Privacy Policy

1. About this policy

1.1 This policy explains how Rinncrest Financial Technologies Private Limited collects, uses, shares, stores and protects personal data through:

• (a) Rinn, our Android app (listed on Google Play as Rinn)
• (b) our website, rinncrest.in >, including the tools on it such as the eligibility checker and the;
• (c) the forms and email addresses we publish for support, complaints, partnerships, investor relations, press and careers; and
• (d) the account-deletion form at /delete-account.

1.2 We have written it to meet the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, which are in force today, and the standard set by the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025, whose main obligations apply from 13 May 2027. We have chosen to meet the DPDP standard now rather than wait. It also reflects the data and consent rules in the Reserve Bank of India (Digital Lending) Directions, 2025.

1.3 This policy and the lender's policy work together. For loan-related data, the lender's privacy policy is the governing notice, because the lender is the Data Fiduciary. This policy is written to agree with it, describes the same categories of recipient and the same complaint route, and explains our part. If the two ever appear to differ on a loan matter, the lender's policy governs and we will correct ours. You can read the Lender's privacy policy through the link on our Lending Partners page.

1.4 This policy does not replace your Key Fact Statement, loan agreement or the Terms of Use. It works alongside them.

1.5 You can ask for this policy in any of the languages listed in the Eighth Schedule to the Constitution of India by writing to support@rinncrest.in

2. Words with a special meaning

In this policy:

3. Who we are and the two roles we play

3.1 Rinncrest is a Lending Service Provider. We built and run Rinn, and we provide technology and operating services to the lender. We are not a lender. We do not decide who gets a loan, set interest rates or hold borrowers' money.

3.2 We are also the lender's authorised recovery agent for Rinn loans. If an EMI is missed, our own staff handle reminders, collections and recovery on the lender's instructions; the lender does not use any outside recovery agency for Rinn loans. In that work we remain the lender's Data Processor.

3.3 Because of this, we play two different roles depending on what you are doing :

Pending confirmation: whether creating a Rinn account (mobile number and OTP) before any loan application begins is treated as lender (Data Fiduciary) data or Rinncrest data — this draft treats it as the lender's.

3.4 When the eligibility checker hands you over to Rinn. If you verify your mobile number on our eligibility checker and then start an application in Rinn, the data you give from that point is collected for the lender. The data you entered on the website remains ours and is kept only as long as section 9.6 allows.

3.5 Outsourcing any part of the loan journey to us, including recovery, does not reduce the lender's responsibility to you or to the regulator.

4. The personal data we collect

We collect only what is needed for the purpose we tell you about. We do not ask for data "just in case".

4.1 If you apply for or hold a loan through Rinn

4.2 If you use our website, tools or contact us

4.3 What we do not collect

4.3.1 Rinn does not access your contacts, SMS, call logs, photo gallery or media library, the list of apps installed on your phone, a device fingerprint, or your location continuously or in the background. Section 6.5 lists each of these in plain words.

4.3.2 We do not store biometric data such as fingerprints or face templates. The KYC selfie is a photograph used to verify your identity; it is not converted into a stored biometric template Pending confirmation: that Decentro, which runs the face match and liveness check, returns only a result and does not retain a face template..

4.3.3 We do not ask for your religion, caste, health information, sexual orientation or political views, and we do not use them in any way.

5. Why we use your data, and on what basis

5.1 Indian data-protection law allows personal data to be processed on a small number of grounds. The ones that apply here are:

• Consent — you have said yes, clearly and specifically, after seeing a notice (section 6 explains how we ask);
• Legitimate uses allowed by the DPDP Act — mainly where you have voluntarily given data for a specific purpose and have not said you object, and where processing is needed to comply with a law, a court order or a regulator; and
• Legal obligation — where a law requires the data to be kept or reported, such as the KYC and anti-money-laundering rules.

Under the SPDI Rules, sensitive personal data is collected only with your consent, given in writing (electronically), for the stated purpose.

5.2 Loan-related purposes (the lender is the Data Fiduciary; we act on its instructions)

5.3 Purposes where Rinncrest is the Data Fiduciary

5.4 No other purposes. We do not use your data for any purpose unrelated to the ones above without first telling you and, where required, asking again. We do not use your credit information, or any data collected to assess your loan, for marketing or advertising, and we do not build advertising profiles of you. Section 7.5 sets out the other things we never do with your data.

