Privacy Policy
This Privacy Policy describes how Creafin Tech Private Limited ("Creafin Tech", "we", "us", or "our") collects, uses, stores, and protects your personal information when you use TIP — Your Finn Mitra and related services. We are committed to protecting your privacy and handling your data responsibly.
1. Information We Collect
We collect the following categories of information:
Information you provide directly:
- Mobile phone number — used for account creation and OTP verification.
- Card portfolio information — the credit cards you add to TIP including card names and issuing banks. We do not collect card numbers, CVV, or net banking credentials.
- Contact form submissions — name, email, and message content when you reach out to us.
- Waitlist registrations — mobile number provided to join the waitlist.
Information collected automatically:
- SMS transaction data — with your explicit permission, TIP reads transaction SMS messages on your device to identify merchant names, transaction amounts, and cards used. This data is processed on-device and transmitted to our servers solely to provide card analysis and recommendations.
- Usage data — how you interact with TIP, which screens you visit, features you use, and time spent in the application.
- Device information — device type, operating system version, and app version for compatibility and troubleshooting.
2. How We Use Your Information
We use your information to:
- Provide, operate, and improve the TIP application and related services.
- Generate personalised card recommendations and benefit analysis based on your transaction history and card portfolio.
- Send you transactional communications including OTP messages and service notifications.
- Respond to your enquiries and support requests.
- Notify waitlist members when TIP becomes available.
- Analyse usage patterns to improve product quality and user experience.
- Comply with legal obligations and enforce our Terms of Service.
We do not use your information for unsolicited marketing communications without your explicit consent.
3. SMS Data — Special Notice
TIP requests permission to read SMS messages on your device to identify bank transaction messages. This permission is used exclusively to:
- Identify credit card transactions from your registered banks.
- Extract merchant name, transaction amount, and card used from transaction SMS.
- Calculate actual rewards earned versus potential rewards to power the loss dashboard.
We do not read personal SMS messages, OTP messages from other services, or any SMS unrelated to credit card transactions. SMS data is stored on our servers in encrypted form and associated with your account. You can withdraw SMS permission at any time through your device settings.
4. Information We Do Not Collect
We explicitly do not collect:
- Credit card numbers, CVV, or card PINs.
- Net banking credentials or passwords.
- Aadhaar number or PAN number (except as required for regulatory KYC compliance where applicable).
- Government-issued identity documents unless required by law.
5. Data Storage and Security
All data is stored on servers located in India in compliance with RBI data localisation requirements. We implement industry-standard security measures including:
- Encryption of data in transit using HTTPS/TLS.
- Encryption of sensitive data at rest in our database.
- Access controls ensuring only authorised personnel can access user data.
- Regular security reviews of our codebase and infrastructure.
No method of transmission or storage is 100% secure. We will notify affected users in the event of a data breach as required by applicable law.
6. Data Sharing
We do not sell your personal data to third parties. We may share your information with:
- Service providers: Third-party vendors who assist in operating TIP, including payment processors (Razorpay), OTP providers (MSG91), account aggregation services (Setu), and cloud infrastructure providers (AWS). These parties are contractually obligated to protect your data and use it only for the services they provide to us.
- Legal requirements: Where required by applicable law, court order, or government authority.
- Business transfers: In connection with a merger, acquisition, or sale of all or a portion of our business assets, with appropriate confidentiality protections.
Aggregated, anonymised data that cannot identify individual users may be used for product improvement and industry research.
7. Account Aggregator Framework
TIP uses the RBI-regulated Account Aggregator (AA) framework through licensed providers to access your bank and card data with your explicit consent. Under the AA framework:
- You control which accounts and data you share with TIP.
- You can revoke consent at any time through the AA provider's interface.
- Data is fetched only with your active, time-limited consent.
- Your banking credentials are never shared with Creafin Tech.
8. Your Rights
You have the right to:
- Access the personal data we hold about you.
- Request correction of inaccurate data.
- Request deletion of your account and associated data.
- Withdraw consent for SMS access at any time.
- Object to processing of your data for specific purposes.
- Receive a copy of your data in a portable format.
To exercise any of these rights, contact us at hello@creafin.in. We will respond within 30 days.
9. Data Retention
We retain your personal data for as long as your account is active or as needed to provide services. Transaction data used for recommendations is retained for up to 24 months. Upon account deletion, we will delete your personal data within 30 days, except where retention is required by law.
10. Children's Privacy
TIP is not intended for use by persons under the age of 18. We do not knowingly collect personal information from minors. If we become aware that a minor has provided us with personal information, we will delete it promptly.
11. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes through the application or by email. Continued use of TIP after changes constitutes acceptance of the revised Privacy Policy.
12. Grievance Officer
In accordance with the Information Technology Act 2000 and applicable rules, the name and contact details of our Grievance Officer are:
- Name: Tarun Sharma
- Designation: Founder & CEO
- Email: grievance@creafin.in
- Address: Creafin Tech Private Limited, Delhi, India
Grievances will be acknowledged within 24 hours and addressed within 30 days of receipt.
13. Contact Us
For any questions about this Privacy Policy or how we handle your data, contact us at hello@creafin.in or through our contact page.