For the Saralya mobile application · Last updated September 2026
Saralya is not a lender. Saralya Tech Solutions Private Limited builds and operates this app. Loans are offered, sanctioned and disbursed by the RBI-regulated entity whose name and registration number are shown to you inside the app before you accept any offer. That entity, not Saralya, decides your application and holds your loan.
This policy describes what the Saralya app collects, why, and what you can do about it. It is written against what the app actually does — where a capability is declared but unused, it is not listed here.
Your Aadhaar number is hashed with SHA-256 on your device before it is transmitted. Only the last four digits are retained, so you can recognise which document you submitted.
The app can check whether specific applications from a fixed, published list are present on your device, and reports counts by category only — never the name of any individual app. The list is compiled into the app and is the hard limit on what can ever be detected; it cannot be extended remotely. It is used as one input to a credit assessment.
This is tied to the “App data” consent. It is off until you turn it on, and turning it off stops it.
The app does not hold the Android background-location permission, and declares no background location mode on iOS — so your device does not give it your location once you leave the app. Tracking stops when you sign out.
The camera is opened without audio. The app does not record sound, and requests no microphone permission on either platform.
Carrier name, network type and the number of active SIM cards. Tied to the “SIM data” consent and off by default.
We do not use your data for advertising, and we do not sell it. The app contains no advertising software and collects no advertising identifier.
Every optional data category is off by default. Nothing is pre-ticked and nothing is bundled — you grant each category separately on the permissions screen, and can review or withdraw any of them later from Data Permissions in the app.
Withdrawing consent stops further collection in that category. It does not retroactively delete data already used to reach a lending decision, which the lender is required to retain.
Declining a category does not stop the app working; it means your application is assessed without that signal.
On your device: the app stores your session and your in-progress application locally, so losing signal does not cost you the form you have just filled. This local store relies on the operating system's app sandbox and is not separately encrypted. It is excluded from Android cloud backups, and sessions expire after 30 days. Keep your device locked, and avoid rooting or jailbreaking it.
Retention follows the lender's regulatory obligations — for loan records, a minimum of five years under RBI rules.
Under the Digital Personal Data Protection Act, 2023, you may:
| Permission | Purpose | When requested |
|---|---|---|
| Camera | Capture PAN, Aadhaar and selfie | At the document scan step |
| Location (while in use) | Address verification and fraud checks | At the KYC address step |
| Phone state | SIM and carrier verification | Only if you grant “SIM data” |
| Photos / storage | Attach documents you choose | When you attach a file |
| Notifications | Application status updates | On first launch |
All permissions are requested at the point they are needed. Declining any of them leaves the app usable, with that step handled another way. The app requests no access to your contacts, call logs, SMS messages, calendar or microphone.
The app is for applicants aged 18 and over. We do not knowingly collect data from children.
For privacy queries, to exercise any right above, or to raise a grievance:
Grievances about your loan — interest, repayment or recovery — go to the lender's grievance officer, whose details appear on your Key Fact Statement, and may be escalated to the RBI Ombudsman at cms.rbi.org.in.
We may update this policy. Material changes will be communicated in the app and published here, with the “Last updated” date above revised.