Your data, your rules.

01Introduction and Scope

Nilfee Fintech Private Limited ("Nilfee", "Company", "We", "Us", or "Our"), a company incorporated under the Companies Act, 2013, CIN: U62099TN2023PTC162123, having its registered office at No. 2/21, Flat D, Sabari Bahavan Flats, Vijay Avenue 3rd Street, Nanganallur, Chennai, Tamil Nadu, India – 600061, operates the Mukodi platform ("Platform"), an artificial-intelligence-powered financial intelligence service accessible via web application, mobile application, and application programming interfaces (APIs).

This Privacy Policy ("Policy") explains how we collect, use, store, share, and protect your personal data when you access or use our Platform, including all AI-driven features such as financial analysis, predictive modelling, voice-based interactions, and personalised recommendations.

This Policy applies to all users of the Platform, including individual consumers ("Data Principals"), enterprise clients, API partners, and visitors to our website.

Legal Framework

This Policy is drafted in compliance with the Digital Personal Data Protection Act, 2023 ("DPDP Act"), the Digital Personal Data Protection Rules, 2025 ("DPDP Rules"), and the Information Technology Act, 2000 and its associated rules. Where the Platform processes data of users located outside India, applicable international data protection laws shall also apply to the extent required.

02Definitions

For the purposes of this Policy, the following terms shall have the meanings ascribed below:

AI Model

Any machine learning or deep learning algorithm deployed within the Platform for the purpose of data analysis, prediction, classification, natural language processing, or decision support.

Consent

A free, specific, informed, unconditional, and unambiguous indication of the Data Principal’s wishes, signifying agreement to the processing of their personal data for a specified purpose, given by a clear affirmative action.

Data Fiduciary

Nilfee Fintech Private Limited, which alone or in conjunction with others determines the purpose and means of processing personal data.

Data Principal

The individual to whom the personal data relates. Where the individual is a child (under 18 years), the Data Principal includes the lawful guardian.

Data Processor

Any person or entity that processes personal data on behalf of the Data Fiduciary, including cloud service providers, analytics partners, and AI model hosting services.

Personal Data

Any data about an individual who is identifiable by or in relation to such data, including but not limited to name, contact information, financial records, transaction history, device identifiers, and biometric data.

Processing

Any operation or set of operations performed on personal data, including collection, recording, organisation, structuring, storage, adaptation, retrieval, use, alignment, combination, indexing, sharing, disclosure, restriction, erasure, or destruction.

Significant Data Fiduciary

A Data Fiduciary designated as such by the Central Government under Section 10 of the DPDP Act based on volume and sensitivity of personal data processed, risk to the rights of Data Principals, potential impact on sovereignty and integrity of India, and other prescribed factors.

Training Data

Datasets used to train, validate, test, or fine-tune AI Models deployed on the Platform, which may include anonymised, aggregated, or synthetic data derived from user interactions.

03Personal Data We Collect

3.1 Data Collected Directly from You

When you register for, access, or use the Platform, we may collect the following personal data that you voluntarily provide:

• Full name, email address, mobile number, and date of birth
• PAN (Permanent Account Number) and Aadhaar number (where required and with explicit consent)
• Bank account details, UPI IDs, and linked financial account information
• Income details, employment information, and financial goals
• KYC (Know Your Customer) documents and identity verification data
• Voice recordings and transcriptions (for Mukodi Speaks voice assistant)
• Communication preferences and feedback

3.2 Data Collected Automatically

When you interact with the Platform, we automatically collect certain technical and usage data:

• Device information (type, operating system, browser, screen resolution)
• IP address, approximate geolocation, and network information
• Usage patterns, session duration, features accessed, and interaction logs
• AI interaction data (queries submitted, responses received, feedback provided)
• Cookies and similar tracking identifiers
• Crash reports and diagnostic data

3.3 Data from Third-Party Sources

With your consent, we may collect personal data from authorised third-party sources:

04Purpose of Processing and Lawful Basis

We process your personal data only for the specific purposes outlined below, each supported by a lawful basis under the DPDP Act:

05Consent Mechanism

5.1 Obtaining Consent

We obtain your consent through clear, affirmative actions prior to the collection or processing of your personal data. Consent requests are presented in clear and plain language, available in English and supported Indian languages (Hindi, Tamil, Telugu, Urdu, Kannada, Bengali, and Marathi). Each consent request specifies the personal data to be collected, the purpose of processing, and the identity and contact details of the Data Fiduciary.

Separate, granular consent is obtained for each distinct purpose of processing. Consent for AI-specific processing (such as model training, voice data processing, and automated decision-making) is obtained independently from general service consent.

5.2 Withdrawal of Consent

You may withdraw consent at any time with the same ease with which it was given. Consent can be withdrawn through the Platform settings (Privacy & Data section), by contacting our Data Protection Officer at [email protected], or through the designated consent management interface available in Your account. Withdrawal of consent shall not affect the lawfulness of processing carried out prior to such withdrawal. Where withdrawal of consent makes it impossible to provide certain services, we shall inform you of the consequences before processing the withdrawal.

5.3 Children's Data — Verifiable Parental Consent

The Platform is intended for individuals aged 18 years or above. We verify age at signup through declared date-of-birth cross-checked against PAN/Aadhaar (where lawfully collected under separate Aadhaar Authentication purposes). Where a user is identified as a minor (under 18 years) at signup or at any point thereafter, we:

• (a) immediately short-circuit access to AI features, voice processing, behavioural personalisation, and targeted recommendations, in accordance with DPDP Act §9(3);
• (b) require verifiable parental or lawful-guardian consent through DigiLocker-verified guardian flow, or alternative methods notified by the Data Protection Board of India, prior to any further processing of the minor's personal data, per DPDP Act §9(1);
• (c) do not undertake tracking, behavioural monitoring, profiling, or targeted advertising directed at minors, per DPDP Act §9(3);
• (d) restrict data collection to the minimum necessary for account maintenance and grievance redressal;
• (e) honour parent/guardian-initiated erasure requests within seven (7) days of verified request;
• (f) maintain a dedicated minors-data register for audit by the Data Protection Board.

06AI-Specific Data Practices

6.1 AI Model Training

Our AI models are trained using a combination of publicly available financial datasets, licensed third-party data, synthetically generated data, and anonymised, aggregated user interaction data. We implement the following safeguards for AI training: personal data is anonymised or pseudonymised before use in training pipelines; differential privacy techniques are applied to prevent re-identification; training data undergoes bias detection and mitigation processes; model training logs are maintained for audit purposes; and users may opt out of having their anonymised data used for model improvement, via Platform Settings > Privacy > AI Training Opt-Out, or by emailing [email protected].

6.2 AI Output Disclaimer

6.3 Automated Decision-Making

Certain features of the Platform involve automated decision-making, including credit risk scoring for B2B partners, fraud detection and transaction monitoring, personalised financial recommendations, and safety interventions (distress detection, gambling pattern identification). Where automated processing produces decisions that significantly affect you, we ensure meaningful human oversight in the decision-making process, provide the right to request human review of automated decisions, offer clear explanations of the logic involved in automated processing, and maintain model cards documenting the purpose, performance, and limitations of each AI model.

6.4 Significant Data Fiduciary Posture

Given the scale of personal data processing, AI/ML model training on personal data, voice biometric processing, processing of financial data of Indian users, and cross-border infrastructure dependencies, We anticipate designation as a Significant Data Fiduciary (SDF) under DPDP Act §10. Accordingly, We have proactively implemented the obligations under §10(2):

• (a) appointed an Indian-resident Data Protection Officer (see Section 14);
• (b) appointed an independent Data Auditor for annual independent audit, per §10(2)(c);
• (c) committed to conduct Data Protection Impact Assessments (DPIA) prior to launch of any new significant processing activity, per §10(2)(b), with public summaries at https://mukodi.com/security;
• (d) established the periodic audit and reporting cadence at quarterly internal + annual external;
• (e) maintain enhanced security measures appropriate to SDF status, per IT (Reasonable Security Practices) Rules 2011 Rule 8.

We will publish formal SDF designation status, audit summaries, and DPIA outcomes at https://mukodi.com/security and update this Notice within thirty (30) days of any change in status.

07Data Sharing and Disclosure

7.1 Categories of Recipients

We may share your personal data with the following categories of recipients:

• Service Providers & Data Processors: Cloud hosting (AWS/GCP), payment gateways, KYC verification providers, SMS/email service providers, and analytics platforms operating under data processing agreements.
• Financial Institutions: Banks, NBFCs, and investment platforms for transaction execution and account aggregation, only with your explicit consent.
• Account Aggregator Ecosystem: RBI-licensed Account Aggregators for fetching financial data under the RBI Master Direction on Non-Banking Financial Company — Account Aggregator (Reserve Bank) Directions, 2016 (as amended), strictly with consent artifacts. IT-service vendors who process personal data on Our behalf operate under written contracts compliant with the RBI Master Direction on Outsourcing of IT Services (April 2023).
• B2B Partners: Aggregated and anonymised insights for enterprise API clients; individual personal data is never shared with B2B partners without explicit consent.
• Regulatory Authorities: SEBI, RBI, Income Tax Department, CERT-In, Data Protection Board of India, and other bodies pursuant to legal obligations.
• Legal Requirements: Courts, tribunals, or law enforcement agencies pursuant to valid legal process.

08Cross-Border Data Transfers

8.1 Default Storage Location

All Personal Data is stored within India by default, in AWS Asia Pacific (Mumbai) region (ap-south-1) and AWS Asia Pacific (Hyderabad) region (ap-south-2), and replicated within these Indian regions for disaster recovery.

8.2 Permitted Cross-Border Transfers

Personal Data may be transferred outside India only in the following limited circumstances, and only to jurisdictions NOT included on the restricted-countries list notified from time to time by the Central Government under DPDP Act §16(1):

• (a) to vendors providing infrastructure or operational support contractually bound to equivalent or stronger data-protection commitments (e.g., AWS GuardDuty threat-intelligence summaries, Cloudflare DDoS-mitigation telemetry);
• (b) with Your explicit consent for a specific purpose;
• (c) where required by an Indian court order or by lawful authority;
• (d) to Our independent Data Auditor for the limited purpose of audit, under §10(2)(c).

8.3 No Transfer Without Lawful Basis

We do NOT transfer Personal Data to:

• Jurisdictions on the Central Government's restricted-countries list (as notified from time to time);
• Vendors not contractually bound to Indian data-protection commitments;
• Any party for advertising, marketing, or training of third-party AI models outside the scope of these Terms.

8.4 Specific Vendor Disclosure

A current list of cross-border processors and their applicable jurisdictions is maintained at https://mukodi.com/security/subprocessors and updated quarterly.

09Data Retention and Deletion

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law. Active account data is retained for the duration of your relationship with us plus a period of three (3) years following account closure for legal and regulatory compliance.

Financial transaction records are retained for a minimum of eight (8) years as required under income tax and financial regulations. KYC documents are retained for five (5) years after the cessation of the business relationship. AI interaction logs are retained for two (2) years for service improvement and audit purposes. Voice recordings are retained for one (1) year unless you request earlier deletion. Anonymised and aggregated data may be retained indefinitely as it does not constitute personal data.

Upon expiry of the retention period or upon Your valid request for erasure (and in the absence of any overriding legal obligation), personal data shall be securely deleted or irreversibly anonymised within ninety (90) days. Erasure cascades operationally across all primary stores, derived caches, vector indexes, and audit-log payloads, with per-store status confirmation available to You on request.

10Rights of Data Principals

Under the DPDP Act, you have the following rights with respect to your personal data:

You may exercise any of the rights above through our self-serve DSAR portal at https://mukodi.com/account/data-rights (consumer accounts) or by emailing [email protected] with proof of identity (Aadhaar masked / PAN / passport). We will acknowledge within 24 hours and complete the request within thirty (30) days, with extensions permitted only for legitimate verification requirements as recognized by DPDP Act §13(3). We may request additional information to verify your identity before processing a rights request. There is no fee for exercising your rights, unless requests are manifestly unfounded or excessive.

11Security Measures

We implement reasonable security safeguards to protect your personal data from unauthorised access, use, modification, disclosure, or destruction, commensurate with the nature and sensitivity of the personal data and the risks associated with processing. Our security measures include:

• Encryption: AES-256 encryption at rest (implementation in progress) and TLS 1.2+ in transit (TLS 1.3 targeted for launch)
• Access Control: Role-based access control (RBAC), multi-factor authentication, and principle of least privilege
• Network Security: Web application firewall and rate limiting (commercial WAF evaluation in progress), and network segmentation
• Application Security: Secure coding practices, regular security audits, penetration testing, and vulnerability assessments
• PII Protection: PII masking middleware (coverage expansion ongoing), differential privacy techniques (planned for analytics pipeline), and privacy budget tracking
• AI Model Security: Adversarial robustness testing, model poisoning detection, input validation, and output sanitisation
• Infrastructure: Secure cloud infrastructure with ISO 27001 and SOC 2 Type II certification (audit engagement planned), and regular third-party audits
• Incident Response: Documented incident response plan, regular DR drills, and security monitoring infrastructure (24/7 coverage planned for launch)

Our security programme aligns with the IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (Rule 8), the CERT-In Directions of April 28, 2022 (logging + 6-hour incident reporting), and, to the extent applicable to Our regulated partners, the SEBI Cybersecurity and Cyber Resilience Framework (Master Circular dated August 20, 2024, as updated from time to time).

While we implement commercially reasonable security measures, no system is completely immune to security threats. We continuously monitor, assess, and improve our security posture.

12Data Breach Notification

In the event of a personal data breach that is likely to cause harm to any Data Principal, we shall:

• Notify the Data Protection Board of India without unreasonable delay, and in any event within 72 hours of becoming aware of the breach, as required under Section 8 of the DPDP Act
• Notify affected Data Principals without unreasonable delay, in clear and plain language, describing the nature of the breach, the personal data affected, measures taken to mitigate harm, and recommended protective actions
• Report to CERT-In (Indian Computer Emergency Response Team) within six (6) hours of detection, as required under IT Act directions
• Maintain detailed breach records including the facts of the breach, its effects, and remedial actions taken
• Conduct post-breach review and implement enhanced safeguards to prevent recurrence

13Cookies and Tracking Technologies

We use cookies and similar tracking technologies to enhance your experience on the Platform. The types of cookies we use include:

• Essential Cookies: Necessary for Platform functionality, authentication, and security. These cannot be disabled.
• Analytics Cookies: Help us understand usage patterns and improve the Platform. May be disabled via cookie preferences.
• Preference Cookies: Store your settings, language preferences, and display choices. May be disabled via cookie preferences.

We do not use advertising or third-party tracking cookies. You may manage cookie preferences through the Platform's cookie settings or your browser settings. Disabling certain cookies may affect Platform functionality.

SMS and Email Communications: All transactional and promotional SMS and email messages are sent in accordance with the Telecom Regulatory Authority of India (TRAI) Telecom Commercial Communications Customer Preference Regulations, 2018 (TCCCPR 2018) and the Distributed Ledger Technology (DLT) registration framework. Promotional messages are sent only to recipients who have opted in, and recipients may opt out at any time through the unsubscribe mechanism embedded in each message or by managing communication preferences in the Platform settings.

14Grievance Redressal

In accordance with the DPDP Act and IT Act, we have appointed a Grievance Officer / Data Protection Officer to address your concerns regarding data processing:

Escalation: Data Protection Board of India for data-protection matters; National Consumer Helpline (1915) for consumer-protection matters; or the appropriate Consumer Commission under the Consumer Protection Act 2019.

Grievances under Section 79 of the IT Act may also be addressed to the Grievance Officer at the same contact details above.

15Amendments

We reserve the right to update or modify this Policy from time to time to reflect changes in our data practices, legal requirements, or Platform features. When we make material changes, we shall notify you via prominent notice on the Platform (banner notification), email notification to your registered email address, and in-app notification with a summary of changes.

Material changes shall be notified at least thirty (30) days before they take effect, and where such changes require fresh consent, we shall obtain it before implementing the changes. Your continued use of the Platform after the effective date of any modifications constitutes acceptance of the updated Policy.

16Governing Law and Jurisdiction

This Policy shall be governed by and construed in accordance with the laws of India, including the Digital Personal Data Protection Act, 2023, the Information Technology Act, 2000, and rules made thereunder. Any disputes arising out of or in connection with this Policy shall be subject to the exclusive jurisdiction of the courts in Chennai, Tamil Nadu, India, without prejudice to the jurisdiction of the Data Protection Board of India for matters under the DPDP Act.

17Severability

If any provision of this Policy is found to be invalid, illegal, or unenforceable by a court of competent jurisdiction or the Data Protection Board of India, such invalidity, illegality, or unenforceability shall not affect the remaining provisions of this Policy, which shall continue in full force and effect. The invalid, illegal, or unenforceable provision shall be deemed modified to the minimum extent necessary to make it valid, legal, and enforceable.

18Acknowledgment

By accessing, registering for, or using the Mukodi Platform, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy. You further acknowledge that you have been informed of your rights under the DPDP Act and the mechanisms available to exercise those rights. If you do not agree with any part of this Policy, you should discontinue use of the Platform immediately.