Draft for legal review
Privacy policy
This is a working draft for the demonstration website. It is not a final notice for a live lending-introduction business. Counsel should revise it against the operating model before launch.
Last updated 23 October 2026. Entity: [Operating legal entity, CIN, and registered office — to be confirmed before launch].
Who this draft covers
Zup Loans runs this website as a comparison and enquiry demo. It is not described here as a lender. A future company name, CIN, and registered office will replace the placeholders on this page.
What the enquiry form collects
Amount, purpose, tenure, employment type, income range, time in work, city, state, credit-score band, existing EMI range, name, and mobile number. Optional marketing consent is separate. The contact form also collects an email address and a message.
The forms do not ask for Aadhaar, PAN images, bank account passwords, card PINs, or one-time passwords used for banking. Do not send those in the message field.
Why it is collected
In this demo, the purpose is to validate the form, show indicative matches against published rules, and give you a reference number. The legal basis for a live service must be confirmed. For now, processing happens only after you tick the consent box, which is not pre-selected.
Who receives it
Enquiry data is written to a local file on the machine running the site. It is not sold. It is not sent to a lender, because no delivery integration is configured. A live service would name the recipient, or explain how a recipient is chosen, in the consent text before sharing.
How long it is kept
The demo store keeps up to 500 enquiries until the file is deleted. There is no automated retention schedule yet. A production system needs a documented retention period and a deletion process.
Consent and withdrawal
Processing consent and marketing consent are separate. You can withdraw by using the contact form, choosing “Withdraw consent”, and including your reference number. The demo marks the enquiry. It cannot recall data from a lender, because the enquiry was not shared. Marketing messages are not sent in this demo even if you opt in.
Security
The demo is not a production vault. Do not submit real customer data. Admin screens require a signed-in loan service account, and each dashboard only opens for the roles assigned to it. Transport security depends on how the site is hosted. Passwords and banking OTPs must never be stored.
Your requests
To ask for a copy, a correction, or deletion of a demo enquiry, use the contact form with the reference number. The request is stored with the message. It is not fulfilled by an automated privacy desk yet.