6. Consent and app permissions

This section sets out every consent and phone permission Rinn asks for, the consents our website asks for, what happens if you say no, and how to withdraw each one.

Who you are consenting to, and how we ask

6.1 Who you are consenting to. Consents you give in Rinn for your loan are given to the Lender, which is the Data Fiduciary for loan-related data. Rinncrest collects and records them on the lender's behalf as its Data Processor. Consents you give on our website, such as for the eligibility checker, are given to Rinncrest.

6.2 How we ask. Every consent request is preceded by a short notice that tells you, in plain language:

• (a) exactly which data will be collected;
• (b) what it will be used for;
• (c) how long it will be kept;
• (d) how to withdraw the consent and use your other rights; and
• (e) how to make a complaint, including to the Data Protection Board of India.

You then give consent by a clear action: tapping a button that says what it does, or ticking an unticked box. We never use pre-ticked boxes. Scrolling, continuing to use the app or staying silent is never treated as consent. These rules follow the consent requirements of the Digital Lending Directions, the DPDP Act and Rules, and the SPDI Rules.

6.3 One purpose, one consent. Where purposes are different, the requests are separate. In particular, the credit-bureau enquiry, optional marketing, and keeping your data after a rejected application for future offers each have their own request. You will never be asked to accept marketing, or to let us keep your data for future offers, as a condition of applying. Saying no to an optional consent never affects your loan application.

Phone permissions

6.4 Permissions Rinn uses. Rinn asks for a permission only at the moment it is needed and tells you why first. You can refuse; the table explains what happens if you do.

Pending confirmation: and that the Android manifest contains no permission beyond those listed here.

6.5 Permissions Rinn never asks for. Rinn does not access:

6.6 Changing a permission. You can review or turn off any permission at any time in your phone's settings (Settings → Apps → Rinn → Permissions) Pending confirmation (F-84).. Turning off location or camera after you have finished KYC and submitted your application does not affect a loan already in progress.

Every consent Rinn asks for

6.7 The table follows the order in which you will meet each consent. "Required" means the step cannot continue without it; "optional" means you can say no and carry on exactly as before.

6.8 Accepting the KFS and loan agreement is not a data consent; it is you entering into the loan contract with the lender. Rinn records it, with the time and the version you saw, in the same way.

6.9 Rinncrest does not make the credit decision. Consents 2 to 6 let the lender decide under its own credit policy. Giving them does not guarantee a loan.

Consents on our website

6.10 Where Rinncrest is the Data Fiduciary, our website asks for these consents:

Withdrawing a consent

6.11 Ways to withdraw. You can withdraw any consent at any time, and it is as easy as giving it:

• In Rinn: Settings → Privacy and consents Pending confirmation: in-app consent screen exists and its menu path.;
• By email: support@rinncrest.in Pending confirmation (F-59)., from your registered email address or quoting your registered mobile number;
• Marketing: the unsubscribe link in any email, or reply STOP to any SMS or WhatsApp message;
• Phone permissions: your phone's settings (section 6.6);
• Website analytics: your browser's cookie settings, or Google's opt-out add-on (section 13).

6.12 What happens when you withdraw each consent. Numbers refer to the table in section 6.7.

6.13 What withdrawal does and does not do. Withdrawal stops further processing for that purpose from the time it takes effect. It does not make earlier processing unlawful. Data tied to a legal retention duty is kept only for as long as that duty lasts and is then deleted or anonymised (section 9). We act on a withdrawal within Pending confirmation: consent-withdrawal turnaround — proposed 2 working days. of receiving it and confirm by SMS or email when it is done.

6.14 If you want your data deleted, rather than only stopping a consent, use the account-deletion form.

The consent ledger

6.15 Every consent you give or withdraw is recorded. Each entry holds:

• the consent type and the exact wording and version you were shown;
• what you did (accepted, declined or withdrew);
• the date and time;
• your IP address and device or browser type; and
• the channel (app, website, email).

6.16 The consent ledger is tamper-evident: entries cannot be altered or deleted once written. It exists so that you, the lender and a regulator can see exactly what you agreed to, and when.

