Privacy Policy

1. Overview and roles

This Privacy Policy explains how GoldLoanPro, operated by Jabir MJ, an individual ("we", "us", "our"), collects, uses, and protects information when you use our gold loan management platform ("the Service").

Two categories of personal data flow through the Service, and we play a different role for each:

• Account data — information about your organization's own staff (account holders) who sign up for and use the Service. For this data, we act as the Data Fiduciary under India's Digital Personal Data Protection Act, 2023 ("DPDP Act") and this Policy describes our direct relationship with you.
• Customer Data — information your organization enters about its own borrowers (KYC details, gold loan records, repayment history). For this data, your organization is the Data Fiduciary and we act only as a Data Processor, processing it solely on your organization's instructions and for the purpose of providing the Service. Our Terms of Service, together with this Policy, form the data-processing terms between us and your organization. If you are a borrower and have a question about your data, please contact the gold loan business you took a loan from — they control that data and can instruct us to act on your request.

2. Information we collect

When you register and use the Service, we collect:

• Account information — name, email address, organization details, and role, provided during registration or team invites.
• Customer Data — information your organization enters about its own borrowers (e.g. KYC details such as name, address, date of birth, Aadhaar/PAN numbers, gold loan records, and repayment history) for the purpose of managing your business. Where a borrower record includes a minor (for example, as a nominee or joint holder), your organization is responsible for having a lawful basis and any required parental or guardian consent for that minor's data before entering it; we process it only on your instruction.
• Billing information — subscription plan and payment status. Card and payment details are handled directly by our payment processor, Razorpay, and are not stored on our servers.
• Usage and diagnostic data — log data such as IP address, browser type, pages accessed, error reports, and (for a limited sample of sessions, described in Section 11) masked session recordings, used for security, reliability, and to improve the Service.

3. Legal basis and consent

We collect and process Account information based on your consent when you register, and to perform our contract with you (providing the Service). We process Customer Data based on your organization's instructions, under the contract between us and your organization. You may withdraw consent for non-essential processing (such as diagnostic session recording, see Section 11) at any time by contacting us using the details in Section 15; withdrawing consent for processing that is necessary to provide the Service may mean we can no longer provide it to you.

4. How we use information

We use the information we collect to:

• Provide, operate, and maintain the Service for your organization
• Authenticate users and enforce access controls between organizations
• Process subscription payments and send billing-related communications
• Send account-related emails (e.g. email verification, password reset, team invites) and, on your organization's behalf, send your borrowers operational emails you configure (e.g. loan due reminders, closure confirmations, KYC status)
• Monitor, secure, diagnose errors in, and improve the Service

We do not sell any personal information — Customer Data or Account data — and we do not use Customer Data for advertising. We do not use Account data for advertising either; we may use aggregated, de-identified usage statistics to improve the Service.

5. Data sharing and sub-processors

We share information only with service providers who help us operate the Service under appropriate confidentiality and data-processing terms. As of the date above, these are:

• Supabase — our managed PostgreSQL database provider, hosting the Service's primary data store.
• Amazon Web Services (S3) — document and image storage (KYC documents, gold item photos), hosted in the Mumbai (ap-south-1) region.
• Razorpay — payment processing and subscription billing.
• Google Workspace — delivery of transactional emails (account and, where your organization configures them, borrower-facing emails).
• Sentry — error monitoring and diagnostic session recording, described further in Section 11.
• Google Analytics — traffic analytics on our public marketing pages only (this page, our homepage, and our Terms of Service). It is not loaded inside the authenticated product, so it never sees Account data or Customer Data. See Section 11.

We may update this list as we add or change providers; where a change is material, we will notify your organization as described in Section 14. We may also disclose information where required by law or to protect the rights, safety, and security of our users and the Service.

6. Cross-border data transfers

Our primary infrastructure — database and document storage — is hosted in India. Sentry, our error-monitoring provider, may process diagnostic data (including masked session recordings) on servers located outside India. Google Analytics, used only on our public marketing pages (never inside the authenticated product), also processes data as part of Google's global infrastructure, which may be outside India. By using the Service, your organization consents to this limited transfer for the stated diagnostic and analytics purposes, consistent with the DPDP Act. We do not otherwise transfer Customer Data outside India.

