Effective Date: 1st April 2026

1. Introduction

At Arthashastra Fintech Private Limited (doing business as “ePayLater”, “we”, “our” or “us”), we are committed to protecting your privacy and ensuring that your Personal Information is handled responsibly, securely and transparently.

This Privacy Policy is an electronic record in the form of an electronic contract formed under the Information Technology Act, 2000 and the rules made thereunder. This Privacy Policy does not require any physical, electronic or digital signature.

This Privacy Policy explains how we collect, use, process, store, share and protect your Personal Information when you access or use our website, mobile application and related products or services (collectively referred to as the “Platform”). This Policy has been prepared in accordance with applicable laws of India, including the guidelines issued by the Reserve Bank of India (“RBI”) governing digital lending, the Digital Personal Data Protection Act, 2023 (“DPDP Act”), and other applicable laws and regulations.

By accessing or using the Platform or by providing your Personal Information, you acknowledge that you have read and understood this Privacy Policy and consent to the processing of your information in the manner described herein, wherever such consent is required under applicable law. If you do not agree with this Privacy Policy, you should discontinue using the Platform. This Privacy Policy should be read together with our Terms & Conditions, customer consent declarations, Key Fact Statement (where applicable), loan documentation and any other notices presented to you during your onboarding or lending journey.

2. Who We Are

ePayLater is a technology platform that facilitates digital lending services on behalf of one or more banks and Non-Banking Financial Companies (“NBFCs”) regulated by the Reserve Bank of India (collectively referred to as “Regulated Entities” or “REs”). Unless expressly stated otherwise, ePayLater is not the lender. The lending relationship is established directly between you and the applicable Regulated Entity.

As a Lending Service Provider (“LSP”), ePayLater provides technology-enabled services that may include:

• Customer onboarding.
• Collection of information and documents voluntarily submitted by you.
• Facilitation of identity verification and Know Your Customer (KYC) processes through authorised service providers.
• Facilitation of credit bureau enquiries and other customer-authorised verification processes.
• Secure transmission of information to the applicable Regulated Entity.
• Technology support during loan origination and servicing.
• Customer support and grievance facilitation.

The applicable Regulated Entity independently evaluates your application and remains solely responsible for lending decisions, including approval, rejection, sanction amount, pricing, tenure, disbursement, repayment terms and compliance with lending regulations.

3. Our Privacy Commitment

Protecting your privacy is one of our core responsibilities. Accordingly, ePayLater is committed to:

• Collecting only the Personal Information necessary to provide our services.
• Requesting access to device features only when required for a specific purpose.
• Clearly informing you why your information is being collected.
• Processing Personal Information only for legitimate business, operational and regulatory purposes.
• Storing and processing Personal Information on servers located within India.
• Never accessing your contacts, personal SMS messages or call logs for lending or credit assessment purposes.
• Protecting your Personal Information through appropriate technical and organisational safeguards.
• Respecting your privacy rights and providing appropriate mechanisms to exercise those rights.

4. Information We Collect

The information we collect depends upon the services you use, the product you apply for and the stage of your customer journey.

Information You Provide
When you register, apply for a product or use our services, you may voluntarily provide information including:

• Name, Mobile number, Email address, and Date of birth.
• Residential or business address.
• PAN and Officially Valid Documents (including Aadhaar where permitted under applicable law).
• Business information, Employment or occupation details.
• Income, financial information, and Bank account details.
• GST information, where applicable.
• Photographs, live images or documents submitted for identity verification.

Information Received from Authorised Sources
With your consent or where otherwise permitted by law, we may receive information from authorised service providers supporting identity verification, lending operations, payments, customer communications and technology infrastructure.

Technical Information
To maintain the security and reliability of the Platform, we may automatically collect limited technical information such as:

• Device type, Operating system, and Application version.
• IP address, Device identifiers, and Network information.
• Browser information and Session information.
• Diagnostic and crash reports, and Security-related logs.

Information We Do Not Collect
In accordance with applicable regulatory guidelines, ePayLater does not access or collect:

• Your contact list.
• Your personal SMS messages or SMS logs.
• Your call logs.
• Continuous background location information.
• Files, photographs or documents other than those you voluntarily choose to upload through the Platform.

We collect only the information reasonably necessary to provide our services, facilitate lending operations and comply with applicable legal and regulatory requirements.

5. Device Permissions

To provide certain features and services, ePayLater may request access to specific device capabilities. Permissions are requested only when required, only for the purpose communicated to you, and only at the relevant stage of your journey. We do not request blanket or continuous access to your device.

Your Choice
Before requesting any permission, the Platform explains why the permission is required. You may choose whether to grant or deny a permission. However, certain permissions may be necessary to complete identity verification, comply with regulatory requirements or enable specific services. If such permissions are denied, some features may not function as intended. Information collected through device permissions is used only for the specific purpose for which the permission was requested.

6. How We Use Your Personal Information

We use your Personal Information only for legitimate business, operational and regulatory purposes connected with the services requested by you. Specifically, we may use your information to:

Customer Onboarding & Lending Services

• Create and manage your customer profile and verify your identity.
• Complete KYC, onboarding requirements, and validate information provided by you.
• Facilitate submission of your application to the applicable Regulated Entity.
• Support credit assessment through authorised verification processes.
• Facilitate communication between you and the applicable Regulated Entity.
• Support loan origination, servicing and repayment-related operations.

