Consent Policy
1. Why we collect consent
In line with RBI digital lending guidelines and the Digital Personal Data Protection Act, CarFin India (operated by Red Fort Capital Finance NBFC) collects explicit, purpose-specific, auditable consent before accessing any of your financial data.
2. Credit bureau (CIBIL) consent
With your consent we pull your credit report from credit information companies (e.g. TransUnion CIBIL) solely for evaluating your loan application. Quick-eligibility soft checks do not affect your credit score. Your bureau data is retained only as long as required for the loan lifecycle and regulatory record-keeping.
3. Account Aggregator (AA) consent
Bank-statement data is fetched only through the RBI-regulated Account Aggregator framework (Sahamati ecosystem) after you approve a consent artifact specifying purpose, data range and validity. You can revoke AA consent at any time through your Account Aggregator app.
4. KYC consent
PAN, Aadhaar (where permitted, via OTP-based verification) and CKYC data are used solely for identity verification mandated under PML rules. Aadhaar numbers are never stored in full.
5. Communication consent
By applying you consent to receiving loan-related SMS, email, WhatsApp and calls. Marketing communication is optional and can be opted out of at any time.
6. Withdrawing consent & grievances
Write to grievance@carfin.com to withdraw consent or raise a complaint. Withdrawal of mandatory consents may prevent us from processing or continuing your loan. Grievances are acknowledged within 48 hours and resolved per our Fair Practices Code.