Completing the full "Know Your Customer" (KYC) process to verify your identity authenticity.
• Using technical means such as document comparison, facial recognition, and liveness detection to effectively prevent identity impersonation risks.

3.1.2 Credit Assessment and Credit Line Granting:

• Conducting comprehensive credit assessment based on the identity information, financial status, and credit history you submit.
• Determining your exclusive revolving credit line and corresponding interest rate pricing through automated risk control systems.

3.1.3 Credit Line Usage and Fund Management:

• Verifying credit line availability and completing the approval process when you initiate a drawdown request.
• Arranging rapid fund disbursement and restoring available credit in real time upon your repayment.

3.1.4 Risk Assessment and Anti-Fraud:

• Building device fingerprints, behavioral models, and multi-dimensional correlation analysis.
• Identifying abnormal drawdown behavior, multiple account registrations, and potential fraud risks.

3.1.5 Account Management and Customer Service:

• Continuously maintaining the status of your revolving credit line account.
• Responding to and handling various inquiries and requests you may have during use.

3.2 Compliance and Legal Obligations

We may process your information based on the following legal or regulatory requirements:

• 3.2.1 Compliance with the Digital Personal Data Protection Act, 2023 (DPDP Act 2023) and its implementing rules.
• 3.2.2 Fulfilling the regulatory requirements of the Reserve Bank of India (RBI) applicable to credit service providers.
• 3.2.3 Responding to lawful information disclosure requests from government agencies or judicial authorities.
• 3.2.4 Complying with anti-money laundering laws and regulations.

3.3 Service Optimization and Product Improvement

Without identifying individuals, we may conduct the following analyses on aggregated or anonymized data:

• 3.3.1 Optimizing app feature interactions and operational workflows to improve user experience.
• 3.3.2 Enhancing system stability, accelerating loading speed, and fixing known errors.
• 3.3.3 Optimizing credit line product display and recommendation strategies based on user behavioral characteristics.

3.4 Notifications and Communications

We will send the following service-related information to you via SMS, in-app notifications, email, and other means:

• 3.4.1 Credit assessment and credit line approval result notifications.
• 3.4.2 Drawdown application status updates (submission successful, under review, disbursement notification).
• 3.4.3 Repayment reminders (upcoming due date reminders, overdue notices, repayment confirmations).
• 3.4.4 Credit line restoration notifications (credit line automatically restored after repayment).
• 3.4.5 One-Time Password (OTP) verification messages.
• 3.4.6 Account security notifications (login alerts, device changes).
• 3.4.7 Platform announcements (system maintenance, feature updates, policy changes).

3.5 Marketing and Promotions

Based solely on your separate consent:

• 3.5.1 With your explicit opt-in consent, we may push information about new product launches, limited-time promotional offers, and personalized product recommendations based on your usage preferences.
• 3.5.2 You have the right to withdraw your marketing consent at any time through means including but not limited to: disabling it through in-app settings, contacting customer service, or clicking the unsubscribe link in SMS messages.
• 3.5.3 Withdrawal of marketing consent does not affect your ability to use core credit line services in any way. In accordance with the DPDP Act, withdrawal of consent must be as easy as giving consent, and we commit to processing your withdrawal request within a reasonable timeframe.

4. Sharing and Disclosure of Information

4.1 Sharing with Service Providers

We may engage third-party service providers to assist us in operating the Platform, with sharing limited to the minimum data necessary for providing services:

• 4.1.1 Cloud infrastructure and data storage service providers.
• 4.1.2 Data analysis and statistics service providers.
• 4.1.3 Customer service systems and ticket management service providers.
• 4.1.4 Security monitoring and risk control technical support service providers.

The above service providers are all contractually bound to confidentiality obligations and may not use data for any purposes beyond those agreed upon. As a data fiduciary, we are fully responsible for data processing throughout the entire process and have entered into binding contracts with all data processors, specifying processing instructions, confidentiality obligations, and security standards.

4.2 Circumstances of Lawful Disclosure

We may disclose your information in accordance with the law in the following circumstances:

• 4.2.1 Providing credit-related information to Credit Information Companies in accordance with the law to fulfill RBI guideline requirements.
• 4.2.2 When required by laws, regulations, judicial authorities, government agencies, or regulatory bodies with lawful directives.
• 4.2.3 When necessary to protect the personal or public safety of users or the general public.
• 4.2.4 In the event of major transactions such as mergers, acquisitions, or asset transfers, data may be transferred in accordance with the law (we will provide advance notice).
• 4.2.5 Other circumstances with your explicit authorization.

4.3 We Never Sell Your Data

We solemnly commit:

• 4.3.1 We will never sell or rent your personal data to any third party.
• 4.3.2 We will never use your information for unauthorized marketing or promotional activities.
• 4.3.3 We will never push advertisements to third parties without your separate authorization.
• 4.3.4 We will never access or misuse your personal data without authorization.

5. Data Security and Storage

5.1 Data Storage Location

Your personal information is primarily stored on secure servers within India and is subject to Indian law. In accordance with the requirements of the RBI Digital Lending Guidelines and DPDP rules, we ensure localized data storage and do not transfer personal data to overseas servers without legal permission.

5.2 Security Protection Measures

We employ a multi-layered security protection system covering technology, management, and personnel to fulfill the obligation of "reasonable security safeguards" under Article 8(5) of the DPDP Act:

5.2.1 Transmission Encryption:

• Using TLS/SSL protocols to encrypt all network-transmitted data, ensuring information is not intercepted or tampered with during transmission.

5.2.2 Storage Encryption:

• Encrypting sensitive fields such as identification document numbers and bank account information at the database level.

5.2.3 Access Control:

• Establishing strict access control mechanisms, granting only authorized personnel in necessary positions access to user data on a minimum-necessary basis.

5.2.4 Log Retention:

• Retaining logs of access, modification, and deletion for at least one year in accordance with DPDP rules.

5.2.5 Regular Audits:

• Conducting periodic reviews of system security, data access logs, and operational activities.

5.2.6 Personnel Management:

• All employees sign strict confidentiality agreements and receive regular data protection and privacy security training.

5.3 Data Retention Period

We retain your data only for as long as necessary to provide services and as required by law:

• 5.3.1 Retaining necessary information during the existence of your account and the validity period of the credit line to maintain normal service operation.
• 5.3.2 After account closure or settlement of all debts, data shall be deleted upon completion of the purpose, unless legal requirements mandate extended retention. In accordance with the DPDP Act, statutory records such as KYC records, credit approval documents, and transaction histories must be retained in accordance with the law and may only be used for compliance and record-keeping purposes, and may not be used for new marketing or profiling activities.
• 5.3.3 After the retention period expires, data will be securely deleted or anonymized.

5.4 Data Breach Emergency Response

In the event of a personal data breach, we will immediately activate emergency response procedures:

• 5.4.1 Report to the Data Protection Board within 72 hours of becoming aware of the breach.
• 5.4.2 Notify affected users without undue delay, explaining the nature of the breach, potential impact, and response measures taken.
• 5.4.3 Cooperate with the Data Protection Board's investigation and rectification requirements in accordance with the law.

6. Your Data Subject Rights

6.1 Overview of Rights

Under the Digital Personal Data Protection Act, 2023 (DPDP Act 2023), as a data subject, you have the following statutory rights over your personal data:

6.1.1 Right to Information and Access:

• You have the right to know whether we hold your personal data and to access its contents, including information on data recipients, processing purposes, and methods.

6.1.2 Right to Consent and Withdrawal:

• You have the right to grant or refuse consent for data processing and to withdraw consent previously granted at any time. Withdrawal must be as easy as giving consent.

6.1.3 Right to Correction and Update:

• When you find that your personal data is inaccurate or outdated, you have the right to request correction or updating.

6.1.4 Right to Erasure:

• Under certain circumstances (e.g., data is no longer necessary, consent has been withdrawn and no other legal basis exists), you have the right to request deletion of your personal data. However, please note that statutory retention obligations may limit the scope of exercising the right to erasure.

6.1.5 Right to Complain:

• If you believe your personal data has been misused or your privacy rights have been violated, you have the right to lodge a complaint with the Data Protection Board.

6.1.6 Right to Nomination:

• You may designate another person to exercise your data rights on your behalf (e.g., in cases of illness or other limitations).

6.2 How to Exercise Your Rights

To exercise any of the above rights, please contact us through the contact information provided in Chapter 9 of this Policy. We will respond to your request within 90 days as stipulated by DPDP rules. We may require you to provide necessary identity verification information to authenticate your identity.

6.3 Consequences of Withdrawing Consent

You have the right to withdraw specific data processing authorizations previously granted to us at any time. Such withdrawal does not affect the lawfulness of processing based on your consent before the withdrawal.

Please note: if you object to the processing of certain personal data, it may affect your credit assessment and credit line granting, thereby affecting your ability to use this service. While you still have unsettled credit line usage obligations with us, withdrawal of consent does not relieve us of our rights and obligations to continue processing your personal data lawfully. When you withdraw consent, we will clearly inform you of the relevant consequences to ensure you make an informed choice.

7. Automated Decision-Making

7.1 Explanation of Automated Decision-Making

We may use automated systems to assess your creditworthiness, including credit scoring, behavioral analysis, and fraud risk identification. Automated decisions will affect your credit line granting, interest rate pricing, and drawdown approval results. Such automated decisions are designed to improve approval efficiency and risk assessment accuracy.

7.2 Your Related Rights

Under the DPDP Act, you have the following rights:

• 7.2.1 To understand the factors considered in automated decision-making.
• 7.2.2 To object to decisions based solely on automated processing.
• 7.2.3 To request human review of decisions when your application is rejected.

If you choose to opt out of automated assessment, it may affect our ability to provide you with credit line services, as this is a core component of credit assessment and credit line granting.

8. Special Provisions

8.1 Protection of Minors

This service is not intended for minors under 18 years of age. In accordance with the DPDP Act and rules, we do not provide services to children, nor do we engage in behavioral monitoring, profiling, or targeted advertising of children. If we discover that we have inadvertently collected personal information from a child, we will promptly take deletion measures.

8.2 Cross-Border Data Transfer

Your personal data is stored by default within India. In accordance with the DPDP Act, should cross-border data transfer be necessary, we will ensure that:

• 8.2.1 Applicable legal requirements are complied with.
• 8.2.2 Adequate data protection measures are implemented.
• 8.2.3 Such transfer is conducted only when necessary and with a lawful basis.

8.3 Cookies and Tracking Technologies

We use Cookies to enhance user experience, conduct risk analysis, and analyze usage behavior. You may disable Cookies through your device system settings, though this may affect the user experience of certain features.

9. Policy Updates and Contact Us

9.1 Policy Updates

We reserve the right to revise this Privacy Policy from time to time:

9.1.1 Update Notifications:

• In the event of material changes involving changes in data processing purposes, scope of permissions, reduction of user rights, or other significant modifications, we will notify you prominently through in-app pop-ups, website announcements, or email notifications.

9.1.2 Effectiveness and Acceptance:

• Revised policies will be marked with a new effective date. Your continued use of the services constitutes your acceptance of the revised policy terms. If you do not agree to the updated terms, you may stop using the App and contact our Data Protection Officer.

9.2 Contact Information

If you have any questions, complaints, or requests to exercise your rights regarding this Privacy Policy or data processing, please contact us through the following means:

• Company Name: Grapeinfo Technology Private Limited
• Application Name: GrapLoan
• Customer Support Email: [email protected]
• Official Website: https://grapeinfotechnology.com/

Response Time:

• We commit to responding within a reasonable timeframe after receiving your request, typically confirming receipt within 15 working days, and completing the processing within 90 days in accordance with DPDP rules.

9.3 Complaint Channels

You have the right to file a complaint directly with the Data Protection Board of India to seek remedies. The Data Protection Board is an independent body established under the DPDP Act, responsible for monitoring compliance, investigating violations, and taking corrective measures. In accordance with DPDP rules, before lodging a complaint with the Data Protection Board, you should first seek resolution through our internal grievance channels described above.

10. Consent and Acknowledgment

10.1 Your Acknowledgment

By using the GrapLoan services and providing us with your personal data, you hereby acknowledge that you have read, understood, and agree to our use, processing, and disclosure of your personal data in accordance with this Privacy Policy.

10.2 Statement Regarding Third-Party Data Providers

If you, as a representative or agent of the Company, provide personal data of third parties (including but not limited to your emergency contacts, family members, etc.), you hereby represent and warrant that:

• 10.2.1 You have obtained lawful and valid consent from such third parties.
• 10.2.2 You have the authority to provide us with their personal data.
• 10.2.3 Such personal data may be used, processed, and disclosed in accordance with this Privacy Policy.

10.3 Governing Law and Jurisdiction

This Privacy Policy is governed by and construed in accordance with the laws of India. Any dispute arising out of or in connection with this Policy shall be submitted to the exclusive jurisdiction of the courts in Delhi, India.