Privacy Policy

1. Introduction

MaxiMoney is a brand and trading name of Value Garage Private Limited (CIN U66190DL2025PTC453505), registered office Flat No. 26, Vandana Apartment, East Delhi 110092, Delhi, India (“we”, “us”, “the company”). MaxiMoney is not a separate company. Every promise in this policy is a promise of Value Garage Private Limited.

MaxiMoney helps you see where your money leaks and what to do about it. This policy says what we collect, why, how long we keep it, who sees it, and what you can do about it. It covers everyone who uses the app, on a phone or in a browser, and everyone who visits our website.

We have written it in plain words, because a policy you cannot read protects nobody. If any part of it is unclear, write to us (section 9) and we will explain it.

2. What we collect, and from where

What	Where it comes from	Why we need it
Your mobile number	You, when you sign in	To text you a one-time code and sign you in, and to find your details and your credit report
Your name, PAN and date of birth	Found from your mobile number by an identity-check service, then shown to you to confirm or correct; or typed by you	Your name, number and PAN find your credit report. Your PAN is also used for the income-tax step below, and checks that the tax record is yours. Your date of birth shows you are 18 or over
Your gender (male or female)	You, on the details screen	To complete your details. It is kept with your profile
Your e-mail address	You, if you give one or when you link your e-mail (below); and the e-mail on your income-tax portal profile and returns. Giving it yourself is optional	So the payment page can send you a receipt; if you link your e-mail account, so that we can look in it as “Your e-mail account” below says; and, where we have it, a scrambled form of it goes to Meta to measure our ads, from what you do on Android or in a browser, never in the iPhone app (below)
Your credit report	A credit information company registered with the Reserve Bank of India, through its technology partners, on your consent	To work out where your money leaks, to show your loans and their offers, and to prepare your report. We read it when you confirm your details, and again when you pay for your full report or when our team asks for a fresh one, in each case only once the last is 30 days old and your consent is live
Your income-tax record	The income-tax portal, read on your own phone. The app signs in to the portal as you. You either type your portal password on your phone, which is held in the phone’s memory for that one login and then cleared, or ask the portal to text you a code, type it on your phone and choose a new portal password there. The password and the code go from your phone to the portal and never reach us	To work out the tax you need not pay, your income and what your tax statement shows, what you could borrow, and, for the relationship manager working with you, your monthly salary and who you work for. What reaches us is everything the portal gives your phone, as it gives it: your profile on the portal (with your address and Aadhaar number); each of your latest three returns whole, with your PAN, Aadhaar, address, bank accounts and your employers’ names and tax numbers; each return’s PDF; your Form 26AS for each year; and your tax statement for each year the portal holds, up to six. A return can also name other people, such as your spouse with their Aadhaar number, a property’s co-owners, your tenants or those you gave to, and the statement names those who reported about you; these are kept as received too. All of it is stored encrypted, as received, under our hold (section 4)
What you tell us about your loans and your home	You, in the app: what each home or property bought with a loan is worth today, and the rate and the EMI you pay when your credit report does not show them	To work out what each loan costs you, what you could save, and what you could borrow against your home
A request for your mutual fund statement	Made by us, once, when you first confirm your details. Through our own statement service, we send KFintech, a company that keeps mutual fund records, your PAN and your e-mail address. The e-mail is the one on your credit report, or else the one on your tax papers or the one you gave us. KFintech e-mails you a statement of all your mutual funds, locked with a password we make from your name. The statement goes to your inbox, not to us. We get back only whether it was sent, or that no mutual funds were found, and whether your PAN was used. We keep that answer, when it came, and the password, sealed	So that you have one statement of all your mutual funds, to look at with us for ways to save. We keep the password so the statement can be opened later, if you share it with us or link your e-mail
Your payment	Our payment gateway. We receive the order, the payment’s reference, how you paid, the amount, and whether it went through. Your card or UPI details go only to the gateway, never to us	To open the full report. It costs ₹199, once, and does not expire
Your requests to our team: a loan switch, a new loan, a consolidation, or a letter to your bank asking for a lower rate or a foreclosure statement	You, in the app. With a request you give the loan it is about, the bank offer you picked, the kind of loan you want and how much, the property’s pincode and kind, how you earn, and, if there is a co-applicant, their name and how they earn. A letter to your bank is written on your phone: its words never reach us, only that you sent that kind of letter	So a relationship manager can call you and help with the request, and so our lending partners can look at it (section 5)
Your rate-drop alerts and notify-me	You, with one tap	To tell you the day a bank goes lower, or the day a new part of the app is live
The documents you upload for a loan request	You, in the app, when you add them to a request: your Aadhaar card, PAN card, bank statements, salary slips, Form 16, tax returns and property papers, and the same papers of a co-applicant. We keep each file as you upload it. Your Aadhaar number is kept in full and is never hidden, on the card and wherever else it appears. If you upload a co-applicant’s papers, you confirm that the co-applicant has agreed	So that our team, and the bank for that loan, have the papers the application needs, and you do not have to send them again. They are asked for under their own consent (section 3), and the files are stored in India (section 6)
Your e-mail account, if you link it	You, only if you choose to link it. You give read-only permission on Google’s own screen, through our e-mail service. You can end it at any time in your Google account, by closing your account in the app (Profile, then Close my account), which ends every consent, or by writing to us (section 9). The service looks for e-mails that have financial documents attached. We keep only a list of the e-mails it finds: for each, the date, who sent it, the subject line, and each attachment’s name, type and size. We never keep the text of an e-mail. We fetch a document from that list only when it is needed, and keep it with your other papers. We cannot send, change or delete anything in your mailbox. The list, the documents fetched and your choice to link are held under our hold (section 4)	To find ways for you to save money, to help with your loan applications, and to help you deal with your lenders and the other companies involved, so you do not have to send us papers yourself. Where linking is not offered yet, the app does not show it, and nothing is read
Your phone and connection	Your phone and our servers: the kind of phone, the app version, and the internet (IP) address you connect from	To keep your account safe, to limit repeated attempts, and to record your consents and what is done with your data

