Privacy Policy

Who we are

The SME PAiSA Associates app and this website are run by SME Paisa ("SME Paisa", "we", "us"), registered office: H-23, Ground Floor, Opposite Axis Bank, Sector 63, Noida, Uttar Pradesh 201309. We decide why and how your personal data is used, so under the Digital Personal Data Protection Act, 2023 (DPDP Act) we are the "Data Fiduciary".

This policy applies to Associate Partners and to our staff who use the app. It does not cover other SME Paisa websites.

What we collect

When you sign up and use the app we collect:

• Identity (from DigiLocker, with your consent): name as on Aadhaar, gender, date of birth, address, and only the last 4 digits of your Aadhaar number.
• PAN: checked with the income-tax records, stored encrypted; the app shows it masked.
• Bank account: account number (encrypted), IFSC, bank name and account holder name, checked with a ₹1 penny-drop.
• Contact: mobile number and email address (both verified with a code).
• Profile: education and the industries you know.
• Your work in the app: cases you add, tickets and messages, earnings, course progress, quiz results and certificates.
• Technical: device notification token, app version, and IP address and time of requests (for security).
• Your consent: which version of the terms you accepted and when.

Customer data you add

When you add a case you give us details of a business owner (our customer): name, mobile number, business name, industry, years in business, turnover, the loan amount needed and your notes. You must add a customer only with their permission, as the Terms & Conditions say. We use these details only to process their loan request with lenders, and protect them the same way as your own data.

Why we use it

• To verify who you are and open your partner account (KYC).
• To process the cases you add and send them to lenders.
• To calculate and pay your commission, and to deduct and report TDS as the Income-tax Act requires.
• To send you codes, case updates, ticket replies and important notices.
• To provide training, quizzes and certificates.
• To keep the app secure, stop fraud and misuse, and fix problems.
• To follow the law, court orders and requests from government authorities.

We use your data on the basis of your consent (given at sign-up) and for the legitimate uses the DPDP Act allows, such as following the law. We never sell your data and never use it for advertising.

Who we share it with

Only these service providers, only what each one needs, and under contract or their published terms:

Inside SME Paisa, only the admin and operations team members who need your details for your account, cases or payments can see them. Associates never see the names or contacts of our staff.

Data outside India

Our database is hosted in Singapore, AI summaries are made by OpenAI in the USA, and some network and notification services run worldwide. The DPDP Act allows this except to countries the Government of India restricts; we will stop any transfer the Government restricts.

How we protect it

• PAN and bank account numbers are encrypted (AES-256) and the app shows them masked.
• All data travels over HTTPS; the server is behind Cloudflare with rate limits.
• Staff accounts need two-step verification; every login uses a signed token that ends when the password changes.
• Codes (OTP) are stored only as hashes and expire in 10 minutes.
• If a personal data breach happens, we will tell the affected users and the Data Protection Board of India / CERT-In as the law requires.

How long we keep it

We keep data only as long as needed for the reason it was collected, or longer only when the law requires it (for example tax records). The full table is on the Data storage & retention page.

Your rights

Under the DPDP Act you can:

• Ask for a summary of the personal data we hold about you and who we shared it with.
• Ask us to correct or complete wrong or old details (raise a ticket in the app).
• Withdraw your consent and ask us to erase your data (delete your account, see below).
• Nominate a person to use these rights for you in case of death or incapacity.
• Complain to our Grievance Officer, and if you are not satisfied, to the Data Protection Board of India.

Deleting your account

In the app: Profile → Profile details → ⋮ → Delete my account, confirm with the code we email you. Your account becomes inactive at once and our team deletes it within 7 days; signing in again before it is deleted cancels the request. You can also write to connect@smepaisa.com from your registered email.

On deletion we erase your name, contact details, address, Aadhaar digits, bank details, course data and the cases that were never paid. If you were paid commission, the paid cases and your encrypted PAN are kept without your name, only for income-tax / TDS records.

Children

The app is only for people aged 18 or above. We do not knowingly collect data of children.

This website

This website uses no cookies, no advertising and no tracking. Our hosting provider may keep basic request logs (like IP address) for security.

Changes

When we change this policy we update the version and date at the top, and tell you in the app or by email before important changes apply.

Grievance officer

We aim to reply within 7 days and resolve every complaint within 30 days.