Skip to main content

Privacy Policy

What we collect, who we share it with, and the rights you have over it.

Last updated: 8 September 2026

Introduction

Dymora is a loan facilitation platform. We are not a lender or an NBFC. To match you with lenders and to produce your credit analysis we handle a significant amount of personal and financial data, and this policy sets out exactly what we do with it.

This policy is written to the Digital Personal Data Protection Act, 2023. Under that Act we are the Data Fiduciary for your personal data and you are the Data Principal. If anything here is unclear, ask us rather than guess.

What we collect, and why

  • Identity and contact details (name, phone number, email, date of birth, address, city, state, PIN code) — to identify you, contact you, and submit an application on your behalf
  • PAN — to retrieve your credit report and to submit a loan application to a lender
  • Financial details (monthly income, employment type, employer, existing loans) — to assess which lenders you are likely to qualify with
  • Your full credit report from the bureau, including accounts, balances, enquiries and score — to produce your credit analysis and lender matches
  • Vehicle details (make, model, year, registration, chassis and engine number) — to assess a loan against your car
  • Documents you or our staff upload (PAN card, address proof, vehicle papers, photographs) — to satisfy lender verification requirements
  • Payment records for the products you purchase — to fulfil the purchase and meet tax and accounting obligations
  • Technical data (IP address, browser user agent, device information) at the point you give consent or sign in — to evidence that consent and to protect accounts from misuse
  • We do not collect your Aadhaar number through this website

The legal basis for processing

  • We process your personal data on the basis of the consent you give at the point of collection, as required by the Digital Personal Data Protection Act, 2023
  • Consent is asked for separately for each purpose. Agreeing to one does not agree you to another
  • You may withdraw consent for any purpose at any time, from Settings in your Dymora profile
  • Withdrawing consent stops future processing for that purpose. It does not undo processing already carried out lawfully
  • Some data must be retained after withdrawal where the law requires it, for example transaction records kept for tax purposes

Who we share your data with

  • Lending partners (banks and NBFCs) — the application details needed to assess your loan, shared only when you ask us to submit an application
  • TransUnion CIBIL, through our bureau access provider — your name, mobile number and PAN, in order to retrieve your credit report
  • Razorpay — to take and verify payment for our paid products
  • MSG91, TextLocal and Twilio — your phone number or email address, to send one-time passcodes and service messages
  • Meta Platforms, through the WhatsApp Business Cloud API — your phone number and message content, if you opt in to WhatsApp updates
  • Anthropic — see the AI section below
  • Google Analytics — see the Cookies section below
  • Our internal operations tooling, to alert staff to new and updated cases
  • We do not sell your personal data, and we do not share it with third parties for their own marketing

Automated analysis and AI

  • Your Personalised Debt Plan is generated with the help of a large language model operated by Anthropic
  • What is sent: your credit score, total debt, EMI obligations, monthly income, debt-to-income ratio, card utilisation, account and enquiry counts, and per-account lender names, balances and rates
  • What is not sent: your name, PAN, phone number, email address or Aadhaar
  • This only happens after you have purchased the plan and given consent for AI analysis and for storage of the derived results
  • The analysis is guidance, not financial advice, and no lending decision is made automatically on the basis of it

Transfers outside India

  • Anthropic and Meta Platforms process data on infrastructure located outside India, so the categories described above are transferred abroad when those services are used
  • Transfers are limited to what each service needs to perform its function
  • We will not transfer personal data to any country that the Central Government restricts under section 16 of the DPDP Act

How long we keep it

  • Loan case records: retained for the life of the case and thereafter as required for regulatory, audit and tax purposes
  • Credit reports and derived analysis: retained while your account is active, and deleted on request unless a legal obligation requires otherwise
  • Consent records: retained for as long as the underlying processing continues, plus the period needed to evidence that consent
  • Payment records: retained for the period required by tax law
  • Marketing and lead records where no application followed: deleted on request

Your rights

  • Access — ask for a summary of the personal data we hold about you and who we have shared it with
  • Correction — have inaccurate or incomplete data corrected, and out-of-date data updated
  • Erasure — ask us to delete your personal data where no legal obligation requires us to keep it
  • Withdraw consent — as easily as you gave it, from Settings in your Dymora profile
  • Nominate — name someone to exercise these rights on your behalf if you die or become incapacitated
  • Grievance redressal — raise a complaint with our Grievance Officer, whose details are below
  • You may escalate to the Data Protection Board of India if you are not satisfied with our response

How we protect it

  • Data is transmitted over encrypted connections and stored in access-controlled databases
  • Staff access is restricted by role, and access to case records is logged
  • Uploaded documents are not publicly accessible and are served only to authorised staff through an authenticated, time-limited link
  • Your Aadhaar number, where our staff record one for a lender's verification, is stored only as an irreversible hash plus the last four digits
  • PAN and mobile numbers are masked in logs and internal alerts
  • No system is perfectly secure. If a breach affects your personal data, we will notify you and the Data Protection Board as the DPDP Act requires

Cookies and analytics

  • We use Google Analytics to understand how the site is used. It sets cookies in your browser from googletagmanager.com
  • We configure it to anonymise IP addresses and we do not enable advertising or cross-device personalisation features
  • We do not set first-party tracking cookies of our own. Your sign-in session is held in your browser's local storage, not a cookie
  • Full detail of every cookie and stored value is in our Cookie Policy

Children

  • Our services are for adults aged 18 and over, and our products are not directed at children
  • We do not knowingly collect the personal data of anyone under 18
  • If you believe a child has provided us with personal data, contact us and we will delete it

Grievance Officer

Under the DPDP Act you may raise a complaint about how we handle your personal data with our Grievance Officer, who will respond within 30 days:

Email: grievance@dymora.co.in

Phone: +91 93108 81366

Address: 4E/9, Jhandewalan Extension, New Delhi, Delhi 110055, India

General enquiries

Email: support@dymora.co.in

See also our Cookie Policy, Terms and Conditions and Refund Policy.

Policy Updates

We may update this policy. Any change is published here with a new revision date at the top. Where a change materially affects how we use data you have already given us, we will tell you directly rather than rely on you noticing this page.