Answers you gave before 6 October 2026, about your savings, deposits, gold, property and card habits, are held as they were (section 4).

Measuring our ads. We advertise MaxiMoney on Facebook and Instagram, which belong to Meta. To learn which of those ads bring people to us, and to improve our advertising, we tell Meta about some of the steps you take in the app on Android and in a browser. We do not do this in the iPhone app. We show no ads in the app.

• What Meta receives: that the app was opened; that you signed up, confirmed your details, started a payment or paid, with the amount; and a few other steps, such as linking your tax record or seeing the price. With them go your internet address and details of your phone or browser, such as its model and system.
• Who sends it: Meta’s software kit in the Android app, and the Meta Pixel when you use the app in a browser, send it from your phone or browser. Our server also sends these steps to Meta, all but the app being opened. With them it sends a scrambled form of your mobile number, and of your e-mail address if we have it. Meta compares these with the scrambled details of its own users, so it can tell which ad brought you.
• Never sent to Meta: anything about your credit report, tax records, loans or income.
• On an iPhone, nothing goes to Meta. The iPhone app has no Meta kit, never asks to track you, and never reads your phone’s advertising identifier. Our server sends Meta nothing about what you do in the iPhone app, and not your number or e-mail. When we cannot tell where a step came from, and you have used the app on an iPhone, we send nothing.
• On Android, Meta’s kit starts when the app opens, and your phone’s advertising ID goes with what it sends. On Android and in a browser there is no separate box: our server sends the scrambled number and e-mail with everyone’s steps. If you use the app on an iPhone and also on Android or in a browser, what you do there is measured as it is for anyone.
• How to say no. On Android, delete or reset your advertising ID in your phone’s settings (usually under Google or Privacy, then Ads). In a browser, block or clear Meta’s cookies. If you ask us to erase your data (section 7), we send Meta nothing more about you. On an iPhone there is nothing to turn off.
• Meta uses what it receives under its own terms and privacy policy. Apart from Meta’s kit on Android and the Pixel in a browser, the app has no advertising tracker, and we run no analytics of our own.

We do not collect your contacts or location. We do not read your text messages: on Android, your phone’s own prompt may offer you the sign-in code from the one text we send, and the income-tax portal’s code, which goes only to the portal. If you allow it, the app uses only those codes.

Kept only on your phone, never sent to us: your income-tax portal password and the portal’s code, which are never stored anywhere; and a letter to your bank, while you check it and before you send it.

3. Your consent

When you sign in, one tick agrees to five statements, each of which you can read in full first: the Terms of Service, this policy, looking up your details from your number, obtaining your credit report, and reading your income-tax record. A sixth, help from our team, is asked on its own the first time you start a switch, a new loan, a consolidation or a letter to your bank. A seventh, the documents you upload, is asked on its own once, before your first upload, and nothing is uploaded until you give it. A rate-drop alert and a notify-me need no consent.

• Each source of data is used only under the consent you gave for it.
• The credit report and income-tax consents also allow MaxiMoney’s team to see that information in full, to explain it, to discuss suitable options with you and to help you with a loan (who in the team, and what each can open, is in section 5). They also allow us to use it, with what you have told us, to see whether our other advisory services suit you and to contact you about them.
• The documents consent allows MaxiMoney’s team to see what you upload in full, to help you with that loan, and allows us to share those papers with the bank for that loan.
• A consent lasts 180 days. One that has run out, or whose words we have replaced with a newer version, is renewed by the tick the next time you sign in. One you withdrew is asked for again, on its own, only when a step needs it. Paying for the full report also renews your consent to read your credit report, for 180 days from the day you pay, as the line above the pay button says. A payment that does not go through renews nothing. You only ever agree to the current words of each consent.
• Closing your account: in the app, Profile, then Close my account. Once you type your full name and tick the box, it ends every consent you gave us together (looking up your details, your credit report, your income-tax record, help from our team, the documents you upload, linking your e-mail, and measuring our ads), signs you out, and we read and send nothing new under them. Your agreement to the Terms and this policy stays as the record of your account. Nothing is erased. What we hold stays as it is, and is never refreshed. Our relationship managers can open your credit report and tax record for 180 days from the day you close, and your requests no longer once you close. The documents you uploaded are open to them for those same 180 days. Section 4 says more. No screen in the app ends one consent on its own: to end your consents, close your account in the app, which ends every consent, or write to us (section 9).
• Proof of your consent: we keep the exact words you agreed to, as a fingerprint of the text, which version they were, when you agreed, the phone and internet address it came from, and when and why each consent ended. We keep this record after you close your account and after an erasure, as proof of what you agreed to.

4. How long we keep things

Our hold. We do not delete, clear or hide what we have fetched about you until you ask us to erase it. So closing your account erases nothing. After you close it we read nothing new and refresh nothing. Our relationship managers can open your credit report and tax record for 180 days from the day you close, and your requests no longer once you close. The documents you uploaded are open to them for those same 180 days. After the 180 days our customer team keeps the summary in section 5. It all stays held until you ask us to erase it (section 7).

The times below are the longest we keep each thing once the hold ends.

What	How long, once the hold ends
Your credit report, as received, and the figures read from it	180 days from your consent, or until you withdraw it or your account is erased, whichever comes first
Your income-tax record, as received, and the figures read from it	Until your account is erased, 30 days after you ask (section 7)
Your reports and scores	Until your account is erased, 30 days after you ask
Your name, PAN, date of birth, gender, e-mail and mobile number, the details found from your number, and what you have told us	Until your account is erased, 30 days after you ask. What you tell us about your loans and your home is replaced each time you save those answers
The documents you uploaded, each file as you uploaded it	Until your account is erased, 30 days after you ask. They are not deleted when the loan is done, or when you end the documents consent
The list of e-mails found when you link your e-mail (never their text), and the documents fetched from it	Until your account is erased, 30 days after you ask. Ending the link stops any new reading. It does not delete what we already hold
The request for your mutual fund statement: whether it was sent, the answer, when, and the statement’s password, sealed	Until your account is erased, 30 days after you ask. We make the request only once
Your requests to our team, and what you gave with each	Until your account is erased, and never longer than 180 days after the request
Your rate-drop alerts and notify-me	Never longer than 180 days after you set them, or until your account is erased if sooner
The phones you signed in from, and your sign-in sessions	Until your account is erased; a session, 30 days after it ends
Sign-in codes, and counts of sign-in attempts	A code, one day after it expires; the counts, two days
Our customer team’s notes about you, and the updates we send it	Until your account is erased. Those that carry figures from your credit report or tax record go after 180 days at most
Payment records	Eight years after the end of the financial year in which you paid or tried to pay, which the law requires. Then we delete them. When your account is erased, your name and number come off them
A note that a credit report or tax record was once obtained for you: its date and reference, none of its content	Kept after your account is erased, as proof of what was done
Proof of your consents	Kept after your account is erased, as proof of what you agreed to
The record of what was done with your data, with internet addresses; it never holds your figures	At least two years. It is your protection: it cannot be changed or deleted
Backups	Seven days. Something we delete leaves the backups within seven days
Your income-tax portal password and code	Never held by us

5. Who sees your data

• You, in the app.
• The MaxiMoney relationship manager working with you, and the managers who oversee them. Our administrators can open any customer’s file, and every opening is recorded. Under your credit report and income-tax consents they can open your name and number, your PAN, the figures from your credit report and tax record, and your credit report and tax record as received. The credit report as received includes your loan and card account numbers. The tax papers include your Aadhaar number in full, your address, e-mail and mobile number, the bank accounts your refunds go to, your employers’ names and tax numbers, and each return’s PDF. Under help from our team they can open your requests with everything you gave in them, a co-applicant’s name and how they earn included. Under the documents consent they can open every file you uploaded, as you uploaded it, with your Aadhaar number in full. If you link your e-mail, they can see the list of e-mails found (never their text) and open the documents fetched from it. It is to explain your report, to discuss options with you and to help with a loan. Every time one opens your file, and every time one is refused, it is recorded.
• Our customer team, which assigns relationship managers and keeps its own notes of your conversations with them. For every customer it sees a summary: your name, your number with most digits hidden, where you are in the app, your consents and payments, whether your credit report and tax record were found, your score and your yearly leak, your credit score, the income on your latest tax return, the state you live in, what of your loans and cards could move to a cheaper rate, and the figures we use to see whether our other advisory services suit you. When you make a request, it also sees the request and the loan it is about. After the 180 days above it keeps the summary, without your credit score, the income and state from your tax return, or what could move to a cheaper rate.
• Our staff who run the service, only what their job needs, under our Information Security Policy.
• Our lending partners. MaxiMoney does not lend. When you start a switch, a new loan request or a consolidation, your request goes to our lending partners — banks and non-banking financial companies regulated by the Reserve Bank of India — directly or through the loan-distribution companies we work with. It may not go to the bank whose rate you saw on screen. The bank rates in the app are published market rates, shown so that you can compare them with what you pay now; they are not offers from those banks. Only after you start the request, the lending partner, and any distribution company that passes the request on, gets the details of the request and your name and number, so that it can look at the request and call you. It also gets the documents you uploaded for that loan, which can include your tax returns and your bank statements. We do not share the credit report or the tax record we obtained for you. Each lender then has its own privacy policy for what it does with everything it receives.
• The service providers that process data for us, each only what its job needs: hosting and file storage, both in India; the service that texts you your sign-in code; the payment gateway; the credit information company and its technology partners; the identity-check service; a security service that checks traffic to our servers for attacks; and, when e-mail linking is available, the service that provides it, which is another brand of Value Garage Private Limited. Each is bound by a written agreement to keep your data confidential, to protect it, not to pass it on further, and to return or delete it when we stop working together. The current list of these companies is available on request (section 9).
• KFintech, a company that keeps mutual fund records: your PAN, your e-mail address and the password for your statement, once, when you first confirm your details, sent through our own statement service. It uses them to e-mail you a statement of all your mutual funds, locked with that password.
• Meta, which runs Facebook and Instagram: what “Measuring our ads” in section 2 says, to measure and improve our ads there. It gets it from Meta’s kit in the Android app, the Meta Pixel in a browser, and our server, for the steps you take on Android or in a browser. The scrambled number and e-mail go from our server. Nothing from the iPhone app. Never anything about your credit report, tax records, loans or income. Meta is not one of our service providers: it uses what it receives under its own terms and privacy policy.
• Courts, regulators and lawful authorities, what the law requires us to give them.

We do not sell your data, to a bank, a data broker, an advertiser or anyone else. We do not report anything about you to any credit agency. We receive credit information; we never supply it.

6. Where your data is kept

Your data is stored and processed in India. Our database and servers are in Bengaluru. The files you upload, and the credit reports and tax records as we receive them, are stored in Mumbai. This is true of our live systems, our backups and our logs alike: we keep no server, database, copy, backup or log store outside India, and we do not send your data out of India. The one exception is what goes to Meta to measure our ads (section 2). Meta handles it on its own systems, which may be outside India.

Your data is encrypted on its way between your phone and us. Your PAN, your date of birth, your credit report, your tax record and your report are also encrypted one by one in our database, and the whole database is encrypted on disk.

7. Your rights

Using any of these is free, and we will not treat you differently for using one.

• See what we hold. At any time, in the app: Profile, then What we hold. It lists your details and your consents, when your credit report and tax record were read, how many answers you gave, your payment records, whether your full report is open, and when you last made a request. For each, it says how long we keep it. For anything the screen does not show, write to us (section 9), and we send it within 30 days.
• Correct it. Your name, date of birth, gender, e-mail, or what you have told us about a loan or your home: write to us. Your PAN is fixed once saved; if it is not yours, write to us. A mistake on your credit report is corrected by the credit information company; write to us and we will tell you how to ask.
• End your consents. Close your account in the app (Profile, then Close my account), which ends every consent (section 3), or write to us (section 9). Closing erases nothing.
• Have your data erased. Write to support@maximoney.in and give the mobile number you signed in with. We text a code to that number to check it is you. Once you send it back, your account is closed at once: you are signed out on every phone, that number cannot sign in, and we do nothing more with your data. 30 days later, everything we hold is erased, except what section 4 says we keep after erasure. After that you can sign up again with the same number, as a new customer. Our full deletion page is at maximoney.in/data-deletion.
• Name someone to act for you. Write to us to name a person who can use these rights for you if you die or cannot act yourself.
• Complain. To our grievance officer (section 9) and, if it is not resolved, to the Data Protection Board of India under the Digital Personal Data Protection Act 2023.

