Privacy Policy

1. Introduction

Welcome to DFINPE, a mobile digital financial application owned, developed, and operated by DFINKARD HUB PRIVATE LIMITED (Corporate Identity Number: U66190MH2023PTC413550), a private limited company incorporated under the laws of India ("Company", "We", "Us", "Our").

We are committed to protecting the privacy, security, and confidentiality of your personal and financial information. This Privacy Policy ("Policy") describes how we collect, store, process, transfer, share, and protect your information when you download, register, access, or use the DFINPE mobile application ("App") and associated websites, features, or digital services ("Services").

This Policy has been drafted in strict compliance with applicable Indian laws, including the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, the Digital Personal Data Protection (DPDP) Act, 2023, Reserve Bank of India (RBI) guidelines, and Google Play Store Developer Program Policies.

2. Information We Collect

To provide seamless utility bill payments, mobile recharges, credit card application facilitation, and loan referral services, DFINPE collects specific categories of personal, financial, and technical information:

A. Personal Identification Data

• Identity Information: Full Name, Date of Birth, Gender, Marital Status.
• Contact Information: Mobile Number, Email Address, Residential / Mailing Address.
• Government Identifiers & KYC Data: Permanent Account Number (PAN), Aadhaar / e-KYC details (collected solely as permitted under applicable law for identity verification and loan/credit applications).

B. Financial & Transaction Data

• Bill Payment Information: Utility consumer numbers, bill account IDs, transaction amounts, payment status, and clearing receipts for electricity, water, piped gas, broadband, DTH, and FASTag recharges.
• Credit & Loan Application Information: Employment details, monthly income range, credit score requests, bank account IFSC/account details, and loan preference data for processing via our licensed bank and NBFC partners.
• Payment Details: Bank account numbers, Unified Payments Interface (UPI) IDs, and payment reference numbers. (Note: We do not store sensitive credit card CVV numbers or banking passwords).

C. Technical & Device Information

• Device Data: Smartphone model, hardware manufacturer, operating system version, unique device identifiers (IMEI/UUID), and mobile network details.
• Log & Analytical Data: IP address, app launch timestamp, crash logs, performance diagnostics, and feature usage patterns.

3. App Permissions Disclosure

To deliver core financial and payment functionalities, the DFINPE app requests explicit user permissions on your Android device. Each permission is used strictly for its declared purpose:

4. How We Use Your Information

DFINKARD HUB PRIVATE LIMITED utilizes your data strictly for legitimate operational, financial, and regulatory purposes:

• Service Delivery: To set up your account, process mobile recharges, facilitate Bharat Bill Payment System (BBPS) utility bill clearings, and manage transaction records.
• Financial Products Processing: To evaluate loan eligibility and forward loan applications to RBI-regulated Banks / NBFC partners, and facilitate credit card applications with authorized card issuers.
• Identity & KYC Verification: To perform customer due diligence, verify ownership of mobile numbers, and fulfill legal anti-money laundering (AML) mandates.
• Security & Fraud Mitigation: To detect, investigate, and prevent unauthorized access, fraudulent payments, money laundering, and security vulnerabilities.
• Communication: To send transactional updates, bill payment reminders, OTP notifications, policy updates, and customer support responses.
• Legal & Regulatory Compliance: To comply with directives issued by the Reserve Bank of India (RBI), National Payments Corporation of India (NPCI), tax authorities, and statutory audit frameworks under Indian Law.

5. Data Sharing & Third-Party Disclosure

We DO NOT sell, rent, lease, or monetize your personal or financial data to any third party for marketing or advertising purposes.

We share your information only under strict confidentiality agreements with the following authorized entities:

1. Licensed NBFC & Banking Partners: When you apply for personal or business loans or credit cards through DFINPE, your application data and KYC details are shared with RBI-registered Banks and Non-Banking Financial Companies (NBFCs) responsible for credit underwriting and loan disbursal.
2. Bill Clearing & Payment Networks: Transaction details are shared with the Bharat Bill Payment System (BBPS) central unit (operated by NPCI Bharat BillPay Limited), authorized bill aggregators, payment gateways, and banking partners to execute bill settlements.
3. Technology & Service Providers: Secure infrastructure providers, SMS gateway vendors (for OTP delivery), and customer support platforms working on our behalf under strict data processing contracts.
4. Regulatory & Legal Enforcement: When required by court orders, government agencies, law enforcement authorities, or statutory mandates under Indian law.

6. Data Security & Local Residency

DFINKARD HUB PRIVATE LIMITED implements industry-standard administrative, physical, and technical safeguards to protect your personal information against unauthorized access, loss, destruction, or disclosure.

• Encryption Standards: All data transmitted between the DFINPE app and our servers is secured using 256-bit Secure Sockets Layer (SSL/TLS) encryption. Sensitive stored data is encrypted at rest using AES-256 standards.
• Local Data Residency: In compliance with RBI data storage directives, all user personal data, payment transaction logs, and financial records are processed and stored exclusively on secure servers located within India.
• Access Controls: Strict role-based access controls and multi-factor authentication safeguard administrative systems.

7. Data Retention & Account Deletion Policy

In compliance with Google Play Developer Policies and Indian legal frameworks, DFINPE provides clear data retention schedules and an explicit account deletion process.

A. Data Retention Schedule

We retain personal information for as long as your DFINPE account remains active to provide continuous services. Following an account deletion request, transaction history and tax records may be retained for 5 to 7 years solely to comply with statutory legal mandates under the Prevention of Money Laundering Act (PMLA), 2002, tax laws, and audit requirements.

B. User Account & Data Deletion Instructions

You have the full right to delete your DFINPE account and request erasure of your personal data at any time.

8. Children's Privacy

The DFINPE mobile app and Services are strictly intended for individuals who are at least 18 years of age (or the legal age of majority in India). We do not knowingly collect, solicit, or process personal information from children under 18. If we become aware that a child under 18 has provided us with personal data, we take immediate steps to purge such information from our servers.

9. Third-Party Software Development Kits (SDKs)

The DFINPE app incorporates essential Google Play Services and trusted third-party SDKs to facilitate app stability, security, and payment processing:

• Google Play Services: Used for app authentication, location services, and security updates. (Google Privacy Policy)
• Firebase Crashlytics & Analytics: Used to monitor app stability, diagnose system crashes, and improve overall app performance. (Firebase Privacy Policy)
• NPCI / BBPS & Payment Gateways: Used for secure utility bill clearing and transaction processing.

10. Your Data Protection Rights

Under the Digital Personal Data Protection Act, 2023 and applicable privacy laws, you possess the following rights regarding your personal data:

• Right to Access: Request a copy of the personal information we hold about you.
• Right to Correction: Request correction or updating of inaccurate or incomplete personal details.
• Right to Withdraw Consent: Withdraw your consent for data processing at any time (withdrawing consent may restrict access to certain app features).
• Right to Erasure: Request permanent deletion of your account data as outlined in Section 7.
• Right to Grievance Redressal: Submit a complaint regarding data processing to our designated Grievance Officer.

11. Changes to This Privacy Policy

We may update this Privacy Policy periodically to reflect changes in our app features, legal requirements, or Google Play policies. When material updates are made, we will update the "Effective Date" at the top of this page and post a notification within the DFINPE app or via email. We encourage you to review this Privacy Policy regularly.

12. Contact Us & Grievance Officer

If you have any questions, concerns, feedback, or grievances regarding this Privacy Policy, your personal data, or compliance under the Indian Information Technology Act and DPDP Act, please contact our designated Grievance Officer: