cNaxelona
Legal & Compliance

Privacy Policy

Effective Date: July 2026 • Compliant with Digital Personal Data Protection (DPDP) Act 2023

1. Overview & Data Fiduciary Identity

Naxelona Technologies Private Limited (“Naxelona”, “We”, “Us”) operates as a Data Fiduciary under India's Digital Personal Data Protection (DPDP) Act 2023. We are committed to processing your personal and financial data lawfully, transparently, and strictly for the specified purpose of evaluating financial eligibility and matching credit products.

2. Personal Data Collected

We collect and process the following categories of data with your explicit consent:

  • Identity & Contact: Full name, verified mobile number, email address, and city of residence.
  • Financial Profile: Monthly income, employment type, existing obligations, self-reported credit score, and bank statement line items uploaded or fetched via Account Aggregator.
  • KYC Indicators: Encrypted national identification numbers (e.g. PAN / My Number / Civil ID) used strictly for bureau verification.
  • Technical Telemetry: Device IP, browser user agent, and anonymous funnel progress tokens.

3. Purpose of Processing & Consent Receipts

Every instance of financial data access (including Bank Statement analysis and Account Aggregator fetches) issues a timestamped, verifiable Consent Receipt detailing the purpose, scope, retention period, and data lifecycle.

We do not sell, lease, or monetize your personal data to third-party advertisers or telemarketing brokers.

4. Data Storage & Encryption

All Personally Identifiable Information (PII) is encrypted at rest using AES-256 (via PII_ENCRYPTION_KEY) and transmitted strictly over TLS 1.3 encrypted connections. Database backups are purged on strict retention schedules (e.g., raw bank statement lines are automatically anonymized or purged within 24 hours of parsing).

5. User Rights under DPDP Act 2023

You possess the following statutory rights regarding your personal data:

  • Right to Access: Export a machine-readable JSON copy of your profile and applications (via Account Settings → Export Data).
  • Right to Erasure / Anonymization: Request complete deletion of your account and anonymization of historical activity (via Account Settings → Right to Erasure).
  • Right to Revoke Consent: Instantly revoke active Account Aggregator consent handles from your security dashboard.

6. Contact Data Protection Officer

For any queries or formal data access/erasure requests under DPDP, contact our designated Data Protection Officer at privacy@naxelona.com.