Privacy Policy

This Privacy Policy should be read together with our Site Terms of Use and Credit Report Terms of Use — collectively, the "Agreement" between you and us. It is published in compliance with the Information Technology Act, 2000 (as amended) and other applicable law.

Upshift Services Pvt Ltd intends to protect the privacy of Users on its site and is committed to maintaining the confidentiality, integrity and security of the information Users provide. This policy describes how we collect and handle information we may collect or receive from you through your use of the site, and applies to all current and former Users. By visiting or using our site, you agree to this Privacy Policy.

By submitting your mobile number on the site and accepting the consents presented at registration or when availing our Services, you accept this Privacy Policy and explicitly consent to our collection, storage, retention, analysis, use and disclosure of your information in accordance with it and applicable law.

To register on our site, you provide information including your mobile number, date of birth, OTP validation, full name, email ID, and other details shared via an application form, email or other medium. We may collect additional information depending on the product you choose and the Services we render, solely for the purpose for which it was collected — collectively, your "Information".

With your one-time explicit consent, we may request access to your location, camera, microphone, or other device facilities necessary for onboarding or KYC. You can withdraw this consent at any time from your device settings; once withdrawn, we will not access that Information prospectively. Written communication you exchange with us — emails, feedback, discussion participation — is handled with confidentiality.

We collect your Information to: provide the Services you avail; market new financial products and services from us or our group companies, Affiliates or Partners; notify you about new products, services, offers or promotions; and recommend suggestions related to Services you've availed, based on your Information.

We offer an online platform for financial products and services, and the Information we collect to process your transaction requests may be shared with relevant Third Parties and Affiliates for that purpose. We take reasonable steps to ensure confidentiality is maintained by imposing strict confidentiality standards on the Service Providers to whom we disclose Information.

We and our Partners, Affiliates and Service Providers may share or transfer some or all of your Information with another business entity to carry out business activity related to the Services and products offered to you, in accordance with applicable law — for providing Services, marketing new products, or notifying you of new offers.

Where we redirect you to a Third Party's site for certain Services, your Information is used, processed and stored by that Third Party under their own terms; we may not retain a copy in that case and are not responsible for their use of your Information — that responsibility rests solely with the Third Party.

We may update this Privacy Policy due to changes in law or to our site's functionality; the updated policy takes effect once posted, and if you continue using the site, you consent to your Information being used under the new policy. If you disagree with a change, you should tell us that you do not want your Information used under it.

Upshift Services Pvt Ltd is strongly committed to protecting the privacy and security of its Users, and takes reasonable measures to protect the confidentiality and integrity of User Information and its secure transmission, including:

Technical, physical and administrative controls to safeguard internal information, alongside periodic internal and external penetration testing, assessments and audits in line with RBI, SEBI and IRDAI obligations.

Alignment and certification with the ISO 27001:2022 standard, and use of data-discovery tooling so personal data is tracked across all assets and secured with encryption-at-rest and masking.

Access-control measures across all data assets, following least-privilege and need-to-know principles, and information-security tooling (DLP, WAF, SOC/SIEM) to help prevent data leakage, monitor the network, and protect the platform from external threats, with systems and endpoints kept on the latest tested patches.

A defence-in-depth architecture using tools from different vendors across different layers to avoid a single point of failure, and contractual obligations requiring Third Parties to apply appropriate security controls and safeguards to any information they handle.

An internal incident-reporting and management policy covering escalation, containment and recovery for information-security incidents, reviewed and updated periodically.

We may share your Information with government agencies and authorities in accordance with applicable law.

Information you provide is retained, save for withdrawal or termination, for a period of 10 (ten) years. We will delete your Information based on a deletion request submitted on the site, within a reasonable period and no later than 14 (fourteen) days of receiving it.

We may retain data after account deletion where there is an unresolved issue relating to your account or an unresolved claim or dispute, where required by applicable law, in aggregated or anonymised form, or where necessary for legitimate business interests such as fraud prevention and User safety.

If you start a loan application and do not complete it within 90 (ninety) days, all information related to that application is deleted from the site.

We follow DoD 5220.22-M (the National Industrial Security Program Operating Manual) and NIST 800-88 (Guidelines for Media Sanitization) for data destruction.

By agreeing to avail our Services, you consent to the collection and use of your Information as described here. You may refuse, partially withdraw, or fully withdraw that consent at any time by raising a service request through the site. If you do, we may not be able to continue offering products or Services that depend on that consent, and any withdrawal is prospective only — Information already shared with Third Parties under an earlier consent may not be destroyed in all cases.

Personal & demographic: full name, gender, date of birth/age, marital status, photograph, signature, details of parents, children or nominees.

Contact & address: email ID, mobile/contact number, residential and correspondence address.

Educational & professional: educational qualification, profession type, professional membership number (CA, CS, CMA).

Identity & KYC: Aadhaar (collected as permitted by law), PAN, GST number, KYC status.

Location, device & access: one-time location, camera and microphone access for onboarding/KYC, and device details.

For insurance applicants: vehicle number and details, previous policy details, height and weight, bank account and payment details, net monthly salary credited, and any other detail requested by the insurer on a case-by-case basis.

We collect this Information solely to provide you Services smoothly, and disclose these categories only where necessary and proportionate to the purpose for which it was collected, or a compatible operational purpose.

Like most sites, we use small pieces of data called cookies to maintain a continuous connection and remember your preferences and session information as you move between pages, without needing to re-enter data. We also use cookies for marketing purposes and to measure the effectiveness of our online content. No personal information is collected via cookies directly; however, if you have previously provided personal information, cookies may be tied to it. Information collected this way is stored in secure databases with access controls and treated as confidential.

If you have a complaint, discrepancy, request, or concern about how your Information is used, processed or disclosed, or about a breach of the Site Terms of Use, Credit Report Terms of Use or this Privacy Policy, you may contact our designated Grievance Redressal Officer, who will address it expeditiously and within the period prescribed by law.

Email: support@upshiftserv.com

Name and phone number of the Grievance Redressal Officer are published on request and kept up to date on our Grievance Redressal page.