For the Saralya mobile application and Saralya AI on saralya.in · Last updated September 2026
Saralya is not a lender. Saralya Tech Solutions Private Limited builds and operates this app. Loans are offered, sanctioned and disbursed by the RBI-regulated entity whose name and registration number are shown to you inside the app before you accept any offer. That entity, not Saralya, decides your application and holds your loan. Saralya AI gives general information only; it does not lend or arrange loans.
This policy describes what the Saralya app collects, why, and what you can do about it. It is written against what the app actually does — where a capability is declared but unused, it is not listed here.
Sections 1 to 8 cover the mobile app. Section 9 covers Saralya AI, the free lending assistant on saralya.in. Sections 10 and 11 apply to both. Section 12 covers the enquiry forms on saralya.in, and section 13 what the website keeps in your browser.
Your Aadhaar number is hashed with SHA-256 on your device before it is transmitted. Only the last four digits are retained, so you can recognise which document you submitted.
The app can check whether specific applications from a fixed, published list are present on your device, and reports counts by category only — never the name of any individual app. The list is compiled into the app and is the hard limit on what can ever be detected; it cannot be extended remotely. It is used as one input to a credit assessment.
This is tied to the “App data” consent. It is off until you turn it on, and turning it off stops it.
The app does not hold the Android background-location permission, and declares no background location mode on iOS — so your device does not give it your location once you leave the app. Tracking stops when you sign out.
The camera is opened without audio. The app does not record sound, and requests no microphone permission on either platform.
Carrier name, network type and the number of active SIM cards. Tied to the “SIM data” consent and off by default.
We do not use your data for advertising, and we do not sell it. The app contains no advertising software and collects no advertising identifier.
Every optional data category is off by default. Nothing is pre-ticked and nothing is bundled — you grant each category separately on the permissions screen, and can review or withdraw any of them later from Data Permissions in the app.
Withdrawing consent stops further collection in that category. It does not retroactively delete data already used to reach a lending decision, which the lender is required to retain.
Declining a category does not stop the app working; it means your application is assessed without that signal.
On your device: the app stores your session and your in-progress application locally, so losing signal does not cost you the form you have just filled. This local store relies on the operating system's app sandbox and is not separately encrypted. It is excluded from Android cloud backups, and sessions expire after 30 days. Keep your device locked, and avoid rooting or jailbreaking it.
Retention follows the lender's regulatory obligations — for loan records, a minimum of five years under RBI rules.
Under the Digital Personal Data Protection Act, 2023, you may:
| Permission | Purpose | When requested |
|---|---|---|
| Camera | Capture PAN, Aadhaar and selfie | At the document scan step |
| Location (while in use) | Address verification and fraud checks | At the KYC address step |
| Phone state | SIM and carrier verification | Only if you grant “SIM data” |
| Photos / storage | Attach documents you choose | When you attach a file |
| Notifications | Application status updates | On first launch |
All permissions are requested at the point they are needed. Declining any of them leaves the app usable, with that step handled another way. The app requests no access to your contacts, call logs, SMS messages, calendar or microphone.
The app is for applicants aged 18 and over. We do not knowingly collect data from children.
Saralya AI is a free assistant on saralya.in that answers questions about loans, credit and lending. This section covers what it collects and what you can do about it. Its terms of use are at saralya.in/ai-terms.
A loan tape you open in the portfolio tool is processed in your browser. Loan-level rows are not sent to Saralya. When you ask for AI commentary, only aggregate figures are sent. If you tick “keep the file in my Saralya workspace”, the file is uploaded and stored with your account, in India, so you can open it again on any device you sign in on, until you delete it.
You can verify an email address at your employer's domain, with a one-time code sent to it (signing in with such an address verifies it too). We keep the address and the domain, and use them to confirm where you work, to give you the professional allowance and your Saralya LMS workspace, and to set up an LMS sandbox if you ask for one. Saralya's team contacts you about the LMS only if you asked for a sandbox or agreed to hear from us (see “Marketing” below). Deleting your account erases it.
If you buy a token pack, the payment is handled by Razorpay. Your card, UPI or bank details go to Razorpay, not to Saralya, and Saralya does not store them. Saralya keeps a record of each order — the pack, the amount, when it was paid, and Razorpay's order and payment references — to add the tokens to your account, for our accounts and taxes, and to handle refunds. Razorpay's own privacy policy covers what it does with your payment details.
Answers are generated by an AI model and can be wrong. They are general information — not a loan offer, and not financial, legal or investment advice. Saralya is a technology provider, not a lender. Check anything that matters with your lender or a qualified professional.
Answers are generated by a third-party AI model provider under contract with Saralya. It processes your messages, and any file you attach, only on Saralya's instructions and only to produce answers. That processing may take place outside India. Your conversations themselves are stored in India.
Personal identifiers such as Aadhaar, PAN, card and account numbers and passwords are removed from messages automatically where we detect them. Detection is not perfect, so please don't share them — Saralya AI does not need them.
Your conversations, files and account details are stored on servers in India. Messages are processed by the AI model provider to write answers, as described above.
We send you news or offers only with your separate, optional consent — an unticked box when you create your account. You can withdraw it at any time from your account page, and doing so changes nothing else about your account.
Under the Digital Personal Data Protection Act, 2023, you can do the following from your account page at saralya.in/saralya-ai#/account:
You can also exercise any of these rights, nominate someone to act for you, or raise a grievance by writing to the contact below.
Saralya AI is for people aged 18 and over. We do not knowingly collect data from children.
If we do not resolve your grievance, you can escalate it to the Data Protection Board of India.
For privacy queries, to exercise any right above, or to raise a grievance:
Grievances about your loan — interest, repayment or recovery — go to the lender's grievance officer, whose details appear on your Key Fact Statement, and may be escalated to the RBI Ombudsman at cms.rbi.org.in.
We may update this policy. Material changes will be communicated in the app or in Saralya AI, as they apply, and published here, with the “Last updated” date above revised.
When you ask for a diagnostic or a demo on saralya.in, we collect what you type into the form — your name, work email, organisation, role, and any message or preferred time — together with the time of the request and the IP address it came from.
saralya.in uses no analytics, advertising or tracking cookies. It stores these in your browser, only for the features you use, and clearing this site's data in your browser removes them: