1. Who we are
Loan24x7 is a small, independent third-party loan comparison and referral service operated by NayakEdu Loans24x7, a Udyam-registered micro enterprise registered at Odisha, India (Udyam registration number UDYAM-OD-07-0019590). In the language of the Digital Personal Data Protection Act 2023 we are the Data Fiduciary for the information described in this policy, and you are the Data Principal.
We are not a lender, a bank or an NBFC. We do not issue loans, we do not disburse funds, we do not hold your money and we do not collect repayments. All we do is show you which lenders would realistically lend to you, put the best of those offers in front of you, and point you to the lender’s own website to apply.
The lender decides everything about your loan. When you choose an offer we introduce you to that lending partner. They set the rate, run their own checks, and approve or decline you — we have no part in that decision. From the moment you leave our site, that lender is a separate data fiduciary handling your data under their own privacy policy, not ours, and we cannot control or be responsible for what they do with it. We will always tell you who we are passing you to before we do it.
Being small is relevant to this policy, so we will say it plainly: there is no large data department here. We collect as little as we can precisely because a small operation should not be holding information it does not need, and everything below is written to be checkable rather than impressive.
2. What we collect, and why
We ask for the minimum needed to tell you which lenders would consider you. Field by field:
Contact details
- Mobile number — so a lender or our team can reach you about your application, and so you can verify your number over WhatsApp.
- Email address — to create your account, send you your offers, and confirm what you applied for.
About you
- Full name and date of birth — lenders set minimum and maximum ages, and your name goes on the application you complete with them.
- Gender — optional, and you can decline to say. Some lenders offer products restricted by gender; we use it for nothing else.
- City, state and pincode — several lenders only operate in certain states, and some exclude specific pincodes.
Your work and money
- Employment type, employer or business name, years in the role — every lender prices and approves differently by employment type.
- Net monthly income — the primary matching criterion. Every lender sets a minimum.
- Existing monthly EMI commitments — used to check that a new instalment would be affordable before we show it to you.
- Self-declared credit score band — so we do not show you offers from lenders whose minimum score you cannot meet. We do not pull your credit report.
What you are looking for
- Loan amount, preferred tenure and purpose — to calculate the instalment and match you to lenders who offer that size of loan.
Documents you choose to upload
- A credit report — entirely optional, and the step can be skipped without penalty. If you upload one it helps us match you more accurately. See section 6 for how it is stored and when it is deleted.
Technical and usage data
- IP address, browser and device type, the pages you viewed, and the campaign or link that brought you here — for security, fraud prevention and to understand which parts of the service work.
Identity numbers — optional, and only if you type them
- Aadhaar number and PAN. Both appear on the form as optional fields. You are not required to give either one, nothing is hidden from you if you leave them blank, and the offers you are shown are identical either way — no lender match, ranking or eligibility check uses them. If you do enter them we store them against your application so a partner can pre-fill your application, and they are masked everywhere we display them back to you. You can ask us to erase them at any time, on their own, without deleting the rest of your application. We never ask you to upload a photograph or scan of either document, and lenders always carry out their own KYC on their own platforms.
What we deliberately do not collect
- Passwords, OTPs, card numbers or net-banking credentials. We will never ask for any of these. Anyone who does, in our name, is committing fraud.
- Your contacts, SMS messages, call logs, photo library or precise location. Our website asks for none of these permissions.
3. Our lawful basis, and your consent
Under the DPDP Act 2023 we process your personal data on the basis of the consent you give us, which must be free, specific, informed, unconditional and unambiguous.
We ask for two separate consents, and we keep them separate:
- Terms and privacy consent — required to use the service, because we cannot match you to lenders without processing what you tell us.
- Marketing consent — entirely optional. It is never pre-ticked, it never blocks you from continuing, and declining it changes nothing about the offers you see.
Each consent is recorded separately with the time you gave it, your IP address, your browser, and the version of this policy that was in force. You can withdraw either at any time — see section 8. Withdrawing marketing consent stops the marketing; withdrawing the processing consent means we can no longer operate the service for you, and we will delete your data.
4. Who we share your data with
Lending partners
We share your details with a lending partner only when you choose them and click through to apply. We do not broadcast your application to every lender on the platform, and we do not sell your data to lead brokers.
The lenders we work with are listed in full on our lending partners page, which is kept current. Once your details reach a lender, that lender processes them as an independent data fiduciary under its own privacy policy, and you should read theirs before you complete an application with them.
Service providers who process data on our behalf
These are Data Processors: they act only on our instructions and cannot use your data for their own purposes.
| Provider | What they do for us | Where |
|---|---|---|
| Supabase | Database, authentication and encrypted file storage | Asia Pacific |
| Cloudflare | Hosting, CDN, DNS, bot protection (Turnstile) and web analytics | Global edge |
| Google (Analytics 4) | Traffic and funnel measurement, after consent | Global |
| Microsoft (Clarity) | Aggregated behaviour analytics with all PII fields masked | Global |
| Brevo | Transactional email — sign-in links and application confirmations | EU |
| Sentry | Error monitoring, with personal data stripped before send | EU/US |
Legal disclosure
We may disclose data where we are legally required to — a court order, a lawful request from a regulator or law-enforcement agency, or to establish or defend a legal claim.
We do not sell your personal data. Not to lenders, not to brokers, not to advertisers.
5. Cookies and analytics
We ask before we set any analytics cookie. If you decline, the analytics tools below do not load at all.
- Strictly necessary storage — keeps you signed in and remembers your half-finished application on your own device. This is not used for tracking and cannot be switched off without breaking the service.
- Google Analytics 4 — how many people use each part of the funnel, so we can find where it breaks. Loaded only after you accept.
- Microsoft Clarity — aggregated behaviour analytics. Every field that can hold personal data is masked before anything leaves your browser, so income, names, phone numbers and email addresses are never recorded. Loaded only after you accept.
- Cloudflare Web Analytics — cookieless page-view counting that sets no identifier and follows you nowhere. It runs whether or not you accept cookies.
You can change your mind at any time by clearing this site’s storage in your browser, which brings the consent prompt back.
6. How long we keep things
- Credit reports you upload — 90 days, then deleted automatically. We say so at the point you upload one.
- Abandoned application drafts — 180 days from the last time you touched them, then deleted.
- Completed applications and account data — for as long as you have an account, and for a reasonable period afterwards to handle disputes.
- Records of referrals that became loans — 8 years, because we have to be able to evidence them for audit and tax.
- Consent records — kept for as long as we can be asked to prove the consent was given.
7. How we protect your data
- Everything travels over HTTPS, and is encrypted at rest by our database provider.
- Uploaded documents go into a private storage bucket with row-level access rules. Only you and the reviewing member of our team can retrieve them, through short-lived signed links that expire.
- Access to production data is limited to the people who need it, and is logged.
- Personal data is stripped before anything reaches our error-monitoring or session analytics tools.
- Forms are protected against automated abuse and rate-limited.
No system is perfectly secure. If we ever suffer a personal data breach we will notify the Data Protection Board of India and affected users as the DPDP Act requires.
8. Your rights, and how to use them
Under the DPDP Act 2023 you have the right to:
- Access — get a summary of the personal data we hold about you and who we have shared it with.
- Correction and completion — have inaccurate or incomplete data fixed.
- Erasure — have your data deleted, except where we are legally required to keep it.
- Withdraw consent — at any time, as easily as you gave it.
- Nominate — name someone to exercise these rights on your behalf if you die or become incapacitated.
- Grievance redressal — complain to us first, and escalate to the Data Protection Board of India if we do not resolve it.
To exercise any of these, email grievance@loans24x7.nayakedu.com, or use the “Delete my data” action in your account. We respond within 30 days, usually much sooner. We may ask you to confirm your identity first — that is to stop someone else exercising your rights.
9. Children
Our service is for adults. You must be at least 21 to apply, which is the minimum age every lender we work with sets. We do not knowingly collect data from anyone under 18, and if we learn we have, we delete it.
10. Complaints and our grievance officer
If you are unhappy with how we have handled your data, raise it with our grievance officer. We acknowledge every complaint within 24 hours and aim to resolve it within 15 days.
Priyanka Patel, Grievance Officer
grievance@loans24x7.nayakedu.com
Odisha, India
If we do not resolve your complaint to your satisfaction, you can escalate it to the Data Protection Board of India.
11. Changes to this policy
When we change this policy we update the version number and the date at the top of this page. If a change materially affects how we use your data, we will tell you by email before it takes effect, and where the law requires it we will ask for your consent again. Continuing to use the service after a change means you accept the updated policy.
12. Governing law
This policy is governed by the laws of India. Any dispute arising from it is subject to the exclusive jurisdiction of the courts at Odisha, India .