Last Updated: July 21, 2025
This Privacy & Security Policy applies to OnEMI TECHNOLOGY SOLUTIONS LIMITED and its digital lending applications Kissht and PaywithRing. The policy governs the collection, use, transfer, disclosure, and sharing of personal data through websites, digital lending applications, mobile applications, and platforms operated by the company.
Legal Entity: OnEMI TECHNOLOGY SOLUTIONS LIMITED
Registration: Company registered under the Companies Act, 2013
Registered Office Address:
Si Creva Capital Services Private Limited - A wholly owned subsidiary of OnEMI Technology Solutions Limited, operating as a non-banking financial company (NBFC) for loan disbursement.
Digital Lending Applications:
Websites:
This data Privacy Policy sets forth the modes of collection, use, transfer, disclosure and sharing minimal amount of personal data or information gathered through any website, digital lending application, mobile application, platform or otherwise used by the company.
The policy applies to:
This Privacy Policy shall be read in conjunction with the terms of use agreed by users while registering with Si Creva for availing its services.
This document is prepared and published in compliance with:
Information Technology Act, 2000 and Information Technology (Intermediaries Guidelines and Digital Media Ethics Code) Rules, 2021 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011
Digital Lending Directions, 2025 issued by the Reserve Bank of India (RBI), dated May 08, 2025
Other applicable acts, regulations and rules which require the publishing of a privacy policy for handling of or dealing in personal information including sensitive personal data or information and all applicable laws, regulations, guidelines provided by applicable regulatory authorities including but not limited to the RBI
By continuing to use the services, users agree to this policy. If users do not agree to this policy or any part thereof, they should not use, access, download, or install the app or any part thereof.
The Policy is applicable for the collection of information for the following categories of services:
Information collected by/through the Platform by Si Creva Capital Services Private Limited (a non-banking financial company), subsidiary company of ONEMI TECHNOLOGY SOLUTIONS PRIVATE LIMITED, for disbursement of loans
Information collected by the Platform provided to the other lending partners and the business partners
Users authorize the company to collect, store, authenticate, verify and distribute Personal Information as may be required to sanction the loan or provide services on the applications or website. Personal information may be collected through application forms.
The company is committed to:
To register with the company, users must:
Use of the Service is strictly prohibited for individuals under the age of 18 (eighteen) years or minors.
For purposes of this Policy, "Personal Information" means information including Sensitive Personal Information that identifies a user, directly or indirectly, such as:
All Personally Identifiable Information and Service Information shall be collectively known as "Information."
By providing a phone number at the platform, users authorize the company and its representatives to:
By submitting Information to the platform, users expressly acknowledge and consent to use such Information and to process the same in a manner deemed fit, which may involve:
Retention of information is done as per this policy and in compliance with applicable law/regulatory requirements in India and as mandated in arrangements with business partners to provide services, unless such consent is withdrawn by the user.
"Processing" in relation to personal data or information means an automated operation or set of operations performed on personal data, and may include operations such as:
"Publicly available information" shall mean any information or data of the user which the company reasonably believes is lawfully publicly available. All other information or data which is not publicly available shall be non-publicly available information for the purpose of this Policy.
"User" shall mean such persons who are using the company's services or the company's website or the company's mobile app and to whom this Policy is applicable. The terms "you" and "customer" are used interchangeably with "User" in this Policy.
If users intend to avail a loan by using the platform from any lending partners, they would be required to provide details like:
Wherever possible, the company indicates the mandatory and optional fields. Users always have the option to not provide any information by choosing not to use a particular Service or feature on the Platform.
Users shall be provided with an option to:
Si Creva engages with various third parties, service partners, and affiliates for the purpose of collecting, storing, transferring, and processing user information as required for its business operations.
List of Third-Party Service Providers: Available at https://sicrevacapital.com/details-of-third-party-service-providers/
The company encourages users to review this list periodically to stay informed about the entities handling their information.
The data collected, as stated in this Policy, is solely restricted to the mentioned activities and will not be used for any other purpose. In case the company uses the data for any other purpose, explicit consent shall be taken.
The company collects and monitors financial/transaction SMS only, to determine the creditworthiness for the purpose of loan applications. No personal SMS data is read or stored.
The company may use information collected from users/mobile devices to:
When the company uses data to carry out data analytics, it generally pseudonymizes/anonymizes the data to uphold user privacy.
No biometric data is stored/collected in the systems, unless allowed under extant statutory guidelines.
The company's systems comply with various technology standards/requirements on cybersecurity stipulated by:
The Platform accesses the following information solely for the purpose of onboarding journey:
Access to user information is strictly restricted:
Access is used only under specific internal procedures and safeguards governing access, to operate, develop or improve the Service.
The company may use third-party service providers to help provide the Service, such as:
The company requires such third parties to maintain the confidentiality of the information provided to them.
If users telephone the company, calls may be recorded and monitored for:
The company will process personal data in compliance with applicable data privacy laws such as:
Processing is based on one or more of the following lawful grounds:
User has explicitly agreed to processing for a specific reason
The processing is necessary to perform the agreement that the lender will have with the user
The processing is necessary for compliance with legal obligations under certain laws
The processing is necessary for the purposes of a legitimate interest pursued by the company
In order to provide seamless approval and determine instant creditworthiness of customers, the company requests certain permissions with explicit consent of users to complete the signup process which shall be passed on with the lender for relevant onboarding process of the loan.
What is Collected: The platform collects, accesses, stores financial/transaction SMS to assess the income, track and analyze financial expenses and determine the creditworthiness once during the loan onboarding journey.
Purpose: This data is used for the purpose of performing credit risk assessment. The assessment is automated, and the SMS are encrypted.
Privacy Protection: The platform does not read or store any personal SMS data. It does not share SMS with any third party.
How This Data is Used:
What is Collected: The platform accesses the current location only once during the loan onboarding journey.
Purpose:
How This Data is Used:
What is Collected: The platform collects the device location of the borrower and phone number information, such as:
Collection Frequency: Only once during loan onboarding journey
Purpose: The platform assesses these to uniquely identify devices and protect users from fraud by preventing unauthorized devices from misrepresenting users or misusing their information.
How This Data is Used:
In addition to the Information made available, the company may seek explicit consent and request one-time access to:
Important Clarifications:
Withdrawing Consent: Upon granting consent for access, if at any time users wish to deny access to the above-mentioned consent in future, they may do so from the settings of their mobile device. In case users withdraw given consents, the company assures that it shall not have any access to user Information.
The company does not access mobile phone resources such as:
Biometric Data: The company does not collect biometric data.
What is Required: One time camera access
Purpose:
Access Type: A one-time access can be taken for camera, microphone, location or any other facility necessary for the purpose of on-boarding/KYC requirements only, with the explicit consent of the borrower.
How This Data is Used:
The company may collect and use technical data and related information, including but not limited to, technical information about user devices, system and application software, and peripherals, that is gathered periodically to facilitate the provision of software updates, product support and other services related to Mobile Applications.
Mobile Device Information Collected:
When users use the Mobile Application, the Mobile Application may automatically collect and store some or all of the following information from mobile devices ("Mobile Device Information"), in addition to the Device Information:
The company also collects certain other information from users on their visit to the Website such as:
This information cannot be easily used to personally identify users.
Use of Non-Personal Information:
The company uses Non-personal Information for purposes including but not limited to:
Usage Statistics:
Users agree that the company may gather usage statistics and usage data from use of the Website to:
The statistics and data collected may or may not be aggregated. These statistics contain no information that can distinctly identify users.
Third-Party Advertising:
The company may use third-party advertising companies and/or ad agencies to serve ads when users visit the platform.