6.17 It is kept for the life of your relationship with the lender plus 8 years, as the lender's retention schedule requires, and then deleted Pending confirmation (F-86).. This applies even after other data is deleted, because it is the proof that your data was handled lawfully.

6.18 You can ask for a copy of your consent history at support@rinncrest.in. We will send it within 30 days Pending confirmation: consent-history export turnaround..

Consent Managers

6.19 The DPDP Act allows you to give, manage, review and withdraw consent through a Consent Manager registered with the Data Protection Board of India. Registration of Consent Managers is scheduled to open on 13 November 2026 Pending confirmation: DPDP Rules phased commencement date for Consent Manager registration.. Once registered Consent Managers are operating, we will update this policy to explain whether, and how, you can use one with Rinn and Rinncrest.

7. Who receives your data: service providers and sharing

7.1 We share personal data only with the categories of organisation in section 7.4, only what each one needs, and only for the purposes in section 5. Sharing is limited to what is strictly needed for the lending process, as the Digital Lending Directions require. These are the same categories of recipient that the lender's privacy policy describes.

7.2 For loan-related data, Rinncrest acts as a Data Processor for the lender, and the providers below that handle loan data act as sub-processors on the lender's instructions. For data where Rinncrest is the Data Fiduciary, such as website enquiries, the providers act on our instructions.

The safeguards every provider must meet

7.3 Every service provider that handles personal data for us or for the lender must, under a written contract:

• (a) process it only on documented instructions and only for the stated purpose;
• (b) keep it confidential, and limit access to staff who need it and are bound by confidentiality;
• (c) protect it with security at least as strong as this policy describes, including encryption in transit and at rest;
• (d) store and process it in India, and if any processing happens outside India incidentally, delete it there and bring it back within 24 hours;
• (e) not pass it to anyone else without prior written approval, and impose the same terms on anyone it does use;
• (f) tell us about any personal data breach without delay Pending confirmation: contractual breach-notification window for vendors — proposed within 6 hours of discovery.;
• (g) help us and the lender respond to your rights requests;
• (h) delete or return the data when the service ends, and confirm in writing that it has done so; and
• (i) allow audits by us, the lender and regulators, including the Reserve Bank of India.

Who receives personal data

7.4 The table lists every category of recipient, with named organisations where we can name them.

What we never do

7.5 We never:

• sell or rent personal data;
• share personal data with data brokers;
• use your credit information, or data collected to assess your loan, for marketing or advertising, or share it with anyone for their marketing;
• give any provider access to your contacts, SMS, call logs, photo gallery or installed apps, because Rinn does not access them; or
• let our recovery staff, or anyone else, contact your friends, family or colleagues using data from Rinn.

7.6 No other lender. We do not share your personal data with any other lender or financial institution unless you have asked for it through a feature that clearly says so. Today there is only one lender on Rinn.

7.7 Business changes. If Rinncrest is ever involved in a merger, acquisition or transfer of its business, personal data may pass to the new owner only under the same protections as this policy, and we will tell you before it does.

Other websites and services

7.8 Rinn and our website link to other services, such as the lender's website, Google Play, the RBI websites and, during your application, verification or payment pages run by regulated providers. Those services have their own privacy notices, which we encourage you to read. This policy does not cover sites we do not control. Where a provider works for us or for the lender as a processor inside the Rinn journey, it is bound by section 7.3 and listed in section 7.4.

Keeping this list up to date

7.9 We review this list at least every six months and whenever we appoint or change a provider Pending confirmation: review frequency.. Section 18.3 explains when we tell you about a change.

7.10 You can ask us for more detail about any provider that handles your data at support@rinncrest.in.

8. Where your data is stored

8.1 Rinn app and user account data is stored on servers located in India. Website analytics collected by Google Analytics is processed by Google and may be processed outside India.

8.2 If any processing ever takes place outside India incidentally, the data is deleted from the system outside India and brought back to India within 24 hours, as the Digital Lending Directions require.

8.3 We do not transfer personal data to any country or territory that the Government of India restricts under the DPDP Act.