8. Children

MaxiMoney is only for people aged 18 and over. We check your age from the date of birth you confirm and from the one found from your number. If either says you are under 18, we refuse you: we read no credit report and no tax record, and nothing further is done with your details. Under our hold (section 4), what has already reached us is held, not deleted: your mobile number, the record of the consents you gave, a note that we refused, and the name, PAN and date of birth found from your number. The date of birth also lets us keep saying no until you turn 18. Write to us (section 9) to have all of it erased, and we erase it.

9. Contact, and grievance redressal

If you have a question, a concern or a complaint about your data or about this policy, write to us. We reply within 2 working days and settle a complaint within 30 days. One address answers everything: your rights, a complaint, and a request to erase your data.

Grievance Redressal Officer	Mr Suraj Agarwalla, Director
Data Protection Officer	Mr Mayank Garg
Write to either at	grievance@maximoney.in
Phone	+91 99584 21835, Monday to Saturday, 10 a.m. to 7 p.m.
Post	The Grievance Redressal Officer, Value Garage Private Limited, Flat No. 26, Vandana Apartment, East Delhi 110092, Delhi, India
In the app	Profile, then Help & grievance, which opens the e-mail for you

10. Changes to this policy

Each new version of this policy, and of our Terms of Service, is published at this address with its date. When a change affects how we use your data, the next time you open the app it asks you to agree to the new version before anything else: it says which of them changed, links the new version, and you tick and agree. Until you agree, you can only sign out. The record says which version you agreed to and when. We do not treat your carrying on using the app as your agreement.

11. What we are, and what we are not

So that there is no doubt about who you are dealing with:

• We are not a bank, not a non-banking financial company, and not regulated by the Reserve Bank of India. We are not a lender, and we do not lend money.
• We do not decide whether you get a loan, on what terms or at what rate. Where you go ahead with a loan, the bank decides, and the loan is between you and that bank.
• We help you understand your own borrowing and, if you ask, we pass your request to the bank you choose.
• We do not report anything about you to any credit agency. We receive credit information; we never supply it.
• We are not a SEBI-registered investment adviser, and we do not give investment, tax or insurance advice.

12. How we protect your data

• Your data is encrypted on its way to us and where it is stored. Your PAN, your date of birth, your credit report, your tax record and your report are each encrypted one by one in our database as well.
• Only those of our people whose job needs it can open your data. Every opening is recorded, and the record cannot be changed or deleted.
• Everyone who works for us is bound to keep your data confidential, and stays bound after they leave.
• Our systems sit behind a firewall, administrative access is restricted, and staff sign in with more than a password.
• We test for weaknesses before each release.
• If a security incident touches your data, we tell the authorities as the law requires, and we tell you where it affects you.

No system anywhere can be promised to be perfectly safe. What we promise is to use proper safeguards, to keep reviewing them, and to be straight with you if something goes wrong.

13. Our website, and cookies

This section is about our website, not the app.

Our website uses cookies to keep you signed in, to remember what you chose, and to see how the site is used so that we can improve it. You can control cookies in your browser. If you turn them off, parts of the site may not work as they should. If you fill in a form on our website, we use what you give us to answer you, and this policy covers it.

The Meta Pixel on our website sets a cookie of Meta’s to measure our ads, as section 2 describes. The app also runs in a browser, and it works the same way there as on a phone.

14. The law, and the courts

This policy is governed by the laws of India. The courts at New Delhi have exclusive power to decide any dispute under it. Before going to court, please raise the matter with our grievance officer (section 9) and give us a fair chance to settle it.

Board approval and adoption

This Privacy Policy was placed before the Board of Directors of Value Garage Private Limited and was considered, approved and adopted by the Board.

Document reference	VG/POL/PRIV/2026-27/02
Version	1.3
Policy owner	Data Protection Officer, Mr Mayank Garg
Approving authority	Board of Directors
Board approval	23 October 2026
Effective date	23 October 2026
Review cycle	Annual, and whenever the data we collect changes or what we use it for changes
For and on behalf of the Board	Mr Nevaid Aggarwal, Director, DIN 07621702
Place	New Delhi