Privacy Policy for
Moneyed

This Privacy Policy ("Policy") is published in accordance with Rule 4 of the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 read with Section 43A of the Information Technology Act, 2000, and the Digital Personal Data Protection Act, 2023 ("DPDP Act"). It governs the collection, processing, storage, disclosure, and protection of personal data by Moneyed, the trade name of Nakul Verma, sole proprietor, registered and operating from Delhi, India, GSTIN 07AJOPV3057D1ZY, Udyam Registration UDYAM-DL-07-0014863 ("Moneyed," "we," "our," or "us"). Moneyed is the Data Fiduciary in respect of the personal data described in this Policy.

Which parts of the DPDP framework are in force

The DPDP Act, 2023 is being brought into force in stages. The dates below come from notification G.S.R. 843(E) dated 13 November 2025, and from Rule 1 of the Digital Personal Data Protection Rules, 2025 (G.S.R. 846(E), same date, as corrected by G.S.R. 892(E) dated 10 December 2025). We publish them because a policy that implies everything is already enforceable is no more honest than one that implies nothing is.

• In force since 13 November 2025 — Sections 1(2), 2, 18 to 26, 35, 38 to 43 and 44(1) and (3) of the Act, and Rules 1, 2 and 17 to 21. This is what establishes the Data Protection Board of India and how it works.
• From 13 November 2026 — Section 6(9) and Section 27(1)(d) of the Act, and Rule 4, which governs the registration and obligations of a Consent Manager.
• From 13 May 2027 — Sections 3 to 5, 6(1) to (8) and (10), 7 to 17, 27 (other than (1)(d)), 28 to 34, 36, 37 and 44(2), and Rules 3, 5 to 16, 22 and 23. These are the substantive duties on us and the enforceable rights of a Data Principal: notice, consent, purpose limitation, erasure, security safeguards, breach reporting, and your rights of access, correction, erasure and nomination.

We are not waiting for those dates. The commitments in this Policy are made now and apply now. Where we describe a practice as following a rule that is not yet in force, we are stating what we already do, not predicting what we will do.

Moneyed provides free financial advisory services to individuals across India — including loan comparison, EMI optimisation, CIBIL score analysis, balance transfer advisory, and credit product guidance — accessible through our platform at moneyed.co.in ("Platform").

By accessing or using the Platform, or by submitting your personal information to us in any form, you acknowledge that you have read and understood this Policy, and you consent to the collection and processing of your data as described herein. If you do not agree with any part of this Policy, you must discontinue use of the Platform immediately.

This Policy is to be read together with the Terms & Conditions of the Platform. In the event of any conflict between this Policy and any other agreement between you and Moneyed, the terms of this Policy shall prevail with respect to data privacy matters.

We may collect the following categories of information when you use our services or request a consultation:

• Personal Information: Full name, date of birth, gender, residential address, email address, and mobile number.
• Financial Information: Monthly income, existing loan details, outstanding EMIs, employment type — for advisory purposes only.
• Identity Documents: PAN card number (used solely for credit assessment and lender referral, with your consent).
• Credit Data: CIBIL or credit bureau report data that you voluntarily upload or share with us for analysis via our CIBIL Analyser tool.
• Device & Usage Data: IP address, browser type, device information, pages visited, and activity logs — collected automatically via cookies and analytics tools.
• Communication Data: Messages, queries, and feedback you send us via the contact form, WhatsApp, or email.
• Third-Party Data: Credit and verification data from partner NBFCs, banks, or credit bureaus — only with your explicit consent.

Your data is used strictly for the following purposes:

• Financial Advisory: To assess your eligibility for loans, balance transfers, and credit products and to provide personalised recommendations.
• CIBIL Analysis: To analyse your credit report and provide actionable insights to improve your credit score.
• Lender Referral: To share your details (with consent) with partner banks and NBFCs for loan processing.
• Identity Verification: To verify your identity and financial eligibility before facilitating introductions to lenders.
• Communication: To respond to your queries, share consultation updates, and send relevant financial tips or offers.
• Legal Compliance: To comply with applicable legal, regulatory, and contractual obligations.
• Product Improvement: To improve our website and tools through anonymised usage analytics.

We do not use your data for automated decision-making that produces legal or similarly significant effects without your knowledge.

We share your personal data only on a need-to-know basis with the following entities:

• Partner Banks & NBFCs: For loan processing, approval, and disbursal — only with your prior consent.
• Credit Bureaus (CIBIL, Experian, etc.): To assess creditworthiness and, where applicable, report loan performance.
• Technology Service Providers: For IT infrastructure, analytics, document verification, and secure data storage — under strict confidentiality agreements.
• Legal or Regulatory Authorities: When required by law, court order, or regulatory directive.

We do not sell, rent, or trade your personal information to any third parties for marketing purposes.

We implement appropriate administrative, physical, and technical safeguards to protect your data:

• HTTPS encryption across all pages and data transmissions.
• Secure, access-controlled data storage via Firebase (Google Cloud infrastructure).
• Restricted internal access — only authorised personnel can access personal data.
• Regular security reviews and data-handling audits.

While we take all reasonable precautions, no internet transmission is 100% secure. Please safeguard your account credentials and report any suspected security issues to us immediately.

Measures under Rule 6 of the DPDP Rules, 2025

Rule 6 of the Digital Personal Data Protection Rules, 2025 sets a minimum list of reasonable security safeguards. Against that list, we maintain:

• Encryption and masking. Personal data is encrypted in transit (HTTPS across every page and request) and at rest by our infrastructure provider. Credit-report PDFs are opened and read in your own browser — the file itself is never uploaded to us. The text read out of it is then sent to our analysis service (Render, in the United States — see Section 4) so the report can be analysed, and that text contains what the report contains. It is used to produce your analysis and is not retained by that service once the response is returned.
• Access control. Access to stored personal data is decided by server-side database rules, not by the interface. A page that forgets to hide something is still refused by the database. Staff access is granted by invitation to a verified official email address and can be revoked centrally.
• Visibility through logs. Access to records in our advisory system is written to an append-only activity log recording who did what and when. Entries cannot be edited or deleted after the fact, including by us.
• Continuity. Data is held on managed infrastructure with provider-side backups, so processing can continue if availability is disrupted.
• Log retention. Logs and the associated personal data are retained for one year to allow a suspected unauthorised access to be detected, investigated and remediated, as Rule 6(1)(e) and Rule 8(3) require, unless another law requires us to keep them longer.
• Processor contracts. Where a Data Processor processes personal data on our behalf, it does so under a contract, as Section 8(2) of the Act requires.

No system is impossible to breach, and we do not claim otherwise. What we commit to is that our systems fail closed — where a check cannot be completed, access is refused rather than allowed.

If a personal data breach occurs

Rule 7 of the DPDP Rules, 2025 sets what must happen. On becoming aware of a personal data breach we will:

• Tell you without delay, through your registered contact, describing the nature, extent and timing of the breach, the consequences likely to affect you, what we have done and are doing to limit the risk, the steps you can take to protect yourself, and the contact details of a person who can answer your questions.
• Tell the Data Protection Board of India without delay, with a description of the breach, its nature, extent, timing, location and likely impact.
• Give the Board the full account within 72 hours of becoming aware — the detailed description, the events and circumstances that led to the breach, the measures taken or proposed, and our findings on who caused it — or within any longer period the Board allows on a written request.

The Data Protection Board of India was established on 13 November 2025 by notification G.S.R. 844(E) and has its head office in the National Capital Region.

Where your data is stored — transfer outside India

Your data is held and processed in two places, both outside India, and we name them here so you can decide with that in front of you.

Storage — Singapore. We use Google Firebase to store data. Our Firebase Realtime Database instance is hosted in Google Cloud's asia-southeast1 region, in Singapore. The categories listed in Section 1 are stored there.

Processing — United States. Our analysis service runs on Render, in Google Cloud's us-west1 region, in Oregon, United States. It is the service that reads the text of a credit report you upload, reads a bank statement you upload, and works out which lenders your figures fit. That means the contents of those documents, and the income and obligation figures you enter, are sent to a server in the United States to be analysed. They are processed and returned; the analysis service is not where your account record is kept.

Taken together: personal data you submit to us is transferred to and stored or processed on servers located outside India.

We rely on Google Cloud's contractual and technical safeguards for both of these transfers, including encryption in transit and at rest, and Google's own data processing terms. Render is the platform our analysis service runs on; the underlying infrastructure is Google Cloud. Section 16 of the DPDP Act, 2023 empowers the Central Government to restrict transfers to a notified country or territory, and Rule 15 of the Digital Personal Data Protection Rules, 2025 (G.S.R. 846(E), 13 November 2025) makes any such transfer subject to requirements the Central Government may specify. As at the date of this Policy, neither Singapore nor the United States has been notified as a restricted territory under Section 16, and no requirement has been specified under Rule 15 that would prevent either transfer. We review this position whenever a notification is issued.

By using the Platform and submitting your information, you consent to this transfer. If you would prefer your data not to be stored or processed outside India, please do not submit personal information through the Platform, and contact our Grievance Officer (Section 9) to discuss alternatives. We keep the choice of hosting region under review.

We retain your personal information only for as long as necessary:

• Consultation records: Retained for up to 3 years from the date of last interaction.
• CIBIL report uploads: Analysed in real-time and deleted within 90 days of upload.
• Contact form submissions: Retained for up to 12 months, then securely deleted.
• Usage analytics data: Retained in anonymised, aggregated form for up to 24 months.

Upon expiry of the retention period, or upon a valid deletion request, your data is securely erased from all active systems.

Under the DPDP Act, 2023, you have the following rights regarding your personal data:

How to exercise these rights

No account, or you would rather write to us? Use the links below. Each opens a pre-filled email to our Grievance Officer — you only need to add your name and send. We acknowledge within 48 hours and resolve within 30 days. There is no charge for any of these requests.

Withdrawing consent is as easy as giving it — that is Rule 3, and it is why Your data exists rather than only an email address. To turn off analytics and advertising cookies in your browser right now, use Cookie preferences.

We use cookies and similar technologies to improve your experience on moneyed.co.in:

• Essential Cookies: Required for core site functionality (authentication, security). Cannot be disabled.
• Analytics Cookies: Google Analytics (GA4) — used to understand how visitors use our site. Data is anonymised and aggregated.
• Marketing Pixels: Meta Pixel — used to measure advertisement effectiveness. No personal financial data is shared with Meta.

Analytics and marketing cookies load only after you accept them on the consent banner shown on your first visit. If you decline, Google Analytics and Meta Pixel are never loaded. You can change your mind at any time using Cookie preferences, or by clearing cookies in your browser settings.

The Platform is intended for adults only. Under our Terms & Conditions you must be at least 18 years of age and legally competent to contract under the Indian Contract Act, 1872 in order to use it. Loan products, credit reports and the services we facilitate are not available to minors.

We do not knowingly collect personal data of any person under 18. We do not direct our advertising at children, and we do not carry out tracking, behavioural monitoring or targeted advertising in relation to children, in line with Section 9 of the DPDP Act, 2023.

If we become aware that we have collected personal data of a person under 18 without verifiable consent of a parent or lawful guardian, we will delete that data from our active systems promptly, and in any case within 30 days of becoming aware.

If you are a parent or guardian and believe a child has provided us with personal data, please contact our Grievance Officer (Section 9) and we will act on it as a priority.

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date at the top of this page and, where appropriate, notify you via email or a prominent notice on our website.

Your continued use of moneyed.co.in after any changes constitutes acceptance of the updated policy.

If you have any questions, concerns, or requests regarding your personal data, or wish to exercise your rights under the DPDP Act, please contact our Grievance Officer:

If you are not satisfied with our response, you may escalate your complaint to the Data Protection Board of India once operational under the DPDP Act, 2023.