The company may in future also share this information with third party service providers or third party advertisers to measure the overall effectiveness of online advertising, content, programming and for other bonafide purposes, as the company may desire.
By usage of the Website, users expressly permit Si Creva to access such information for one or more purposes deemed fit by Si Creva.
The company automatically logs generic information about device connections to the Internet, which is called "session data", that is anonymous and not linked to any personal information.
Session Data Consists Of:
What is an IP Address: An IP address is a number that lets devices attached to the Internet, such as web servers, know where to send data back to the user, such as the pages of the site the user wishes to view.
Why Session Data is Collected:
The company collects session data because it helps:
Although such information does not identify any visitor personally, it is possible to determine from an IP address a visitor's Internet Service Provider (ISP), and the approximate geographic location of his or her point of connectivity.
If enabled, the company may place cookies on user machines that store small amounts of data on computers about visits to any of the pages of this website.
What Cookies Do: Cookies can identify the pages that are being viewed, and this can assist in:
Cookie Technologies Used For:
Third-Party Cookies:
Third-party vendors, including www.google.com ("Google"), may use cookies to serve ads based on visits to this Website. Users may visit the website of the third party and choose to opt-out of the use of cookies for interest-based advertising if the third party offers such an option.
User Control Over Cookies:
The company uses cookies on the website to personalize Service to users. Users can control the use of cookies at the individual browser level.
The company may use third-party advertising companies and/or ad agencies to serve ads when users visit the website. These companies may use information (excluding name, address, e-mail address, or telephone number) about visits to websites to provide advertisements on this Site and other sites about goods and services that may be of interest to users.
Consent Requirements:
Explicit consent will be taken from users before sharing Personal Information with any third party, except for cases where such sharing is required as per statutory or regulatory requirement.
Third-Party Products and Services:
If users choose to apply for separate products or services, disclose information to the providers, or grant them permission to collect information, then the use of user information is governed by their privacy policies. Users should evaluate the practices of these external service providers before deciding to use their services. The company is not responsible for their privacy practices.
Restricting Information Sharing:
In case users wish to restrict sharing of information partially or completely with third party (other than statutory or regulatory authorities), they may reach out to:
The company works with third-party service providers to execute various functionalities of the App and may share user information with such service providers to help provide the App.
Functionalities Include:
KYC Validation:
Bank Account Validation:
E-Signing:
E-NACH Setup:
Additional Bank Information:
Collections:
Third-Party Privacy Policies:
Usage of such third-party services is subject to their privacy policies and not within the company's control. The company recommends that users have a look at their privacy policies before agreeing to use their services.
Consent for Third-Party Sharing:
Explicit consent will be taken from users before sharing personal information with any third party, except for cases where such sharing is required as per statutory or regulatory requirement.
The App has a link to a registered third party SDK which collects data on behalf of the company and data is stored to a secured server to perform a variety of services such as:
Information Shared with SDK:
The company shares limited information such as:
This information is shared with analytics and marketing service providers who may use it to serve targeted, contextual ads to users.
Security Measures:
The company ensures that third party service providers take extensive security measures in order to protect Personal Information against loss, misuse or alteration of the data.
Data Protection During Transmission:
The company follows generally accepted standards to protect the Personal Information submitted, both during transmission and once received, using secure cryptographic techniques over HTTPS APIs.
Security Measures:
The company uses a combination of:
These measures are used to maintain the security of online sessions and to protect https://paywithring.com/ https://kissht.com accounts and systems from unauthorized access.
Security Limitations:
No Internet website can fully eliminate security risks. The company implements cyber security policy for handling all security breaches in compliance with applicable laws and regulations.
Hosting Security:
The registered third party service provider provides hosting security using:
Data Usage Policy:
The company does not sell or misuse user data. The company does not share personal identifiable information and Government IDs such as PAN, Aadhaar Card, VID number with these 3rd parties. The company also doesn't allow unauthorized access to non-public personal contacts or financial transaction SMS data with any 3rd party.
The company may from time to time add or enhance products/services available on the Website. To the extent these products/services are provided to and used by users, the company will use the information provided in this regard to facilitate the products/service requested.
Example: If users email the company with a question, the company will use email address, name, nature of the question, etc. to respond to the question. The company may also store and publish such information to assist in making the Website better and easier to use.
Google API Services:
The use of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements.
To verify creditworthiness and complete the KYC formalities, the company requests users to enter few government-issued ID numbers such as:
Data Security:
This data remains completely safe and secure with the company and is never shared with any 3rd party. However, user information is passed to the authorized 3rd party APIs and government websites for users to fill up the information and help the company validate KYC credentials.
The company collects and uses the minimal financial information and other minimal personal information.
To fulfill user requests for products and services offered and subscribed and accepted by users
To deliver to users any administrative notices, alerts, advice and communications relevant to use of the Service
To share user information with group companies and other third parties in so far as required for joint marketing purposes and/or to provide users with similar value-added services
For market research, project planning, troubleshooting problems, detecting and protecting against error, fraud or other criminal activity
To third-party contractors that provide services to Si Creva and are bound by these same privacy restrictions
To enforce Terms of Use
Establish identity and verify the same with or without help of third party(ies)
To facilitate and complete onboarding and KYC requirements for third party lending partners
Monitor, improve and administer the Platform
To facilitate and provide service i.e. perform credit profiling for the purpose of facilitating loans to users
Design and offer customized products and services offered by third party financial partners
Analyze how the Platform is used, diagnose service or technical problems and maintain security
Send communication notifications, information regarding the products or services requested by users or process queries and applications that users have made on the Platform
Manage relationship with users and inform users about other products or services the company thinks users might find of some use
Conduct data analysis in order to improve the Services/Products provided to the User
Use the User information in order to comply with country laws and regulations
Collect KYC for third party lending partners based on the information shared by the User
Use the User information in other ways permitted by law to enable users to take financial services from lending partners
OnEMI stores user personal information only at servers located in India.
The company shall only retain basic personal information such as:
These are required to be stored for carrying out non-lending services.
For other personal information collected as part of outsourcing services being provided to Partners:
Retention of information is done as per this policy and in compliance with:
The company retains Information as long as the purpose of its usage exists, after which the same is archived or purged or deleted, except in case where the retention is required as per Applicable Laws.
The company informs users that it retains Information even after users withdraw consent partially or wholly, for longer period of time, when necessary or required to be retained under various Applicable Laws.
Non-Personally Identifiable Information (Non-PII) including SMS:
Other Data: All other data such as name, address, contact details, etc. permitted in pursuant to regulatory guidelines, including DLG and such other data collected for the purpose of onboarding and operational servicing:
In general terms, user Information will be kept for:
The duration of the relationship with users
The period required under Applicable Laws
As long as it is necessary for users to be able to bring a claim against the company and for the company to be able to defend itself against any legal claims. This will generally be the length of the relationship plus the length of any applicable statutory limitation period under Applicable Laws
All the data, including all the copies thereof will be destroyed post the completion of the business, legal or regulatory requirement.
Digital Data Destruction:
In case the data are stored in digital form, then secure erasure of individual folders and/or files will be done as per the Media handling and Destruction Policy of the Company.
The personal information collected by the Company shall not be disclosed to any other organization except:
Contractual Agreement:
Need-to-Know Basis:
Legal Requirements:
The user authorizes the Company to exchange, share, part with all information related to the details and transaction history of the User to:
This exchange may be required by:
Users shall hold the Company liable for use or disclosure of this information.
Consent is required before the company may collect, use or disclose personal information, except in situations permitted by the law, such as:
Users may also provide implied consent for the collection, use, and disclosure of personal information necessary for the Identified Purposes.
