Privacy Policy

We collect information that you provide directly to us and information necessary to operate and secure our Services:

• Account and contact information, such as name, email address and login credentials.
• Financial information you choose to provide in connection with home-loan services, such as income and obligation details.
• Documents and identifiers used for verification, such as PAN, Aadhaar (where lawfully required), salary slips, bank statements and property papers.
• Data accessed through India's consent-based rails — such as the RBI Account Aggregator framework, DigiLocker and credit bureaus — only with your explicit consent.
• Communications with us, including support requests and feedback.
• Essential technical data (such as IP address and device identifiers) used for security, fraud prevention and service integrity.

We use information to provide, maintain and improve the Services, including to:

• Deliver the requested Services and manage user accounts.
• Verify identity, assess loan readiness and comply with legal obligations.
• Protect against fraud, abuse and security incidents.
• Respond to your questions and provide customer support.

We process personal data in accordance with the Digital Personal Data Protection Act, 2023 on the basis of your consent or another lawful ground, and only for the purposes for which it was collected.

Verification of bank data, identity and credit information happens only after you give explicit, purpose-specific consent. You may withdraw consent at any time, subject to legal and operational limitations; withdrawing consent may affect our ability to provide certain Services.

We do not sell your personal data. We may share information only in limited circumstances:

• With the lender, NBFC or DSA you are applying through, so that your loan file can be assessed.
• With regulated data providers and processors (such as Account Aggregators, KYC and credit bureau partners) needed to deliver the Services, under appropriate safeguards.
• To comply with law, regulation, legal process or a lawful government request.
• To protect the rights, property and safety of GrihaNexus, our users or the public.
• In connection with a business transaction such as a merger or acquisition, subject to appropriate safeguards.

We retain personal data only for as long as necessary to provide the Services and to comply with legal, accounting and regulatory requirements, after which it is deleted or anonymised.

We use reasonable administrative, technical and physical safeguards, including encryption in transit and at rest, designed to protect personal data. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Subject to applicable law, you may request access to, correction of, or erasure of your personal data, nominate another individual to exercise your rights in the event of death or incapacity, and raise grievances. We will respond to verified requests as required by the Digital Personal Data Protection Act, 2023.

Our Services are not directed to children, and we do not knowingly collect personal data from children without verifiable parental or guardian consent. If you believe we have collected such data, please contact us so we can delete it.

We may update this policy from time to time. We will post any updates on this page and indicate the revised effective date.

If you have questions about this Privacy Policy, or wish to exercise your rights or raise a grievance, please contact us at founders@grihanexus.com. We will address verified requests within the timelines required by applicable law.