Privacy Policy

1. Who we are

CreditDoctor (“CreditDoctor”, “we”, “us”, or “our”) is a credit-health platform operated by Revelosoft Technologies Pvt. Ltd., a company incorporated in India. We are the Data Fiduciary responsible for the personal data you provide while using our website at www.creditdoctor.in and related services (together, the “Service”).

We are not a credit bureau. We do not pull, fetch, or generate your credit report from any bureau. You upload a report you have already obtained yourself, and we help you understand and improve it.

2. The data we collect

Information you give us

• Account details — your name, email address, and mobile number, used to create and secure your account.
• Identity & profile details — PAN, date of birth, and address, where you choose to provide them, to match and organise your reports.
• Credit reports you upload — the PDF credit reports you obtain from CIBIL (TransUnion), Experian, CRIF High Mark, or Equifax, and the account, enquiry, and score data we extract from them.
• Communications — messages you send us through support, contact forms, or the in-app assistant.

Information we collect automatically

• Usage & device data — IP address, browser/user-agent, pages viewed, and actions taken, used to operate, secure, and improve the Service.
• Session & security logs — login times and audit records of sensitive actions, kept to protect your account and meet our legal obligations.

3. Why we use your data (purpose & lawful basis)

We process your personal data only for specified purposes, on the basis of the consent you give us, or where processing is necessary for the Service you have asked for or to comply with law:

• To create your account and authenticate you (including OTP delivery by SMS/email).
• To parse and analyse the credit reports you upload, and generate explanations, improvement plans, simulations, and draft lender communications.
• To provide the AI assistant, scoped strictly to the report and profile you select.
• To process subscription payments and manage your plan.
• To respond to your queries and provide customer support.
• To send service and security notifications, and — only with your separate consent — product updates and offers.
• To detect, prevent, and investigate fraud, abuse, and security incidents.
• To comply with applicable law and enforce our Terms.

We do not sell your personal data. We do not use your credit data for advertising.

4. AI processing

Our analysis and assistant features use automated processing, including large-language-model services, applied to the contents of the report you upload. Outputs are educational and informational and are not a guarantee of any credit-score change or lending decision. We instruct our AI providers not to use your data to train their models. You should always verify findings against your official bureau report.

5. How we protect your data

• Encryption in transit — all traffic is served over HTTPS/TLS.
• Encryption at rest for sensitive fields — identifiers such as your PAN and phone number are encrypted in our database; we store irreversible hashes for lookups so we never need to expose them in plain text.
• Access controls & audit logging — access to personal data is restricted and sensitive actions are logged.
• Profile isolation — the assistant is scoped to a single profile and never mixes one person’s data with another’s.

No method of transmission or storage is perfectly secure, but we work to protect your data using safeguards appropriate to its sensitivity. If a personal-data breach occurs, we will notify the Data Protection Board of India and affected users as required by law.

6. Sharing & disclosure

We share personal data only with:

• Processors who run the Service on our behalf — cloud hosting and storage (Microsoft Azure), document/AI processing, payment processing (Razorpay), and SMS/email delivery. These providers act on our instructions under contractual safeguards.
• Lending partners — only if you give separate, explicit consent for partner offers. You can withdraw this at any time.
• Authorities — where required by law, court order, or to protect rights, safety, and security.

Some providers may process data outside India. Where they do, we rely on contractual and technical safeguards and only transfer to jurisdictions permitted under applicable law.

7. How long we keep your data

We keep your account data for as long as your account is active. For credit reports, we retain the latest report per bureau to power your dashboard and trends; older reports may be superseded. When you delete a report or close your account, we delete the associated personal data and uploaded files within a reasonable period, except where we must retain limited records to comply with law, resolve disputes, or enforce our agreements.

8. Your rights under the DPDP Act, 2023

As a Data Principal, you have the right to:

• Access a summary of the personal data we process about you.
• Correct, complete, or update inaccurate data.
• Erase your data when it is no longer needed for the purpose it was collected.
• Withdraw consent at any time (this will not affect processing already carried out, and may limit features that depend on that data).
• Grievance redressal — raise a complaint and have it addressed.
• Nominate another individual to exercise your rights in the event of death or incapacity.

You can exercise most of these directly from your account settings, or by contacting our Grievance Officer (see below). We may need to verify your identity before acting on a request. If you are not satisfied with our response, you may complain to the Data Protection Board of India.

9. Children

The Service is intended for individuals aged 18 and above. We do not knowingly process the data of children. If you believe a child has provided us data, please contact us so we can remove it.

10. Cookies & local storage

We use essential cookies and browser local storage to keep you signed in and to operate the Service. We do not use third-party advertising cookies.

11. Changes to this policy

We may update this policy from time to time. We will post the revised version here with a new “Last updated” date and, for material changes, notify you through the Service or by email.

12. Contact us & Grievance Officer

For any privacy question or to exercise your rights, contact our Grievance Officer (who also serves as our point of contact for data protection):

See our full Grievance Redressal process for escalation details, and our Terms of Service for the rules that govern use of the Service.