8.4 WhatsApp. WhatsApp messages travel through Meta's WhatsApp Business Platform before they reach us, and WhatsApp's own terms and privacy policy apply to your use of WhatsApp. Once received, your WhatsApp messages and media are stored encrypted in our systems

9. How long we keep your data

9.1 The principle. The DPDP Act requires personal data to be erased once its purpose is served or consent is withdrawn, unless another law requires it to be kept. Lending is a regulated activity, and several laws do require certain records to be kept for set periods. We keep those records for those periods, restrict who can see them, and delete or anonymise them when the period ends. These periods are ceilings set by law, not entitlements. We do not keep personal data indefinitely.

9.2 Two schedules. For loan-related data, the lender is the Data Fiduciary, and its Board has approved the schedule in section 9.3, which we apply as its Data Processor. For data where Rinncrest is the Data Fiduciary, such as website enquiries, the schedule in section 9.6 applies.

Loan-related data (the lender's schedule)

9.3 The schedule below applies to every borrower and applicant Pending confirmation: retention schedule adopted from the Lender's Board-approved policy; counsel to confirm each row and its basis..

9.4 Records kept even for a rejected application. The consent ledger entries showing what you agreed to, and the fact and date of the decision, are kept under the consent-ledger row, even when the rest of your application data is deleted. They prove that your data was collected and deleted lawfully Pending confirmation: whether KYC records created for an applicant who is later rejected fall under the 30-day rule or the 5-year KYC rule — counsel to reconcile..

9.5 When is a loan "closed"? A loan is closed when the lender's records show nothing more is payable on it and the account has been closed in its books, for example after full repayment, foreclosure or exit during the cooling-off period. See Closing your loan and getting your NOC.

Data where Rinncrest is the Data Fiduciary

9.6 Pending confirmation: retention periods for Rinncrest's own data — proposed in this draft; not part of F-86.

Credit-bureau reporting

9.7 The lender reports loans to credit information companies, such as TransUnion CIBIL, Experian, Equifax and CRIF High Mark. This is the lender's legal obligation, and it continues independently of anything in this section. The credit information companies keep that information for as long as required under applicable credit information regulations. Deleting your Rinn account, or asking us to delete your data, does not remove your loan from your credit report. If you think something on your credit report is wrong, see Your loan and your credit report.

What "deletion" and "anonymisation" mean

9.8 Deletion We delete personal data when it is no longer required for the purpose for which it was collected,unless we are required to retain it under applicable law, regulatory requirements, or for legitimate legal, security, or fraud-prevention purposes.

9.9 Backups Data stored in encrypted backups is deleted or overwritten in accordance with our backup-retention cycle. Backups are used only for security, recovery, or business-continuity purposes.

9.10 Anonymisation Where personal data is anonymised so that an individual can no longer reasonably be identified, it is no longer treated as personal data. We may use anonymised or aggregated information for analytics, reporting, and service improvement.

9.11 Legally Required Retention Where data must be retained to comply with applicable Indian laws, RBI requirements, regulatory obligations, or legal proceedings, we retain it for the required period and restrict access to authorised personnel.

When data may be kept longer: legal holds

9.12 We or the lender may keep specific data beyond the periods above only while one of these applies:

• a dispute, complaint or legal claim about it is open;
• a court, tribunal or regulator has ordered it to be kept;
• it is needed for an investigation by a regulator or law-enforcement agency; or
• it is needed to investigate suspected fraud or identity misuse.

9.13 A legal hold covers only the data needed for that purpose. When the matter ends, the normal period applies again, and if it has already passed, the data is deleted or anonymised.

Asking us to delete your data

9.14 You can ask us to delete your account and your data at any time using the account-deletion form. Data covered by a legal retention period will be kept for that period, restricted as described in section 9.11, and then deleted. Everything else will be deleted.

10. How we protect your data

10.1 We protect personal data with security measures appropriate to its sensitivity, including:

• encryption of data in transit and at rest;
• role-based access, so people see only what their job needs, with least-privilege access and multi-factor authentication for administrative access Pending confirmation: MFA on administrative access.;
• logging of every access to, and change of, personal data;
• a consent ledger and audit trail that cannot be altered or deleted once written;
• written contracts, security reviews and confidentiality duties for every service provider (section 7.3) and every member of staff; and
• an information security management system certified to ISO/IEC 27001:2022.

10.2 These measures are intended to meet the "reasonable security practices" standard of the SPDI Rules and the security safeguards the DPDP Rules require. A public summary is on our Information security page, where you can also report a vulnerability to support@rinncrest.in.

