Privacy Policy

1. Interpretation and Definitions

Capitalised terms used in this Privacy Policy have the meanings set out below. These definitions apply whether terms appear in singular or plural.

• Company / We / Us / Our — Lightbees Technologies Private Limited, a company incorporated under the Companies Act, 2013, with its registered office at HD-093, WeWork Salarpuria Symbiosis, Arekere Village, Bannerghatta Road, Bengaluru – 560076, Karnataka, India, operating the AbleCredit Platform.
• Platform — The AbleCredit website, mobile application, API integrations, dashboards, and all associated products and services.
• Lender — Banks, Non-Banking Financial Companies (NBFCs), or other regulated financial entities that license and deploy the Platform for their credit operations.
• Field User / Credit Officer — Any employee, agent, or contractor of a Lender who uses the Platform to conduct borrower assessments.
• Borrower — Any individual or business entity whose information is collected through the Platform in connection with a credit assessment conducted by a Lender.
• Borrower Data — All information — including voice recordings, images, video, documents, geo-location, and behavioural data — captured or processed through the Platform in connection with a borrower assessment.
• Sensitive Personal Data or Information (SPDI) — Has the meaning assigned under Rule 3 of the SPDI Rules and includes biometric data (including facial photographs), financial information, and health data.
• Personal Data — Any information that relates to an identified or identifiable natural person.
• AI Outputs — Risk scores, credit appraisal memos, analysis, and any machine-generated recommendations produced by the Platform's models.
• Intermediary Rules — The Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, as amended from time to time.
• You / Your — The individual or entity accessing or using the Platform, whether as a Field User, Borrower, or representative of a Lender.

2. Categories of Data We Collect

We collect the following categories of data when You or Your Lender uses the Platform. Collection occurs only with prior, informed consent as described in Section 3 below.

2.1 Standard Personal Identifiers

• Full name
• Email address
• Mobile number
• Business address and operating location
• Internet Protocol (IP) address
• Device identifiers and operating system information
• Browser type and version

2.2 Financial Conversation Recordings

The Platform records audio and/or video conversations between a Borrower and a Field User / Credit Officer conducted for the purpose of credit appraisal ("Recorded Sessions"). These recordings are:

• Captured only after obtaining prior, explicit, bilateral consent from both the Borrower and the Field User before each session commences (see Section 3);
• Used solely for credit assessment, quality assurance, regulatory compliance, and AI model improvement (in anonymised or aggregated form only);
• Stored in encrypted form on servers located exclusively within India;
• Retained for the period specified in Section 7 and in the Company's Data Retention Policy.

Recording conversations constitutes the collection of personal data and, where the conversation reveals financial information, may constitute SPDI. The Company treats all Recorded Sessions accordingly.

2.3 Facial Photographs and Biometric Data

The Platform may capture facial photographs of the Borrower during the credit assessment process. Facial photographs that are used to verify identity or that are capable of being used to identify an individual constitute biometric data and are classified as Sensitive Personal Data or Information (SPDI) under the SPDI Rules.

• Facial photographs are collected only with explicit, specific, prior consent from the Borrower;
• They are used solely for identity verification during the credit assessment process;
• They are not shared with third parties except the relevant Lender, unless required by law;
• Secure deletion is applied at the end of the applicable retention period.

2.4 Business Information and Documents

• Business name, registration details, and nature of business;
• Business financial information submitted by or on behalf of the Borrower;
• Photographs of business premises, inventory, and assets;
• Business documents uploaded via the Platform (invoices, bank statements, ownership documents);
• Hyperlocal and inventory data gathered during field visits.

2.5 Geo-Location Data

The Platform collects geo-location data from the devices of Field Users during active sessions. This is used to:

• Verify that field visits occur at the declared business location;
• Generate hyperlocal market intelligence for credit risk purposes;
• Detect and prevent fraud.

Geo-location is collected only when the Platform is in active use. Background location tracking is not performed. Borrowers are informed of geo-location capture at the point of consent.

2.6 Device and Usage Data

• Device type, operating system, and unique device identifier;
• Session timestamps, duration, and pages accessed;
• Cookies and similar tracking technologies (see Section 9).

2.7 Data Not Collected

The Company does not collect, verify, or store KYC (Know Your Customer) documents such as Aadhaar, PAN, or passport as part of its standard Platform operations. KYC is the responsibility of the Lender. Where the Platform integrates with a Lender's KYC workflow via API, the Company acts solely as a data processor and does not retain such documents beyond the session.

3. Consent — Conversation Recording and Biometric Data

We obtain consent in accordance with the requirements of the IT Act, SPDI Rules, and DPDPA before collecting any Borrower Data, with heightened consent requirements for Recorded Sessions and biometric data.

3.1 Bilateral Consent for Recorded Sessions

Before any financial conversation is recorded, the Platform obtains explicit consent from:

• The Borrower: via an on-screen disclosure presented before the session commences, clearly stating that the conversation will be recorded, the purpose of the recording, and the Borrower's right to withdraw consent;
• The Field User / Credit Officer: via an acknowledgment presented at login or session initiation, confirming they consent to the session being recorded on behalf of the Lender.

A session cannot commence on the Platform without the positive confirmation of both parties. Consent records are timestamped and retained as part of the audit trail.

Withdrawing consent for recording will prevent the Platform from being used for that session. It does not affect any data already lawfully collected prior to withdrawal.

3.2 Consent for Facial Photographs and Biometric Data

Explicit, specific consent for collection of facial photographs is sought separately from general Platform consent. The consent notice clearly states:

• That a facial photograph will be taken;
• That it constitutes biometric / SPDI under applicable law;
• The specific purpose (identity verification during credit assessment);
• The retention period and the right to request deletion.

Facial photographs are not collected without affirmative consent. A Borrower may decline to provide a facial photograph; the Lender will determine whether the assessment can proceed without it.

3.3 Consent for Geo-Location

Geo-location capture is disclosed in the Platform's onboarding flow. Field Users grant location permissions through their device's native permission mechanism. Borrowers are notified via the session-start disclosure that geo-location of the visit will be recorded.

4. How We Use Your Data

The Company processes Borrower Data and Personal Data for the following purposes, consistent with the consent obtained and applicable law:

• To provide, operate, and improve the Platform;
• To enable Lenders to conduct credit appraisals and make lending decisions;
• To generate AI Outputs (risk scores, credit appraisal memos) for use by Lender personnel;
• To verify the identity of Borrowers during field assessments;
• To improve AI and machine learning models using anonymised and aggregated data only;
• To detect and prevent fraud, misrepresentation, and Platform misuse;
• To comply with applicable legal and regulatory obligations;
• To respond to requests from law enforcement or regulatory authorities;
• To manage grievances and disputes.

AI Outputs are recommendations only. All credit decisions rest with the Lender's authorised personnel and are not made solely on AI Outputs. The Company does not make lending decisions.

5. Sharing and Disclosure of Data

We do not sell Personal Data or Borrower Data. We share data only in the following circumstances:

• With the relevant Lender: Borrower Data is shared with the Lender that commissioned the assessment, as necessary to provide the Platform services. The Lender is the data fiduciary for purposes of DPDPA in respect of Borrower Data;
• With authorised Service Providers: We engage third-party vendors (cloud hosting, analytics) under binding data processing agreements that prohibit use of data for any other purpose;
• For legal compliance: We may disclose data to courts, regulators, or law enforcement agencies when required by law or valid legal process, including as set out in Sections 5.1 and 5.2 below;
• In a business transfer: Data may be transferred in the event of a merger, acquisition, or asset sale, subject to advance notice to affected users;
• With Your consent: We may disclose data for any other purpose with Your specific, prior consent.

5.1 Assistance to Government Agencies

In accordance with Rule 3(1)(j) of the Intermediary Rules, upon receipt of a written order from a lawfully authorised Government agency, the Company will provide information under its control or possession, or assistance, within seventy-two (72) hours of receipt of such order, for the purposes of verification of identity, or for the prevention, detection, investigation, or prosecution of offences under any law for the time being in force, or for cyber security incidents. Every such order must clearly state the purpose for which the information or assistance is sought.

5.2 Removal of Unlawful Information on Actual Knowledge

In accordance with Rule 3(1)(d) of the Intermediary Rules, upon receiving actual knowledge in the form of an order by a court of competent jurisdiction, or a reasoned written intimation by an authorised officer of the appropriate Government or its agency, the Company will remove or disable access to the unlawful information hosted, stored, or published on the Platform within three (3) hours of receipt of such order or intimation.

6. Data Localisation — Storage Within India

All Personal Data, Borrower Data, and Recorded Sessions collected through the Platform are stored on servers located exclusively within India. The Company does not transfer Borrower Data or Recorded Sessions to any jurisdiction outside India.

Where third-party service providers are engaged (such as cloud infrastructure providers), the Company contractually requires that data be stored and processed only within India.

7. Data Retention

The Company retains Personal Data and Borrower Data for the following periods, determined by the applicable statutory, regulatory, and contractual requirements:

7.1 Preservation of Removed Information

In accordance with Rule 3(1)(g) of the Intermediary Rules, where the Company removes or disables access to any information — whether pursuant to actual knowledge under Section 5.2, voluntarily on account of a violation of Rule 3(1)(b) of the Intermediary Rules, or on the basis of a grievance received under Section 11 — the Company will, without vitiating the evidence in any manner, preserve such information and associated records for a period of one hundred and eighty (180) days for investigation purposes, or for such longer period as may be required by a court or by a lawfully authorised Government agency.