While the company may rely on implied consent in certain circumstances, the company will not collect, use or disclose the following without express written or verbal consent:
Users may withdraw consent, subject to legal or contractual obligations and on reasonable notice, but this may limit the company's ability to provide the requested product or service.
To Withdraw Consent:
Users should contact:
The company will provide information regarding the implications of withdrawal, and then if users choose to proceed, users should give the requisite notice.
Where permitted by law, users may be given the option to give express consent to the company to access credit information from:
Purpose of Credit Information:
The company will use this credit information for the purpose of:
The company may continue to retrieve current credit scores from time to time, while users remain customers, unless users withdraw consent for the company to do this.
The company follows generally accepted standards to protect the Personal Information submitted, both during transmission and once received. However, no Internet website can fully eliminate security risks. The company implements cyber security policy for handling all security breaches in compliance with applicable laws and regulations.
Security Measures:
The company uses a combination of:
These measures maintain the safety and security of user data.
Industry Standard Security:
The company employs industry standard security measures to protect personal information:
The company maintains user information on servers located in India.
Database Security:
In the event of an information security breach, the Company is committed to complying with the guidelines set forth by:
This adherence is in accordance with the Company's Incident Management Policy, which outlines the structured approach to be followed when handling such incidents.
Incident Response Approach:
Immediate Action:
Assessment:
Notification:
Investigation:
Recovery:
Post-Incident Analysis:
Reporting:
Policy Compliance:
The Company's Incident Management Policy is designed to be in full compliance with national laws and regulations regarding cybersecurity and data protection. This ensures not only a rapid and effective response to incidents but also maintains the Company's reputation and the trust of its customers and partners.
All communications between user computers, tablets, mobile devices and the platform that contain any Personal Information are encrypted. This enables client and server applications to communicate in a way that is designed to prevent:
Users are responsible for maintaining the security of their Login ID and Password, and may not provide these credentials to any third party.
If Credentials are Compromised:
If users believe credentials have been stolen or been made known to others, users must contact the company immediately at:
The company is not responsible if someone else accesses user accounts through Registration Information they have obtained from users or through a violation by users of this Privacy Policy or the Terms of this policy.
Account Management:
Users can review and edit Personal Information at any time by:
Account Closure:
If users choose to close accounts, personally identifiable information will not be used by the company for any further purposes, nor sold or shared with third parties, except as necessary to:
Non-Confidential Information:
All other information shall be treated as non-confidential and non-proprietary and PaywithRing/Kissht shall be under no obligation of any kind concerning such information and shall be free to:
Information Sharing with Third Parties:
The company may share collected information with only registered third parties including regulated financial partners for provision of Services on the Website/App wherever feasible.
Third-Party Sharing Scenarios:
Financial Service Providers:
Data Analysis:
Legal Obligations:
Technology Partners:
Business Transactions:
Credit Checks:
Confidentiality Agreements:
User Consent for Disclosure:
Regulatory Disclosure:
Data Usage Limitation:
The data stored on the company's server shall be utilized only for the purpose and to the extent stated in the policy. In case the company uses or discloses information for any purpose not specified above, the company will take explicit consent.
The Platform intends to protect user information and to maintain its accuracy as confirmed by users. The company implements reasonable physical, administrative and technical safeguards to help protect information from unauthorized access, use and disclosure.
Example Security Measures:
Stringent Security Measures:
The Platform has stringent security measures in place to protect the loss, misuse and alteration of information under control. The company endeavours to safeguard and ensure the security of the information provided by users.
Encryption Standards:
The company uses Secure Sockets Layers (SSL) based encryption, for the transmission of the information, which is currently the required level of encryption in India as per applicable law.
Multi-Layer Security:
The company blends security at multiple steps within products with the state of the art technology to ensure systems maintain strong security measures and the overall data and privacy security design allows the company to defend systems ranging from low hanging issues up to sophisticated attacks.
Protection Measures:
The company aims to protect from unauthorized access, alteration, disclosure or destruction of information held, including:
Encryption:
Security Features:
Physical Security:
Access Restrictions:
Compliance & Cooperation:
Policy Review:
Data Transfers:
Aadhaar Protection:
Data Location and Protection:
The company or its affiliates maintain user information on servers located in India. Data protection laws vary among countries, with some providing more protection than others.
The company also complies with certain legal frameworks relating to the transfer of data as mentioned and required under:
Complaint Resolution:
When the company receives formal written complaints, the company responds by contacting the person who made the complaint. The company works with the appropriate regulatory authorities, including local data protection authorities, to resolve any complaints regarding the transfer of data that the company cannot resolve with users directly.
Users may request to access data provided by them (or) processed by the company. This enables users to receive a copy of the personal data the company holds about them and to check that the company is lawfully processing it.
In the event that any personal data provided by users is inaccurate, incomplete or outdated then users shall have the right to provide the company with the accurate, complete and up to date data and have the company rectify such data at its end immediately.
The company urges users to ensure that they always provide accurate and correct information/data to ensure use of Services is uninterrupted.
To prevent further sharing of data, users can also uninstall the App. User devices may have controls that determine what information the company collects. For example, users can modify permissions on Android devices for access to Camera or Audio permissions.
The company may email or send push notifications to users from time to time about latest offerings and updates.
Opting Out:
Users may opt out of receiving such promotional emails from the company by:
Non-Promotional Communications:
However, even if users have opted out of receiving information from the company, the company will still send non-promotional communications, such as:
Push Notifications:
Users can opt out of receiving push notifications through device settings. Please note that opting out of receiving push notifications may impact use of the App.
Users are provided with an option to:
Impact of Consent Withdrawal:
In case of withdrawal or modification of consent or amendment of any choices in this regard, the company reserves the option not to provide the services or modify the services provided to users for which such information was sought.
Children and Minors:
The platform is not intended for use by children and minors. Parents are requested to ensure that personal information is not provided by minors.
In accordance with the relevant provisions of the Information Technology Act, 2000 and Rules and RBI Guidelines on Digital Lending dated Sep 02, 2022, made thereunder, the name and contact details of the Grievance Officer who can be contacted with respect to any complaints or concerns including those pertaining to breach of Si Creva's Privacy Policy, Terms & Conditions/Terms of Use and other policies or questions are published as under:
| Detail | Information |
|---|---|
| Name | Reefat Shaikh |
| Address | 10th Floor, Tower 4, Equinox Park, LBS Marg, Kurla West, Mumbai, Maharashtra 400070 |
| Contact Number | 08044745952 |
| [email protected] | |
| Availability | 10:30 a.m. to 6:00 p.m., Monday to Friday (except public holidays) |
For any privacy related concerns, kindly write to:
For withdrawal of consent, deletion of data or account, kindly write to:
This Privacy Statement may change or be amended over time. The recent version of this Privacy Statement is published on the Platform, as the case may be.
Staying Informed:
Please revisit this page periodically to stay aware of any changes to this Privacy Statement.
The company will notify users of any material changes to this Privacy Statement by publishing the same on the Platform, as applicable.
Users' continued use of Services confirms acceptance of this Privacy Statement, as amended. If users do not agree to the terms and conditions as contained in the Privacy Statement, as amended, users must stop using Services and notify the company.
It is very important that any Personal Information the company holds/passes on to lending partners about users is up to date and correct. Please inform the company of any changes to Personal Information.
The policy will be reviewed at yearly intervals or as and when considered necessary by the Senior Management / Board of the Company.
All extant & future master circular/directions/guidance/guidance notes issued by Regulatory Authorities and other applicable regulations from time to time would be the directing force for the Privacy Policy and will supersede the contents of this policy.
The company collects minimal personal information necessary for:
Users have the right to:
The company implements:
Explicit consent is required before sharing personal information with third parties, except where required by statutory or regulatory requirements.
Email:
Grievance Officer: