Legal & Support
Privacy Policy
Credit, when life needs it.
LoanDidi (“LoanDidi”, “we”, “us” or “our”) is a brand of 36 Forts Capital Private Limited, Ground Floor, Gore Parisar, Civil Lines, Raipur, Chhattisgarh - 492007. We act as a Lending Service Provider (“LSP”) and operate the LoanDidi website at www.loandidi.com and the LoanDidi app, which is available as an Android app and as a web app at app.loandidi.com (together, the “Platform”). Loans offered through the Platform are made by Collocate Merchants Private Limited (CIN U51109WB1995PTC070852), a Non-Banking Financial Company registered with the Reserve Bank of India (“RBI”), Certificate of Registration No. B-05.05188, registered office at 2A, Ganesh Chandra Avenue, Commerce House, 5th Floor, Room No. 4A, Kolkata, West Bengal - 700013 (the “Lender”). LoanDidi helps you apply, verifies your details, and helps service your loan. The Lender alone decides whether to lend, and sanctions, disburses and holds the loan.
This Privacy Policy explains what information we collect when you use the Platform, why we collect it, who we share it with, where it is stored, how long it is kept, and how you can ask us to correct or delete it. It applies to the website, the Android app and the web app. By using the Platform you confirm that you have read and understood it.
It is written having regard to the Information Technology Act, 2000 and the rules made under it, the Digital Personal Data Protection Act, 2023, the Prevention of Money Laundering Act, 2002, the Credit Information Companies (Regulation) Act, 2005, and the Reserve Bank of India (Digital Lending) Directions, 2025 (the “Digital Lending Directions”), each as amended from time to time. It is meant to say the same thing as the Lender's own privacy policy.
Protect yourself
Our staff never collect cash, and never ask you for your OTP, password, UPI PIN, card number or CVV. If anyone claiming to be from LoanDidi asks for any of these, it is not us. Please report it to contact@loandidi.com or call +91-9009003333.
Contents
- Who is responsible for your data
- Consent
- Information we collect
- Device permissions: what we ask for and what we never ask for
- How we use information
- Who we share it with
- Analytics, advertising and cookies
- Where your data is stored and how we protect it
- How long we keep it
- Deleting your account and data
- Your rights
- Eligibility and children
- Third-party links
- Complaints and contact
- Changes to this Policy
1. Who is responsible for your data
You apply for a loan from the Lender, and the loan is on the Lender's books. LoanDidi collects, processes and keeps your data on behalf of the Lender and as the Lender instructs, under the Digital Lending Directions. The Lender is the regulated entity and decides how your data is used for lending. We use it only for the purposes in this Policy. The retention periods in section 9 are the Lender's.
2. Consent
We collect and use your information only with your consent, and only for the purposes described here. We ask for consent on the Platform, at the step where each kind of information is collected, with an explanation of what it is for. Consents are recorded. The identity of the Lender and of LoanDidi as its LSP is shown to you on the Platform, in your Key Fact Statement and in your Loan Agreement.
You can withdraw a consent at any time by writing to contact@loandidi.com. Withdrawal does not affect anything already done lawfully. If you have an active or outstanding loan, we must keep processing the information needed to service that loan and to meet legal duties until it is closed. A consent you give to an Account Aggregator, DigiLocker or a similar service is managed in that service and can be withdrawn there.
3. Information we collect
We collect what is needed to verify you, to assess, process and service a loan, and to meet our legal duties. We do not collect anything that is not listed here.
a. Information you give us, or confirm through a verification service
| Category | What we collect | Why |
|---|---|---|
| Contact and sign-in | Mobile number and email address, each confirmed with a one-time password (OTP); WhatsApp number; an alternate mobile number and an alternate email address, each confirmed with an OTP; language choice | To sign you in, keep your account secure, and reach you about your application and loan |
| Loan request | Loan amount, tenure and purpose of the loan | To prepare your application and an offer |
| Identity (KYC) | Through DigiLocker, with your consent: your name, date of birth, gender, masked Aadhaar number, address and photograph from your Aadhaar record. Your PAN, checked against the PAN database. | To verify who you are, as KYC rules require, and to check your age |
| Address and work | Your current address, pincode, city and state; whether you are salaried or self-employed; your employer or business; your monthly income | To assess eligibility and repayment capacity |
| Selfie and video | A live selfie and a short video clip that includes the consent line you speak aloud (so it carries your voice); the face match and liveness result | To confirm that you are the person in your KYC record and that the application is yours (video KYC) |
| Bank account and statement | Your bank statement data, read through an RBI-licensed Account Aggregator with your consent, or a statement you upload if the Account Aggregator route does not work; the account number and IFSC of the account you choose for disbursal; the result of the bank account check (a Rs 1 test payment or credit, which returns the account holder's name) | To assess repayment capacity, to confirm the account is yours, and to pay out the loan and collect repayments |
| Credit report | Your credit score and credit report from a credit information company, requested with your consent | To assess creditworthiness, as permitted under the Credit Information Companies (Regulation) Act, 2005 |
| Approximate location | Your approximate location, asked once at the “Last details” step, and the places that the addresses you gave correspond to | To record where the application was made, as the Digital Lending Directions expect, and to compare it with the addresses you stated. You can refuse; see section 4. |
| Agreement and repayment | Your Aadhaar e-sign of the sanction letter, Key Fact Statement and Loan Agreement; your repayment mandate (UPI Autopay or e-NACH); loan amount, interest, fees, repayment schedule, payments made and amounts due | To make the loan agreement, and to service and collect the loan |
| Messages and calls | What you write to us in the app chat or in a complaint; records of SMS, WhatsApp and email we send you; details of calls with our team, which may be recorded | To give you support, handle complaints, and keep a record of what was said |
b. Information collected automatically
- Device and connection data. A random device identifier that the app keeps for itself (it is not your IMEI and does not name you), your IP address and the browser or device details your device sends with each request, collected when you submit an application. We use it for security, to prevent fraud and to spot several applications made from one device.
- Push notification token, if you allow notifications in the Android app, so that we can send you application and repayment updates.
- How you reached us. Campaign details in the link you used (such as the source or advertisement), kept with your application so that we know which channel it came from.
- Usage events. Which steps of the application you completed, used to find and fix problems and to measure our advertising. See section 7.
c. Information from others
- Your Aadhaar details from DigiLocker, your PAN verification, your bank data from the Account Aggregator, and your credit report from the credit information company, each only as you have consented.
- If you applied through a partner or agent, the details that partner sent us (such as your name and mobile number), which the partner must have your consent to share. We run the same checks on them as on any other application.
4. Device permissions: what we ask for and what we never ask for
The Android app asks for the following permissions, each when it is needed:
- Camera, for your selfie and video KYC. It is used only on the screen that asks for it, never in the background.
- Microphone, only while the video KYC clip is recorded, so that the consent line you speak is captured. It is asked for when the video starts.
- Approximate location, asked once at the “Last details” step, after we explain why. The Android app asks for approximate location only and does not request precise (fine) or background location. On the web app your browser asks you, and the accuracy it gives is decided by your browser and device. You can refuse. If you refuse, we record that you refused, and you can still continue.
- Notifications, for application and repayment updates.
- Internet access, to connect to our servers.
What we never ask for
The LoanDidi app does not read your SMS messages, contacts or phone book, call logs, photos, videos or files, phone number or SIM details, or the list of other apps installed on your phone. The Android app is built so that these permissions are removed from it. We do not use precise or background location.
We do not ask for your internet banking password, UPI PIN, card PIN, CVV or any OTP other than the OTPs we send you to sign in and to confirm contact details.
5. How we use information
- To confirm your identity and complete KYC;
- To check that you meet the eligibility rules (age and residence) and to assess your creditworthiness and repayment capacity, using your bank data, credit report and the details you gave, with the help of automated tools (see section 6);
- To show you a Key Fact Statement with the annual percentage rate and all charges before you accept any loan;
- To pass your application to the Lender so that it can decide, sanction and disburse the loan;
- To obtain your e-signature and repayment mandate, and to pay out and collect the loan;
- To service your loan with statements, reminders and receipts, and to contact you if a payment is missed, lawfully and politely, as the Lender's Fair Practices Code requires;
- To prevent fraud, money laundering and misuse of the Platform;
- To answer your questions and complaints;
- To keep the Platform secure and working, and to measure and improve it and our advertising; and
- To follow the law, RBI directions and lawful orders of courts and authorities.
We do not sell or rent your personal information. We do not use what you give in your application to advertise other companies' products to you.