Upon expiry of the applicable retention period, data is securely deleted or anonymised using controls that prevent reconstruction. Records of deletion are maintained by the Information Security Group.

8. Security of Your Data

The Company implements reasonable security practices and procedures as required under the SPDI Rules, including:

• ISO 27001-aligned Information Security Management System (ISMS);
• Encryption of data in transit (TLS 1.2 or higher) and at rest (AES-256);
• Role-based access controls limiting access to authorised personnel;
• Regular security audits conducted by CERT-In empanelled auditors;
• Audit logs maintained for a rolling period of 180 days as required under CERT-In Directions.

No method of electronic storage or internet transmission is 100% secure. While we implement commercially reasonable safeguards, we cannot guarantee absolute security.

9. Cookies and Tracking Technologies

• Session Cookies: Essential for Platform functionality; deleted when the session ends.
• Persistent Cookies: Used to remember preferences (e.g., language, login state); retained for up to 182 days.
• Web Beacons: Used for analytics on Platform usage.

You may instruct your browser to refuse all Cookies. Doing so may limit access to certain Platform features. Borrowers do not interact with the Platform website directly and are not subject to cookie collection during field assessments.

10. Your Rights

Subject to applicable law, You have the following rights in relation to Your Personal Data:

• Right to access: Request a copy of Personal Data held about You;
• Right to correction: Request correction of inaccurate Personal Data;
• Right to erasure: Request deletion of Personal Data, subject to legal obligations to retain it;
• Right to withdraw consent: Withdraw consent for processing at any time (withdrawal does not affect prior lawful processing);
• Right to grievance redressal: Raise a complaint with the Grievance Officer (see Section 11).

To exercise any of these rights, contact us at [email protected]. We will respond within 7 days of receipt.

11. Grievance Redressal

In accordance with Rule 3(2) of the IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, as amended, the Company has designated a Grievance Officer for the purposes of addressing complaints and grievances from users of the Platform.

Complaints may be submitted in writing to the above email address. On receipt, the Grievance Officer will acknowledge the complaint within 24 hours and resolve it within the applicable timeline:

• General complaints: resolved within 7 days of receipt.
• Requests for removal of prohibited content: where a complaint requests removal of information relating to content prohibited under Rule 3(1)(b) of the Intermediary Rules (other than sub-clauses (i), (iv) and (xi) thereof), the complaint will be acted upon and resolved within 36 hours of receipt.
• Nudity, sexual content and impersonation: the Company will take all reasonable and practicable measures to remove or disable access to such content within 2 hours of receipt of the complaint.

If You are not satisfied with the resolution, You may approach the relevant data protection authority or regulatory body under applicable Indian law.

12. Children's Privacy

The Platform is intended solely for business use and is not directed at individuals under the age of 18. We do not knowingly collect Personal Data from minors. If we become aware that data from a minor has been inadvertently collected, we will take immediate steps to delete it.

13. Changes to This Privacy Policy and Periodic User Notifications

13.1 Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be notified via email and/or a prominent notice on the Platform prior to the change taking effect. The "Last Updated" date at the top of this Policy will be revised accordingly. Continued use of the Platform after the effective date of any change constitutes acceptance of the updated Policy. We encourage You to review this Policy periodically.

13.2 Annual Notification

In accordance with Rule 3(1)(f) of the Intermediary Rules, the Company will, at least once every year, inform all users of the Platform — by email to their registered email address and/or by a prominent notice on the Platform — of its rules and regulations, this Privacy Policy, and the Terms of Service, and of any changes thereto.

13.3 Quarterly Notification

In accordance with Rule 3(1)(c) of the Intermediary Rules, the Company will, at least once every three months, inform all users of the Platform — by email to their registered email address and/or by a prominent notice on the Platform — that:

• in case of non-compliance with the Company's rules and regulations, this Privacy Policy, or the Terms of Service, the Company has the right to terminate the user's access or usage rights to the Platform immediately, or remove non-compliant information, or both;
• where such non-compliance relates to the creation, hosting, or sharing of information in violation of any law, the user may be liable to penalty or punishment under the Information Technology Act, 2000 or any other applicable law; and
• where such non-compliance relates to the commission of an offence mandatorily reportable under applicable law, including the Bharatiya Nagarik Suraksha Sanhita, 2023 or the Protection of Children from Sexual Offences Act, 2012, the Company will report such offence to the appropriate authority in accordance with law.

14. Contact Us

For any questions, requests, or concerns regarding this Privacy Policy or the handling of Your data, please contact:

• Email: [email protected]
• Post: HD-093, WeWork Salarpuria Symbiosis, Arekere Village, Bannerghatta Road, Bengaluru – 560076, Karnataka, India

For complaints specifically relating to data privacy, please address correspondence to the Grievance Officer as set out in Section 11.