7. Data storage and security

Our database provider encrypts data at rest by default. Documents you upload (KYC images, gold item photographs) are encrypted at rest using AES-256 server-side encryption and served through access-controlled, tenant-scoped routes. Data in transit is encrypted via TLS. Access to your organization's data is restricted to that organization (tenant) through role-based access control and audit logging. Sensitive identifiers such as Aadhaar numbers are masked in the product interface (only the last four digits are shown); the full value is stored for KYC verification purposes and is not indexed for search.

8. Data retention

We retain Account data for as long as your organization's account is active, and for 12 months afterwards for security and legal purposes, after which it is deleted or anonymized.

We retain Customer Data (KYC and loan records) for as long as your organization's account is active, and afterwards for the longer of (a) any statutory retention period applicable to your organization as a regulated lender — for example, RBI KYC-record and PMLA obligations, which currently require retention for a minimum of five years from the end of the customer relationship — or (b) the export window described in our Terms of Service. We will not honour a deletion request where it would conflict with a retention obligation your organization has told us about or that we are otherwise aware of; in that case we will explain the conflict rather than silently ignoring the request.

9. Your rights

If you are an account holder, under the DPDP Act you have the right to access, correct, and request erasure of your Account data, to withdraw consent, to nominate another individual to exercise your rights in the event of death or incapacity, and to grievance redressal. You can update your profile directly in the Service; for other requests, contact us using the details in Section 15. We aim to respond within 30 days.

If you are a borrower, your data is Customer Data controlled by the gold loan organization you dealt with. Please direct access, correction, or deletion requests to that organization; we will act on such requests when instructed by the organization.

10. Automated processing

The Service calculates figures such as loan-to-value ratios, purity-based valuation caps, and compound interest using configurable rules. These calculations are computational aids that inform, but do not themselves make, final lending decisions — decisions are made by your organization's staff. See Section 2 of our Terms of Service for more on the limits of these calculations.

11. Cookies and session diagnostics

We use essential cookies within the product to keep you signed in and to maintain session security. We do not use advertising or remarketing cookies, and none of the tools below are used to build advertising profiles.

We use Sentry for error monitoring, which includes session replay for a small sample of sessions (currently 10%) and for all sessions in which an error occurs, so we can diagnose and fix problems. Session replay is configured to mask all text content and block all media (images, video) — it captures interaction and navigation patterns, not the content you or your customers type or view. You can ask us to disable this for your organization by contacting us using the details in Section 15.

Our public marketing pages — the homepage, this Privacy Policy, and our Terms of Service — use Google Analytics to understand traffic to our public site. Google Analytics sets cookies (such as _ga and _ga_*) to distinguish visitors and measure page views. It is not loaded inside the authenticated product, so it never sees your organization's Account data or Customer Data. You can control it through your browser's cookie settings or tools such as Google's Analytics opt-out browser add-on.

12. Security incidents

If we become aware of a breach involving your organization's Account data or Customer Data, we will notify your organization without undue delay, and in any case within 72 hours of becoming aware of the breach, with the information available to us at that time. We will reasonably assist your organization in meeting any notification obligations it has to its own borrowers or regulators as a result.

13. Changes to this policy

We may update this Privacy Policy from time to time. For material changes, we will notify account holders by email at least 15 days before the change takes effect, except where a change is required immediately to comply with law. Non-material changes are reflected by updating the "last updated" date above. Earlier versions are available on request.

14. Grievance Officer / Contact

In accordance with the DPDP Act and the Information Technology Rules, 2021, our Grievance Officer is:

Jabir MJ, Founder
[Business Address]
support@goldloanpro.in

For privacy-related questions or requests, including data access, correction, or deletion requests, contact us at the email above. We aim to acknowledge requests within 48 hours and resolve them within 30 days.