6. Who we share it with
We share information only as needed for the purposes above, and only with the following. The providers named are the ones we use at the date of this version. We may change them, and we will update this list when we do.
| Who | What is shared | Why |
|---|---|---|
| The Lender, Collocate Merchants Private Limited (RBI CoR No. B-05.05188) | Your application: identity, KYC, selfie and video, financial, credit, location and loan account information | To decide, sanction, disburse and hold the loan |
| Identity and verification services: Setu (DigiLocker, PAN, bank account check, Aadhaar e-sign, face matching) | The details and images needed for each check | To verify your identity, PAN, face, bank account and signature |
| Account Aggregator services: Fineye, as technology provider, and the RBI-licensed Account Aggregator you choose (for example Anumati or Finvu); Fineye's statement analysis service for uploaded statements | Your consent, and the bank data you authorise, or the statement you upload | To read your bank statement with your consent |
| Credit information companies: CRIF High Mark and Experian, through a bureau data provider (BeFisc) | Your name and mobile number for the enquiry; the Lender's loan and repayment data for credit reporting | To assess creditworthiness and report your loan as the law requires |
| Payment services: Razorpay (repayment mandates and collections) and RazorpayX (payouts), and the banks involved | Your bank account details, mandate details and payment instructions | To pay out your loan and collect repayments. Card, bank and UPI credentials are entered on the payment provider's own page and are not seen or stored by us. |
| Messaging and calling services: MSG91 (SMS, WhatsApp, OTP and email) and Acefone (telephony) | Your mobile number, email address and the message or call | To send you OTPs, updates and reminders, and to place calls |
| Technology services: Google (cloud hosting and storage in India, Google Maps address look-up, Firebase push notifications) | Data processed on our instructions; addresses and the approximate location you gave, sent for address look-up; your push token | To run the Platform, find the place an address refers to, and send notifications |
| Automated analysis tools: an AI service provider | Only summary figures worked out from your bank data (such as income stability and balance pattern), with no name, account number, ID or transaction narration | To help us read your bank data. The decision on your application is made by the Lender under its credit policy. |
| Advertising and analytics services: Google Tag Manager and Google Analytics, and Meta | See section 7. Never your name, mobile number, PAN, Aadhaar, income, bank details or loan amount. | To count visits and measure our advertising |
| Regulators, courts and law-enforcement agencies | What the law requires | To follow the law, RBI directions and binding orders |
| A successor in a business transfer | What is necessary for the transfer | Subject to the same confidentiality as this Policy |
Each service provider is bound by contract to use your information only for the purpose it was given for, to keep it confidential and secure, and to return or delete it when the engagement ends. Loan money moves only between the Lender and your bank account; LoanDidi does not hold your loan funds.
7. Analytics, advertising and cookies
Our website and the web app use Google Tag Manager, Google Analytics and the Meta Pixel to count visits, to see which steps of the application people complete, and to measure our advertising. They may set cookies or similar identifiers in your browser. The events we send them are limited to the step reached, a random lead or application reference, and the campaign details of the link you arrived through. We do not send them your name, mobile number, email, PAN, Aadhaar, bank details, income, loan amount or loan decision. When an application is submitted or a loan is disbursed, we also tell Meta that it happened, identified only by the application reference and the advertisement click identifier, with no personal details.
You can block or delete cookies in your browser settings. Some parts of the Platform may not work without essential cookies.
8. Where your data is stored and how we protect it
- Your data is stored on servers in India. Our servers run on Google Cloud in the Mumbai region (asia-south1), and documents, images and bank data files are kept in private Google Cloud Storage in India. We do not store your personal data outside India.
- Data sent between your device and our servers is encrypted in transit with TLS.
- Access to personal data is limited to staff who need it for their work, and is logged.
- We keep technical and organisational safeguards and review them from time to time.
No system on the internet is completely secure and we cannot promise absolute security. If a breach affects your personal data, we will tell you and the authorities as the law requires.
9. How long we keep it
LoanDidi keeps and processes your data on behalf of the Lender, as the Lender instructs, under the Reserve Bank of India (Digital Lending) Directions, 2025. We keep it for the periods the Lender states in its privacy policy:
- KYC and credit underwriting records: 10 years. This includes your identity and KYC records, selfie and video, bank statement data, credit report and the records of declined, withdrawn or incomplete applications.