10.3 No system connected to the internet is perfectly secure. Please help protect your account: never share your OTP, PIN or password with anyone, including someone claiming to be from Rinn. Rinn and Rinncrest never ask for them. See Fraud alerts and Verify it's really us.

11. Your rights

11.1 You have the following rights over your personal data. Some are already available to you under the SPDI Rules and the Digital Lending Directions; we extend the full set the DPDP Act provides to you now.

11.2 How we handle your request. We may ask you to confirm your identity, usually with an OTP sent to your registered mobile number, before we act. We will not charge you. We will acknowledge your request within Pending confirmation (F-51). working days and respond in full within 30 days. If we cannot do what you asked, for example because a law requires a record to be kept, we will tell you why and what we will do instead.

11.3 If the request is about loan data. The lender is accountable for loan-related data, so we act on your request under its instructions. You can send the request to us, and we will pass it to the lender within Pending confirmation: processor-to-lender forwarding time — proposed 2 working days. and keep you informed, or you can write to the lender directly.

11.4 Your duties. The DPDP Act also asks you to give accurate information, not to impersonate anyone and not to file false or frivolous complaints.

12. Children

Loans through Rinn are available only to adults who can enter into a binding contract and meet the lender's eligibility criteria, including the age range of 18 to 55 years Pending confirmation (F-28).. Rinn and our website are not intended for anyone under 18, and we do not knowingly collect their personal data. If we learn that we have collected personal data of a child, we will delete it, subject only to any law that requires otherwise.

13. Cookies on our website

13.1 This section explains how Rinncrest uses cookies on rinncrest.in. For cookie-based data, Rinncrest is the Data Fiduciary. The Rinn app does not use browser cookies; how the app handles data, including any software components from service providers, is explained in sections 4 to 7.

13.2 What cookies are. A cookie is a small text file that a website stores in your browser. Similar technologies include local storage, session storage and pixels, which store or read information on your device in comparable ways. In this policy, "cookies" includes them all.

13.3 First-party cookies are set by rinncrest.in. Third-party cookies are set by another organisation's service used on our site. Session cookies are deleted when you close your browser; persistent cookies stay for the period shown in section 13.5.

13.4 The cookies we use. The only non-essential tool on our website is Google Analytics (GA4). It sets two cookies, _ga and _ga_<container-id>, each expiring after 2 years. Google Analytics (GA4) event data is kept for 14 months. We use it to understand which pages are visited and how people arrive, in aggregated form. We do not use advertising cookies, remarketing or social media pixels, and we do not use cookies to build cross-site profiles, to collect your credit information, or to read anything you enter into a loan application. Strictly necessary cookies, if any, are limited to keeping the site secure. The full list, with names, providers and durations, is in our Cookie Policy.

13.5 Where to read more. Our Cookie Policy lists every cookie, explains Google's role and says how to opt out.

13.6 No cookie banner. Google Analytics cookies are set when you visit. The site works fully with or without them.

13.7 How to opt out. Block or delete cookies in your browser settings, or install the Google Analytics opt-out browser add-on. A link to our Cookie Policy is in the footer of every page.

13.8 How long data is kept. Google Analytics (GA4) event data is kept for 14 months, which is our GA4 data-retention setting. The _ga and _ga_<id> cookies expire after 2 years.

13.9 Browser controls. You can also block or delete cookies through your browser settings. If you block strictly necessary cookies, some parts of the site, such as forms, may not work.

13.10 Where the data goes. Website analytics is collected and processed by Google and may be processed outside India. The statement in section 8 that data is stored in India covers Rinn app and user account data.

14. Messages we send you, and marketing

14.1 Service messages. While you have an application or a loan, we and the lender send messages you need, such as OTPs, application updates, KFS and agreement copies, EMI reminders, receipts and closure confirmations. These are part of the service and cannot be switched off while the loan is active, though you can choose your preferred channel where a choice exists. Calls about your loan are made only between 8:00 a.m. and 7:00 p.m. Pending confirmation: calling-hours rule as set in the lender's Fair Practices Code..

14.2 Marketing. We send marketing only if you have given a separate consent for it (consent 10). That consent is never pre-ticked and never a condition of a loan. Each marketing message tells you how to stop. You can also stop all marketing by emailing support@rinncrest.in or through the app's settings. We process an opt-out within 2 working days Pending confirmation: marketing opt-out turnaround.. Marketing never uses your credit information.

14.3 We will never ask you, by phone, SMS, email or WhatsApp, for an OTP, PIN, password or any advance fee. Rinncrest only writes from addresses ending @rinncrest.in.

14.4 WhatsApp. We use the WhatsApp Business Platform (Cloud API) to send service updates where you have agreed (consent 8) and to reply when you message us. Any media you send us on WhatsApp is deleted 30 days after the day you send it. To delete your WhatsApp chat history and other account data, use the account-deletion page.

15. Personal data breaches

15.1 If a personal data breach affects loan-related data, we will inform the lender without delay and give it everything it needs, so that it can inform you and the Data Protection Board of India in the manner and within the time the DPDP Rules prescribe.

15.2 If a breach affects data for which Rinncrest is the Data Fiduciary, we will inform you and the Data Protection Board of India ourselves, in the same way.

15.3 Any notice to you will explain, in plain language, what happened, when, what data was involved, the likely consequences, what we are doing about it, what you can do to protect yourself, and who to contact. We also report cyber-security incidents to CERT-In as the law requires.

16. Questions, complaints and escalation

16.1 Start with us. Our Data Protection Officer is Smriti Gupta, Director. You can also raise any data-protection matter with our Grievance Officer.

16.2 We acknowledge complaints within Pending confirmation (F-51). working days and resolve them within 30 days. Please include your registered mobile number, your application or loan number if you have one, and what you would like us to do. The full process is on Raise a complaint and in our Grievance Redressal Policy.

16.3 The escalation route. These are the same levels the lender's privacy policy sets out. You do not have to start again at each level.

16.4 About how your personal data has been handled: once you have used the grievance process above, you may also complain to the Data Protection Board of India.

17. Common questions

Does Rinn read my contacts or SMS?

No. Rinn does not request access to your contacts, SMS or call logs, and it never contacts anyone from your phonebook. Section 6.5 lists everything Rinn does not access.

Why does Rinn need my location?

To check, once, that the lender serves your area and to help prevent fraud. It is captured when you submit your application and never tracked afterwards.

Can I say no to marketing and still get a loan?

Yes. Marketing is a separate, optional consent, and declining it has no effect on your application or the lender's decision.

If I withdraw consent, is my loan cancelled?

No. Withdrawing consent does not cancel a loan or your duty to repay it. To exit a loan early, see the cooling-off period or prepayment and foreclosure.

How long does Rinn keep my data if my loan application is rejected?

Your application data is deleted within 30 days of the decision, unless you have separately chosen to let it be kept for future offers. A record of your consents and the decision is kept to prove the data was handled lawfully.

How long is my credit report kept?

The full credit report is kept for 30 days, encrypted, and then deleted. Only the lender's decision and your score band are kept with your application or loan record.

Can I make you delete my KYC records straight away?

No, not while a law requires them to be kept. KYC records must be kept for 5 years after the loan closes or the relationship ends. During that time they are restricted, and afterwards they are deleted.

Does deleting my data remove my loan from my credit report?

No. Reporting loans to credit information companies is the lender's legal obligation and continues independently of any deletion request.

Who do I complain to about my data or a consent?

Our Grievance Officer, Bipasa Adhikary, at support@rinncrest.in or +91 82309 07903. If you are not satisfied, follow the escalation route in section 16.3.

18. Changes to this policy

18.1 We will update this policy when the law, our services or our practices change. The version number and "Last updated" date at the top always show the current version, and earlier versions are available on request.

18.2 If a change is material, for example a new purpose, a new category of recipient or a change in where data is stored, we will tell you in Rinn and by email or SMS before the change takes effect. Where a change needs fresh consent, we will ask for it and will not rely on your continued use alone.

18.3 In particular, we will update this policy before:

• a new category of service provider starts receiving personal data, or any provider starts processing outside India (section 7);
• any change that shortens your rights or lengthens a retention period takes effect (section 9), and we will tell you about it; and
• we add or change a cookie (section 13).

19. Contact

Manage your consents

Delete your account