Privacy Policy

Who we are

For the personal data described here, Paizy is the data fiduciary: we decide why and how it is processed. For any question, request or complaint about your data, write to hello@paizy.in.

What we collect

• Account details: your name, email address, mobile number (if you sign in by phone), date of birth, and, if you choose to add them, your gender and a profile photo.
• Sign-in details: sign-in is handled by our authentication provider, Supabase. If you use a password, it goes directly to Supabase and is stored only in hashed form; Paizy’s servers never receive it. If you sign in with a one-time code, your mobile number is used to send it.
• Identity (KYC) details: your PAN and date of birth, when you submit them in the app. Your PAN is encrypted before it is stored.
• Credit report data: only if you ask for a Credit Score check and give consent. See “Credit Score check” below.
• Paizy AI conversations: the messages you send to Paizy AI and its replies.
• Account and transaction records: details of any Paizy credit account, its limits, balances, transactions and repayments. These products are not live yet, so most early-access accounts have none.
• Device details: device model, operating system, app version, platform and a push-notification token, so we can deliver notifications and keep your account secure.
• App usage: events such as screens viewed and features used, linked to your account, with your device platform and app version.
• Security logs: records of important account and admin actions, including the time and the IP address the request came from.
• Website data: anonymous visit data and, if you join the waitlist, your email address. See “Website, cookies and analytics” below.
• Messages to us: anything you send when you email us.

We do not read your contacts, SMS inbox or location. The app uses your camera only when you open the QR scanner, and your photo library only when you pick a profile photo. Paizy does not store card numbers.

How we use it

• To create and run your account and let you sign in.
• To verify your identity before you can apply for a credit product, as the law requires.
• To answer your questions in Paizy AI.
• To fetch and show your credit score, when you ask and consent.
• To send notifications you have allowed, such as account alerts.
• To keep Paizy secure: detecting misuse, preventing fraud and enforcing usage limits.
• To understand how Paizy is used and improve it, mostly through counts and trends rather than individual activity.
• To contact you about early access, if you joined the waitlist.
• To meet our legal obligations and respond to lawful requests.

We process your data with your consent, which you give when you create an account and, separately, when you use features such as the Credit Score check, or where the DPDP Act otherwise allows it, for example to comply with the law. We do not sell your personal data, we do not show ads, and we do not use advertising trackers.

Paizy AI

Paizy AI answers questions about credit, money and your Paizy account. To do that, we send the following to our AI model provider, Anthropic (the Claude models), which processes it to generate a reply:

• your message and the earlier messages in that conversation;
• when a question needs it, data from your account: an overview (which products you have, KYC status, member-since date, credit limits and balances), recent transactions, monthly spending summaries and your latest credit score result.

Our systems do not send your name, phone number, email address or PAN to Paizy AI, but anything you type is sent as written. Please do not type passwords, one-time codes or card numbers into a chat.

Your conversations are stored so you can return to them. You can delete a conversation in the app at any time; it is removed from your account straight away and Paizy AI no longer uses it. If you also want it erased from our systems, email us.

Messages are checked automatically so that Paizy AI stays on credit, money and your account. Off-topic requests and requests to write code are refused, and there is a daily message limit. Paizy AI explains; it does not give financial advice.

Credit Score check

We fetch your credit report only when you ask for it and tick the consent box. We record your consent, the version of the consent text you agreed to and when you gave it. The check is a soft enquiry and does not affect your score. One fresh check is available every 30 days.

We are still connecting a credit bureau partner. Until then, asking for a check places you on a waitlist and no data is sent to any bureau; the app may show a sample score that is clearly labelled as a sample.

Once a bureau is connected, we will share with it only the identity details it needs to find your report. We store the report you receive: the full bureau response is encrypted before it is stored, and the app shows a summary of your score and the factors behind it.

You can withdraw your consent at any time by emailing us. We will stop fetching your report and, if you ask, delete the reports we hold, except where the law requires us to keep them.

Who we share it with

We share personal data only when it is needed to run Paizy, and each provider receives only what its job requires:

• Supabase: authentication, our database and file storage (including profile photos and the website waitlist).
• Amazon Web Services: the servers that run the Paizy app’s backend and paizy.in, in the Mumbai region (ap-south-1).
• Anthropic: the AI model behind Paizy AI.
• Google Firebase Cloud Messaging and Apple Push Notification service: delivery of push notifications.
• MSG91: delivery of one-time sign-in codes by SMS, when phone sign-in is enabled.
• Cloudflare: bot protection on the waitlist form and cookieless website analytics, where enabled.
• Sentry: error monitoring for our servers, set up so that it does not send personal data by default.
• A credit bureau: once connected, and only for checks you consent to.
• A partner bank: the Paizy Credit Card and Paizy Credit Line, when they launch, will be offered with or through a regulated partner bank. If you apply, we will share the details the bank needs to assess and run your account, and we will tell you exactly what is shared before you apply.
• Authorities: when the law or a valid legal order requires it.

If Paizy is merged with or acquired by another company, your data may move to that company, which will have to protect it as this policy describes.

Where your data is stored

Our servers run on Amazon Web Services in Mumbai (ap-south-1). Our database, authentication and file storage are provided by Supabase. Some providers, including Anthropic, Google, Apple, Cloudflare and Sentry, may process data outside India. We transfer data outside India only as the DPDP Act permits.

How we protect it

Data is encrypted in transit, sensitive fields such as your PAN and credit reports are encrypted at rest, and access by our team is limited and logged. Our Security page describes these measures in more detail. No system is perfectly secure; if a breach affects your data, we will tell you and the authorities as the law requires.

How long we keep it

• Account details: while your account is open. After you close it, we delete or anonymise them, except what the law requires us to keep.
• Credit product records: once those products are live, for as long as banking, tax and anti-money-laundering laws require.
• Paizy AI conversations: until you delete them or close your account.
• Credit reports: while your account is open, or until you ask us to delete them.
• Consent records and security logs: as long as we need them to show we acted lawfully and to keep Paizy secure.
• App usage events: when you close your account, they are unlinked from you and kept only as anonymous data.
• Waitlist emails: until you ask to be removed or early-access invitations end.

Your rights

Under the DPDP Act you have the right to:

• get a summary of the personal data we hold about you, how we use it and who we have shared it with;
• have inaccurate or incomplete data corrected or updated (you can edit your name, email and photo in the app);
• have your data erased when it is no longer needed for the purpose you gave it for, unless the law requires us to keep it;
• withdraw your consent at any time, as easily as you gave it;
• have your grievances addressed by us; and
• nominate another person to exercise these rights if you die or become unable to.

Withdrawing consent does not affect processing that already happened, but some features may stop working; for example, without consent we cannot fetch your credit report. To close your account or make any request, email hello@paizy.in from the email address on your account. We may need to confirm your identity first, and we respond within 30 days.

Children

Paizy is only for people aged 18 or over. We do not knowingly collect data from anyone under 18. If you think a child has given us their data, email us and we will delete it.

Website, cookies and analytics

We do not use advertising or tracking cookies. On paizy.in we count visits anonymously with our own analytics: a random visitor id kept in your browser’s local storage (not a cookie), the page path, the referring website’s name, campaign tags in the link if present, and simple events such as page views, button clicks, FAQ opens and waitlist sign-ups. We never record your email or name in these events. Your IP address is used briefly to limit abuse and is not stored with them. If your browser sends Do Not Track or Global Privacy Control, our analytics records nothing.

Where enabled, we also use Cloudflare Web Analytics, which measures page loads without cookies, and Cloudflare Turnstile, which checks that waitlist sign-ups come from people rather than bots. When you sign in to the web dashboard, usage events are linked to your account, as they are in the app.

Grievance Officer

Grievance Officer — hello@paizy.in, subject “Grievance”. Tell us what happened and how to reach you. We will acknowledge your grievance and resolve it within one month of receiving it, as the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 require.

If you are not satisfied with our response, you may complain to the Data Protection Board of India after using our grievance process.

Changes to this policy

When we change this policy, we will publish the new version here with a new date and version number. If a change is significant, we will tell you in the app or by email before it takes effect.