- Loan documents and repayment records: 8 years after the loan is closed.
- Complaints and related correspondence: 5 years.
Technical and security logs are kept only as long as needed for security and fraud prevention. When a period ends, data is deleted or irreversibly anonymised. Where the law requires a longer period, the longer period applies.
10. Deleting your account and data
You can ask us to delete your account and data in any of these ways:
- On the web: www.loandidi.com/delete-account
- By email: contact@loandidi.com, from your registered email address or quoting your registered mobile number
- By phone: +91-9009003333
- In the app: write to us through Chat with us on the Profile tab
We check who is asking before we act. We acknowledge a request within 48 hours and complete it within 30 days.
If you have an active or outstanding loan, your account cannot be deleted until the loan is settled. Data that the law and the Lender's policy require us to keep (the records in section 9) is kept for the period stated there and then deleted. Until then it is access-restricted and used only for legal, regulatory and audit purposes, and not to market to you. Everything else, such as an unfinished application, a saved profile, notification tokens and marketing preferences, is deleted. The account deletion page lists what is deleted and what is kept.
11. Your rights
Subject to the law, you can:
- Ask what personal information we hold about you and for a copy of it;
- Ask us to correct information that is wrong or out of date;
- Withdraw a consent you gave;
- Ask for deletion, subject to section 9;
- Nominate another person to exercise these rights if you die or become unable to; and
- Complain about how your information has been handled.
To use any of these rights, write to contact@loandidi.com. We reply within the time the law allows.
12. Eligibility and children
The Platform is for residents of India aged 18 to 55 who are competent to contract. We do not knowingly collect information from anyone under 18. If we learn that we have, we will delete it.
13. Third-party links
To complete a step, the Platform opens pages of other services, such as DigiLocker, your Account Aggregator, the e-sign provider and Razorpay. Those pages are run by those services under their own privacy policies, and we encourage you to read them.
14. Complaints and contact
If you have a question or concern about this Policy or about your information, you can raise it as follows. The same process applies to every complaint about LoanDidi or the loan, and is set out in our Grievance Redressal Code.
| Level | Who | How to reach | Time to reply |
|---|---|---|---|
| Level 1 | LoanDidi Customer Support | contact@loandidi.com Phone: +91-9009003333 In the app: Profile tab | Acknowledged within 3 working days; reply within 7 working days |
| Level 2 | LoanDidi Grievance Redressal Officers Mr. Shreyash Holani, Nodal Grievance Redressal Officer Mr. Pratyush Pandey, Vice President, Operations | Mr. Holani: compliance@loandidi.com, shreyash@loandidi.com Mr. Pandey: pratyush.p@loandidi.com, +91 92039 86714 36 Forts Capital Private Limited, Ground Floor, Gore Parisar, Civil Lines, Raipur, Chhattisgarh - 492007 | Within 10 working days |
| Level 3 | Grievance Officer of the Lender, Collocate Merchants Private Limited Mr. Pratyush Pandey | grievance@collocatemerchants.com +91 92039 86714 Registered office: 2A, Ganesh Chandra Avenue, Commerce House, 5th Floor, Room No. 4A, Kolkata, West Bengal - 700013 | Within 15 working days |
| Level 4 | Reserve Bank of India, Integrated Ombudsman | RBI Complaint Management System: cms.rbi.org.in RBI Contact Centre: 14440 | As per the RBI process |
You may move to the next level if you are not satisfied with a reply, or if you do not get one in the time shown. In every case we aim to resolve your complaint within 30 days of the day you first raised it. If it is not resolved within 30 days, or you are not satisfied with the result, you may take it to the RBI through the Reserve Bank - Integrated Ombudsman Scheme, 2021. A complaint about the loan itself is made against the Lender, as the regulated entity.
15. Changes to this Policy
We may change this Policy. The new version will be posted at this address with a new date, and if the change is significant we will tell you in the app or by email. If you do not agree with a change, you can stop using the Platform and ask us to delete your account. Earlier versions are available on request.
This document is reviewed at least once a year, and when applicable law or our arrangements with the Lender change materially. If anything in it conflicts with the Reserve Bank of India (Digital Lending) Directions, 2025 or other applicable RBI directions, the RBI directions prevail.
For and on behalf of 36 Forts Capital Private Limited (operator of LoanDidi™)
Authorised Signatory / Director