Privacy Policy

Ojas Loans is a Lending Service Provider: we compare loan products, advise borrowers, and assemble loan files for regulated lenders (banks and NBFCs). We are never the lender. The lender underwrites, sanctions, and disburses every loan, and loan money moves directly between you and the lender — never through an Ojas account.

This shapes how data flows: your loan file is shared with a regulated lender only when you ask us to take your enquiry forward, and once shared, that lender handles it as an independent regulated entity under its own privacy policy and RBI obligations.

• Account data — name, email, password (stored as a salted hash), timezone, locale, and organisation membership.
• Enquiry data— what you tell us when you check eligibility: the loan family and amount you’re looking for, your business entity type and vintage, and your contact details (name, phone, email, city).
• File data — business and financial documents you choose to share with your named consultant so a loan file can be assembled. We ask only for what the lender checklist needs, and we do not ask you to submit Aadhaar numbers or bank credentials through this website.
• Payment data — where you buy a disclosed advisory service: amounts, currency, payment status, and provider references. Card and UPI details go directly to the payment provider; we never see or store them.
• Technical data — IP address, browser type, and request logs used for security, rate limiting, and debugging. Our free calculators run in your browser; the figures you type into them are not sent to us.

We use personal data to:

• run the service — receive your enquiry, assign it a named consultant, assemble your loan file with your participation, and track it to a lender decision;
• deliver advisory services you have purchased, and invoice them on the terms quoted to you before work began;
• send transactional communication — enquiry confirmations with your reference id, consultant follow-ups, and updates about a file you asked us to carry;
• keep the platform safe — fraud prevention, abuse detection, rate limiting, and audit logging of sensitive actions; and
• meet legal obligations, including tax and accounting.

We do not sell personal data, and we do not use borrower data for third-party advertising.

We process data with your consent (given when you submit an enquiry, create an account, or purchase an advisory service) and for certain legitimate uses recognised by law, such as complying with legal obligations and responding to emergencies. You may withdraw consent at any time; services that depend on that data — such as carrying your loan file — may stop working once you do.

• Regulated lenders receive your loan file when you ask us to take your enquiry to them — that is the product. From that point they process it as independent data fiduciaries under their own policies.
• Your consultant or partner advisorsees the enquiries and files they are assigned to work — never another advisor’s book.
• Payment providers (such as Razorpay and Stripe) process payments and refunds for advisory services.
• Service providers host our infrastructure and deliver email on our instructions, under contracts that restrict their use of the data.
• Authorities, where the law requires us to disclose.

We keep cookies to the minimum the product needs:

• a session cookie that keeps you signed in; and
• a preference cookie that remembers your theme so pages paint correctly on first load.

We do not set third-party advertising or cross-site tracking cookies. Payment providers may set their own cookies on their checkout components, governed by their policies.

Account data is kept while your account is active. Enquiry, advisory-order, and invoice records are kept for as long as tax and accounting law requires, typically eight years in India. Security logs are kept for short, fixed windows. When data is no longer needed, we delete it or irreversibly anonymise it. Data held by a lender about a sanctioned loan is governed by that lender’s retention obligations, not ours.

You can:

• access and correct your data from your account settings;
• ask for a copy of your data, or for erasure where we have no legal duty to keep it;
• withdraw consent for non-essential processing; and
• raise a grievance with us, and escalate to the Data Protection Board of India if you are not satisfied with our response.

Requests go to privacy@ojas.loans — we respond within the timelines the law sets.

Data is encrypted in transit, passwords are stored as salted hashes, access is scoped per tenant so one customer can never read another’s data, sensitive actions are audit-logged, and documents are served from private storage with ownership checks. No system is perfectly secure; if a breach affects your data we will notify you and the authorities as the law requires.

Accounts and enquiries are for adults (18+). The platform is intended for business borrowing and advisory work and is not directed at children.

Our primary infrastructure serves customers in India. Where a service provider processes data outside India, we do so only as permitted by applicable law and under contracts that protect the data to the standards of this policy.

We may update this policy as the product and the law evolve. The “Last updated” date reflects the current version; material changes are notified by email or in-product notice.

Privacy questions and grievances: privacy@ojas.loans or grievance@ojas.loans. General support: hello@ojas.loans or the contact page. Postal correspondence reaches us at the registered office of CHITRAM.AI PRIVATE LIMITED.