Privacy policy.

1 · What we collect

We collect three categories of data, in this order:

Things you tell us

• Identity: name, date of birth, gender, PAN, Aadhaar (masked), photograph;
• Contact: email, phone, residential address, employer address;
• Financial: employment, income range, bank statement (where you upload one);
• Preference: cars shortlisted, EMI range, down-payment willingness, tenure preference.

Things we get from third parties — with your consent

• Soft-pull credit data from CIBIL / Experian (only during pre-approval; this is not a hard pull);
• Vehicle valuation from our partner inspection network (used cars only);
• Identity verification responses from UIDAI's authorised KYC partner.

Things our systems observe

• Device metadata: browser, OS, approximate IP-derived city;
• Behavioural: pages viewed, actions taken, forms started but not completed;
• Communication: timestamps and content of messages you exchange with Carfin advisors.

2 · How we use it

• To match you to vehicles and lenders relevant to your stated criteria;
• To facilitate sanction and disbursal of any loan you accept;
• To run anti-fraud and credit-risk checks on Carfin's behalf;
• To send transactional communication (WhatsApp / SMS / email) about your application;
• To send marketing communication — only if you opt in;
• To improve Carfin's product, in aggregated and anonymised form.

3 · Who we share with

We share data with:

• Lenders — the banks and NBFCs we panel with (see /bank-partners). They receive your file only when you authorise the application;
• Authorised dealerships — only the dealer of the car you book, only the fields needed to issue an invoice;
• Service providers — KYC partners, communication providers (Meta Cloud, Twilio, SendGrid), payment processors, cloud infrastructure;
• Regulators — when required by law (RBI, SEBI, Income Tax, courts).

We do not sell your data. We do not pass your contact details to anyone whose product you have not opted into.

4 · How long we keep it

• Active loans: through tenure plus 12 months;
• Dropped applications: 18 months, for re-engagement, after which it is purged unless you opt in to longer retention;
• Communication logs: 36 months for dispute-resolution purposes;
• Anonymised analytics: indefinitely, no individual identifier attached.

5 · Your rights

Under the Digital Personal Data Protection Act, 2023 you have the right to:

• Access — see what we hold on you;
• Correct — fix anything that's wrong;
• Erase — delete your data (subject to regulatory retention);
• Withdraw consent — for marketing, immediately; for transactional, on conclusion of business;
• Port — receive your data in a structured machine-readable form;
• Lodge a grievance — first with us (see section 8), then with the Data Protection Board of India.

6 · Cookies & analytics

We use first-party cookies for session management and analytics. We use Plausible Analytics (privacy-preserving, no cross-site tracking) for product analytics. We do not run third-party advertising trackers on Carfin.

7 · Children

Carfin is not intended for users below 18. We do not knowingly collect data from minors. If you believe a minor has shared data with us, write to privacy@carfin.in and we'll delete it.

8 · Contact

For any privacy question or to exercise a right above:

Aanya Kapoor
Grievance Officer
privacy@carfin.in
Carfin Technologies Pvt. Ltd., Lvl 14, BKC Connect, Bandra-Kurla Complex, Mumbai 400051
We respond within 7 working days.