Where data is stored
App data is stored in a managed PostgreSQL database (Neon, Singapore region, encrypted at rest) and handled by our server in India (AWS Mumbai). PAN and bank account numbers are also encrypted by us before they are saved. Course audio and certificates are kept on our server.
How long we keep it
| Data | While active | After deletion | Why |
|---|---|---|---|
| Name, email, mobile, address, date of birth, gender | Kept | Erased | To run your account |
| Aadhaar (last 4 digits only) | Kept | Erased | Proof that KYC was done |
| PAN (encrypted) | Kept | Erased, or kept encrypted for 8 years if you were paid commission | TDS returns and Form 16A need the PAN (Income-tax Act) |
| Bank account (encrypted) + IFSC | Kept | Erased; only the last 4 digits are kept if you were paid | Proof of where commission was paid |
| Cases never paid (customer details, notes) | Kept | Deleted with their tickets | To process the loan request |
| Disbursed / paid cases | Kept | Kept 8 years, without your name ("Deleted associate") | Accounts, tax audit and lender records |
| Tickets and messages | Kept | Deleted with their case | Support history |
| Course progress, quiz results, certificates | Kept | Deleted (the certificate check page stops working) | Training |
| Login and email codes (OTP) | Expire in 10 minutes; stored only as hashes | Deleted | Security |
| Notification token | Kept until you log out | Erased | To send notifications |
| Security logs (IP address, time) | Up to 180 days | Up to 180 days | Security and CERT-In rules |
| Deletion request record | Not applicable | Partner code and dates only | Proof that we acted on your request |
Why we keep some data
Tax law
Commission is paid after TDS. The Income-tax Act needs payment and TDS records (with PAN) for several years, so we keep about 8 years.
Disputes and audits
Paid cases may be checked by lenders, auditors or courts. We keep them without your personal details.
Fraud prevention
Your PAN stays registered (encrypted) so the same PAN cannot open a new account without our support team.
After you delete
Your account becomes inactive at once and our team deletes it within 7 days (sign in again before that to cancel): if you were never paid commission, everything is deleted; if you were, only the paid cases and the encrypted PAN stay, without your name, for the time above. See the Privacy Policy for how to ask.