Privacy Policy

0. Scope and Who This Policy Covers

This Privacy Policy applies to visitors of the public Eassy Finexa website, including anyone who submits the Contact form, the Enquiry form, or otherwise communicates with Eassy Finexa through the website.

The public website does not offer open registration. Anyone can browse the site, use the EMI calculator, and submit the Contact or Enquiry form without an account.

A Client Portal exists, through which a customer can sign in to see their own requests and documents. It is not open registration: an account is created by Eassy Finexa for an existing customer, and sign-in is by a one-time code sent to the customer's registered email address. The Client Portal is currently switched off while it is being completed, and while it is off no customer sign-in takes place and no portal session cookie is set. Where this policy refers to "your account", it means a Client Portal account.

Internal staff accounts for the administrative Dashboard are governed separately by our Information Security Policy and are out of scope for this public-facing document.

1. Information We Collect

1.1 Information You Provide

Depending on how you interact with the website, we may collect:

• Full name
• Email address
• Mobile/phone number
• The service you are enquiring about (e.g., Personal Loan, GST Registration — see Services)
• Enquiry-specific details where relevant (e.g., loan amount, employment/business type, monthly income — see)
• The subject and content of your message
• Files, images, or documents you choose to upload through the Contact or Enquiry form (see Contact for accepted file types and limits)
• Information provided when you contact our support team by phone or email
• Information submitted through a grievance under our Grievance Redressal Policy

You should only provide information that you have the right to share, and you should never submit information that is unnecessary to your request (see Section 14, Sensitive Information).

1.1a If You Register as an Affiliate Partner

Our Affiliate Partner Programme (Section 7a) collects more than the forms above, because we verify who a partner is and pay them money. If you register as an affiliate partner we collect:

To create your account: your first and last name, email address, mobile number, date of birth, and a password. We never store your password itself — only a one-way hash of it, from which the password cannot be recovered.

To verify your identity (KYC): the type of government identity document you choose to use (Aadhaar card, driving licence, or passport), its number, and images of the document. In addition, in every case, your PAN and an image of your PAN card — commission is taxable income, and your PAN is what links what we pay you to your tax record. Your document number and your PAN are each encrypted before they are stored, and only their last four characters are ever displayed — to you or to our staff.

To pay you: your bank name, account number, IFSC code, and an image of a passbook page or a cancelled cheque confirming the account is yours. Your account number is encrypted before it is stored, and only its last four digits are ever displayed.

When you submit a lead: the name and mobile number of the customer you are introducing, their email address if you provide one, the service they need, any notes you add, and any supporting documents you attach together with the label you give each one. The customer's contact details are encrypted before they are stored.

About your account activity: the status of each lead you submit, any commission assigned to it, your payout requests, and the payment receipts we upload when we pay you.

If you are submitting a lead, you are giving us another person's personal information. You must have that person's permission to do so, and the affiliate lead form asks you to confirm it. Do not submit a lead for someone who has not agreed to it.

1.1b Consent Records

When you submit a form that asks you to confirm your age and accept our Terms of Service and Privacy Policy, we keep a record of that confirmation. Each record holds only: which consents you gave, the version of the Terms and of this Privacy Policy in force when you gave them, the date and time, your IP address and browser user-agent string, and a link to the submission or account it belongs to.

These records contain no name, email address, or message content — those stay on the record they point at. We keep them so that we can answer, later and accurately, what a person actually agreed to and when.

1.2 Automatically Collected Information

When you access the website, certain technical information is necessarily processed by our hosting and security layers in order to serve the page and to protect the site against abuse — including your IP address, browser type and version, device type, and the date and time of access.

Where you have allowed analytics (see section 12 and our Cookie Policy), we additionally record the page address, the referring website, a campaign tag if the link carried one, and coarse device, browser, and operating-system categories. Your IP address is not stored in those analytics records. Visits are grouped using a one-way salted hash of your IP address, browser, and the date, which cannot be reversed to identify you and changes daily.

This information helps us understand how the website is used and to improve its performance and security. It is not used to identify you personally.

1.3 Cookies and Similar Technologies

The website uses a small number of first-party cookies. The strictly necessary ones keep you signed in to the Dashboard or the Client Portal, protect forms against cross-site request forgery, and record your cookie choice.

A cookie banner is shown on your first visit, offering Accept all, Reject all, and per-category preferences. Nothing optional runs before you answer: the analytics beacon does not fire and the Google Maps frame on our Contact page does not load. You can change or withdraw your choice at any time using the Cookie preferences link in the footer of any page.

This site sets no advertising cookies and carries no social media pixels or tag manager. It uses two page-view counters, both of which run only if you allow the analytics category: our own first-party counter, and Vercel Web Analytics, provided by the company that hosts this site. The full inventory — every cookie, what it does, and how long it lasts — is in our Cookie Policy.

You may also control cookies through your browser settings; blocking the strictly necessary cookies will prevent signing in.

2. How We Use Your Information

We use the information described above to:

• Understand your requirement and respond to your Contact Lead or Enquiry
• Provide customer support and answer questions
• Communicate with you about your request, including by phone or email
• Assist with documentation and coordinate with the relevant lender, insurer, government authority, or qualified professional wherever applicable (see Lending Partners and Services)
• Improve the website and its performance and security
• Detect, prevent, and investigate fraud, abuse, spam, or security incidents affecting the Contact/Enquiry forms
• Comply with applicable laws and legal obligations
• Enforce our Terms of Service and other applicable policies

We do not use your personal information for purposes incompatible with those described above, unless permitted or required by applicable law.

3. How We Share Information

We do not sell your personal information.

With Lending, Insurance, and Professional Partners

Where your Contact Lead or Enquiry relates to a specific service, information you provide (and any files you upload) may be shared with the relevant bank, NBFC, insurer, government portal, tax professional, accountant, auditor, or other qualified professional named or implied by your request, strictly for the purpose of facilitating that request. See Lending Partners and Financial Disclaimer for how those third parties independently make their own decisions and are governed by their own policies.

With Service Providers

We use trusted third-party providers that help us operate the website: Vercel (hosting and infrastructure, and the Vercel Web Analytics counter described in section 12), Cloudflare R2 (storage for uploaded files), and Gmail SMTP (email delivery). These providers process information only as necessary to provide services to us.

Legal Requirements

We may disclose information when reasonably necessary to comply with applicable law, respond to valid legal requests, protect the rights or safety of Eassy Finexa, our users, or others, investigate fraud or abuse, or enforce our agreements.

Business Transfers

If Eassy Finexa is involved in a merger, acquisition, restructuring, or sale of assets, personal information may be transferred as part of that transaction, subject to applicable privacy requirements.

4. Data Security

We take reasonable technical and organizational measures to protect personal information, consistent with, including access controls, authentication for internal Dashboard access, encryption where appropriate, secure file storage for uploaded documents, monitoring and logging, and rate limiting on public forms.

No online service or method of electronic transmission can be guaranteed to be completely secure. If you believe your submission was affected by a security incident, contact us using the details in Section 17.

Specific measures that apply to the most sensitive information we hold. Affiliate partners' identity document numbers and bank account numbers, and the contact details of customers introduced through an affiliate lead, are encrypted using authenticated encryption before they are written to the database, each under a separate key derived for that field alone. Only the last four digits of a document or account number are ever displayed. Passwords and one-time codes are stored only as one-way hashes and cannot be recovered from our systems. Uploaded documents are held in access-controlled storage and are reachable only through short-lived links issued to authorised staff, whose access is recorded.

Our full approach to protecting this information — access control, encryption, application and database security, logging, and how we detect and respond to security incidents — is set out in our Information Security Policy. That policy also explains how to report a suspected security problem with this website.

5. Data Retention

We retain Contact Lead and Enquiry records (including any uploaded files) only for as long as reasonably necessary to provide assistance, maintain business records, resolve disputes, prevent abuse, and meet legal or regulatory requirements.

Our Data Retention Policy sets out, category by category, what we keep, why, and for how long — including enquiries, uploaded documents, Client Portal accounts, emails, audit logs, analytics, and cookie-consent records. It also describes how information is securely deleted, and the circumstances in which we are required to keep something even after you ask us to delete it.

Affiliate partner records are retained for as long as the partnership is active. Because commission paid to a partner is a financial record, information about approved leads, commission amounts, payout requests and payment receipts is retained after an account closes for as long as tax and accounting law requires. Identity and bank verification documents are retained while they are needed for verification and payment; where a KYC application is superseded — for example when a rejected application is corrected and resubmitted — the documents it replaced are deleted from storage at that point rather than kept alongside the new ones.

Consent records are retained for as long as the submission or account they relate to, because a record of consent is only useful while the thing it authorised still exists.

The specific periods in that policy are marked [TBD]: they are drafted proposals awaiting confirmation by the business and by legal counsel against the statutory record-keeping requirements that apply to us. Once information is no longer reasonably required, it is deleted, anonymised, or securely disposed of, subject to those obligations.

6. Your Privacy Rights

Depending on applicable law (including, where applicable, India's Digital Personal Data Protection Act, 2023), you may have rights to:

• Access the personal information we hold about you
• Request correction of inaccurate information
• Request deletion of certain information
• Object to or request restriction of certain processing
• Withdraw consent where processing is based on consent
• Lodge a complaint with an applicable data protection authority

These rights are not absolute and may be subject to legal limitations. To exercise a right, contact us using the details in Section 17. We may need to verify your identity before processing certain requests.

7. Accounts and the Client Portal

There is no open registration. You cannot create an account on this website, and you do not need one to browse it, use the EMI calculator, or submit an enquiry.

A Client Portal exists for existing customers. An account is created by Eassy Finexa — not by self-registration — and sign-in is by a one-time code sent to the customer's registered email address; there is no password to choose, reuse, or have stolen. Inside the portal a customer can see their own requests, documents, and messages, and update their own contact details. A customer can only ever see their own records.

The Client Portal is currently switched off while it is being completed. While it is off, portal sign-in is not possible, no portal session cookie is set, and links to it are not shown anywhere on this website or included in email we send. This policy already covers the portal so that it is described before it is available, not after.

Where a customer wants information corrected or deleted and the portal is unavailable, they can contact us using the details in Section 17.

7a. Affiliate Partner Accounts

Unlike the Client Portal, the Affiliate Partner Programme has open registration: anyone aged 18 or over can apply at /affiliate-register.

How an affiliate account works. You register with your name, email, mobile number and date of birth, and choose a password. We email you a six-digit code to confirm that the address is yours; the code is valid for a limited period, can be used once, and only a one-way hash of it is stored. You then complete identity and bank verification (KYC). While that is being reviewed, we prepare your Affiliate Partner Agreement — a document carrying your partner ID and the commission rates agreed for your account — which you download, sign and upload back to us. We store the signed copy you upload, in the same object storage as your identity documents and under the same access controls: it is never served directly, only through a short-lived link to a member of our team who is authorised to see it, and every such view is recorded. Your account cannot submit leads, and the partner portal will not open, until a member of our team has reviewed and approved your KYC application and accepted your signed agreement.

What we do with your KYC documents. Your identity document and bank proof are stored in our secure object storage and are never publicly reachable. They are not shown in any list or search result. A member of our team can only open one through a link that expires after a short period, and every time one of your documents is opened, we record who opened it, which document it was, and when. Access is restricted by role: some staff can see that you are an approved partner without being able to see your documents at all.

What we do with a lead you submit. We use the customer's details to contact them about the service you introduced them for, and we handle their information under this same policy. Your lead's status, and any commission assigned to it, are visible to you in your portal.

Payments. When you request a payout we use your verified bank details to make the transfer, and we upload the payment receipt to your portal. We do not process card payments and we do not store card details anywhere on this website.

Signing out and sessions. Your portal session is stored as a one-way hash, expires after a period of inactivity as well as an absolute limit, and is ended immediately if you reset your password or if we suspend your account.

Closing your account. Contact us using the details in Section 17. Some information must be retained after closure — see Section 5 and our Data Retention Policy — because commission paid to you is a financial record.

8. Age Requirement

You must be at least 18 years old to use this website's forms or to hold any account with us. This applies to the Contact form, the Enquiry form, the Affiliate Partner Programme, and every other form on this website that collects personal information.

Every such form asks you to confirm that you are 18 or over, and a submission that does not carry that confirmation is rejected — both in your browser and again on our servers, so it cannot be bypassed. Affiliate registration additionally requires a date of birth and refuses any applicant under 18.

The website is not directed at children, and we do not knowingly collect personal information from anyone under 18. If you believe someone under 18 has provided personal information to us, contact us using the details in Section 17 and we will take reasonable steps to delete it.

9. Third-Party Services and Links

Two pieces of third-party content can run in your browser on this site, and neither loads unless you have allowed its category. The Google Maps frame on our Contact page loads only if you have allowed "Maps and embedded content". Vercel Web Analytics — the page-view counter provided by our host — loads only if you have allowed "Analytics"; if you decline, its script is never requested at all. Google sets its own cookies inside that frame under its own terms. Our Cookie Policy lists this in full.

Lending partner logos on the Lending Partners page are fetched by our server and served from our own domain, so viewing that page does not contact the logo provider. Lending partner cards do not link out to partner websites.

Service providers that process information on our behalf. Beyond what runs in your browser, this website depends on a small number of providers to operate: a hosting provider that serves the site, a managed database that stores the records described in this policy, an object-storage provider that holds uploaded files, and an email provider that delivers the messages we send you — including verification codes and updates about your enquiry, leads or payouts. These providers act on our instructions and are not permitted to use your information for their own purposes.

Security alerting. Where it is configured, requests that match known automated-scanner patterns generate an internal alert to a messaging service used by our technical team. That alert contains the requested path, the browser user-agent string and the originating IP address. It is triggered by the shape of the request rather than by anything you submit, and no form content is included.

The website may contain occasional links to third-party websites, such as the button that opens Google Maps in a new tab. We are not responsible for the privacy practices of third parties. Review a third party's own privacy policy before providing personal information directly to them.

10. International Data Transfers

Where our service providers operate outside India, your information may be processed or stored in other countries. Where applicable, we take reasonable steps to ensure such transfers are handled in accordance with applicable data protection law. [TBD — confirm hosting/storage provider data-residency location(s) once finalized.]

11. Marketing Communications

Where permitted by law, we may send you service-related communications about your Contact Lead or Enquiry. We do not currently operate a general marketing/newsletter program [TBD — confirm if this changes]. Essential service, security, or transactional communications will still be sent even if you opt out of any future promotional communications.

12. Analytics

We count page views to understand which pages are useful — traffic sources, coarse device and browser categories, popular pages, and general usage patterns. Two counters do this:

• Our own first-party counter, which records what is described below and stores it in our own database.
• Vercel Web Analytics, provided by the company that hosts this site. It measures page views at the point your request is served, which catches visits our own counter cannot see — a page answered entirely from cache, or a visit that ends before our beacon runs.

There is no tag manager and no advertising or retargeting provider on this site.

Neither counter runs until you have allowed the analytics category. Our own counter additionally requires the business to have collection switched on, so both must be true before it records anything. If you decline, our beacon is not sent and the Vercel Analytics script is not loaded.

Analytics never receives personal data submitted through forms — no names, email addresses, phone numbers, message content, or file contents — and does not store your IP address. See our Cookie Policy for how visits are counted without identifying you.

13. User-Generated Content

The website does not currently offer a feature for visitors to publish public content (e.g., public comments or reviews). If this changes, this Privacy Policy will be updated accordingly before launch.

14. Sensitive Information

Please do not submit highly sensitive information through the Contact or Enquiry form beyond what is genuinely necessary for your request — for example, do not submit banking passwords, OTPs, card CVV numbers, or other authentication credentials. See Lending Partners, Customer Protection, and Financial Disclaimer, Section 14 (Fraud and Scams).

If a specific service genuinely requires sensitive documentation (e.g., identity or income documents for a loan application), we will explain the requirement and handle the documents in accordance with Section 4 (Data Security).

15. Data Breach and Security Incidents

If we become aware of a security incident involving personal information, we will assess it and take reasonable steps to contain, investigate, and remediate it. Where required by applicable law, we will notify affected individuals and/or relevant authorities within the legally required timeframe.

Our incident detection and response procedure, and the address for reporting a suspected security problem, are set out in our Information Security Policy.

16. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes to our services, technology, legal requirements, security practices, or business operations. The Last Updated date at the top of this policy indicates when it was most recently revised. Continued use of the website after an updated policy becomes effective constitutes acknowledgment of the update, to the extent permitted by applicable law.

17. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or your personal information, contact us:

Eassy Finexa Solutions (OPC) Private Limited

Email: info@eassyfinexa.com [TBD — confirm whether a dedicated privacy@eassyfinexa.com address will be created; until then, use the address above.]

Phone: +91 75429 79529

Registered Office: KHUSHAR CHOWK, NEAR HP PETROL PUMP, KUSHAR KHANPATI, MAHUA, VAISHALI, BIHAR 844122

This contact information must always match Contact exactly.

18. Governing Law and Legal Disclaimer

This Privacy Policy is intended to operate in accordance with applicable Indian law, including the Information Technology Act, 2000 and the Digital Personal Data Protection Act, 2023, where applicable to Eassy Finexa's processing activities. This statement is not a certification of compliance — qualified legal counsel should review this policy against Eassy Finexa's actual data-processing activities before publication.

This Privacy Policy is a general framework and may not address every legal requirement applicable to Eassy Finexa. Additional disclosures, consent mechanisms, or contractual terms may be required depending on Eassy Finexa's specific data-processing activities and any jurisdictions its users are located in.

© 2026 Eassy Finexa Solutions (OPC) Private Limited. All rights reserved.