Statutory & DPDP Compliance

Privacy Policy & Data Protection Standards

Effective Date: October 2026 • Compliant with the Digital Personal Data Protection (DPDP) Act, 2023 & RBI Guidelines.

Policy Overview

Have privacy concerns or data inquiry?

1. Information We Collect

Earning Friend collects personal and transactional data solely to authenticate your identity as a certified financial referral partner and to reconcile banking payouts:

•Partner KYC Data: Full Name, Mobile Number, Email Address, PAN Card number (mandatory for TDS compliance under Section 194H of IT Act), and Bank Account/UPI ID.
•Customer Lead Data: When you generate a lead, we temporarily capture the prospective borrower's name and mobile number to route them to the authorized banking portal.
•Device & Telemetry Data: IP address, device fingerprints, browser version, and application timestamps to safeguard against duplicate or fraudulent referrals.

2. How We Use Your Data

We process data strictly in adherence to business necessity:

Commission Settlements

Calculating, verifying, and crediting commission earnings directly to your bank account or UPI handle.

Lead Telemetry & Tracking

Updating live application statuses (KYC submitted, Approved, Sanctioned) via institutional webhooks.

Tax & TDS Filing

Generating quarterly Form 16A certificates and reporting tax deducted at source to the Income Tax Department.

Anti-Fraud Screening

Preventing click manipulation, spoofed leads, and unauthorized bot submissions.

3. Tracking Cookies & Banking Webhooks

Our system issues a 90-day cryptographically signed attribution cookie whenever a prospective applicant opens your shared link. If the applicant completes their digital KYC within this window, partner bank webhooks automatically identify and attribute the approval to your distributor ID.

We never store financial banking credentials, netbanking passwords, or sensitive payment PINs. All loan disbursements and credit card originations are processed on bank servers.

5. Data Security & Encryption Protocols

All databases are guarded behind enterprise VPC barriers with AES-256 bit data-at-rest encryption and TLS 1.3 transit encryption. Regular third-party penetration testing and vulnerability assessments ensure your partner wallet, ledger, and PAN information remain invulnerable to unauthorized access.

6. User Rights & Data Retention

In accordance with the DPDP Act 2023, you retain full rights to request an export of your account telemetry, correct inaccurate profile records, or request account closure.

*Note: Historical commission payout receipts and TDS audit records are retained for a statutory period of 7 years as mandated by the Indian Income Tax Department.