The final decision regarding loan approval, rejection, pricing, sanction amount, tenure and disbursement rests solely with the applicable Regulated Entity.

Compliance, Fraud Prevention, and Security
We process Personal Information to comply with applicable laws and regulatory requirements, including those relating to KYC, Anti-Money Laundering (AML), fraud prevention, RBI Digital Lending Guidelines, and lawful directions issued by courts, government authorities or regulators.

Your information may be used to verify your identity, prevent fraud, detect suspicious activity, protect customer accounts, secure the Platform, and investigate security incidents.

Customer Support & Service Improvement

• Respond to enquiries, resolve complaints and grievances.
• Communicate service-related updates, send operational notifications and repayment reminders.
• Improve the quality of customer support.
• Analyse information relating to the use of our Platform to improve performance, enhance customer experience, strengthen security and develop new features (using aggregated or anonymised information wherever reasonably possible).

7. Sharing of Your Personal Information

We respect the confidentiality of your Personal Information. We do not sell, rent or trade your Personal Information to third parties for their independent marketing purposes. We share Personal Information only where necessary to provide the services requested by you, facilitate lending services, comply with applicable legal obligations or protect the security and integrity of our Platform.

Regulated Entities
Where you apply for a lending product, your information may be shared with the applicable Regulated Entity for purposes including: processing your application, KYC and identity verification, credit assessment, loan sanction and servicing, repayment management, and compliance with applicable laws and regulatory requirements.

Authorised Service Providers
We may engage authorised service providers to support our operations, including providers of identity verification, KYC services, Credit Information Company integrations, Account Aggregator services, banking and payment services, cloud infrastructure, customer communications, fraud prevention, document verification, and customer support. These service providers process Personal Information only on our behalf, only for the services entrusted to them and under appropriate contractual obligations relating to confidentiality, privacy and security.

Government and Regulatory Authorities
We may disclose Personal Information where required by law, pursuant to lawful requests from government authorities, courts or regulators, or where necessary to prevent fraud, financial crime or other unlawful activities.

Business Transfers
In the event of a merger, acquisition, restructuring or similar corporate transaction, Personal Information may be transferred to the relevant successor entity, subject to appropriate confidentiality obligations and applicable legal requirements.

Whenever Personal Information is shared, we take reasonable steps to ensure that only the minimum information necessary for the relevant purpose is disclosed.

8. Data Storage, Security and Retention

Protecting your Personal Information is fundamental to the way ePayLater operates. We implement appropriate technical, organisational and administrative safeguards to protect your information from unauthorised access, disclosure, alteration, misuse or loss.

Data Localisation
Personal Information processed by ePayLater is stored and processed on servers located within India. We also ensure that authorised third-party service providers engaged by us for the lending journey process and store Personal Information within India in accordance with applicable legal, contractual and regulatory requirements.

Information Security
We maintain appropriate security measures to safeguard Personal Information, including access controls, encryption where appropriate, secure transmission mechanisms, system monitoring and periodic security reviews. Access to Personal Information is restricted to authorised personnel and service providers who require such access to perform their responsibilities.

Security Assurance and User Responsibility
Both you and ePayLater play an important role in protecting against online fraud. You should be careful that your bank account details and other related information, including your User ID(s) and/or passwords/personal identification numbers (PIN) are not compromised by ensuring that you do not knowingly or accidentally share, provide, or facilitate unauthorized use of it. We endeavor to put in place high standards of security to protect your interests, but you must safeguard your credentials. If you believe your account has been compromised, you are responsible for informing us immediately.

Data Retention
ePayLater retains Personal Information only for as long as necessary to provide the services requested by you, facilitate lending services on behalf of the applicable Regulated Entity, comply with applicable legal, contractual and regulatory obligations, resolve disputes, prevent fraud, or protect our legal rights.

As a Lending Service Provider, ePayLater retains only the minimum operational information necessary to perform its services. Where identity verification information or supporting documents are temporarily processed on behalf of a Regulated Entity during onboarding or loan processing, such information is retained only for the period reasonably necessary to complete the relevant operational purpose or comply with applicable obligations. Thereafter, such information is securely deleted, anonymised or otherwise disposed of in accordance with our internal retention policies. The applicable Regulated Entity remains responsible for maintaining customer records, including KYC records, loan documentation and lending records required to be retained under applicable laws and regulatory guidelines.

9. Your Privacy Rights

Subject to applicable law, you may exercise the following rights in relation to your Personal Information:

• Access and Correction: You may request access to the Personal Information processed by ePayLater and request correction of inaccurate or incomplete information. Where the relevant information is maintained by the applicable Regulated Entity, we may facilitate your request or direct you to the appropriate Regulated Entity.
• Withdrawal of Consent: Where processing is based on your consent, you may withdraw such consent at any time through the channels made available by ePayLater. Withdrawal of consent will not affect the lawfulness of any processing carried out prior to such withdrawal. Please note that withdrawal of consent may affect our ability, or the ability of the applicable Regulated Entity, to provide certain products or services where such processing is necessary.
• Deletion Requests: You may request deletion of your Personal Information that is no longer necessary for the purpose for which it was collected. However, certain information may continue to be retained where required under applicable law, regulatory directions, contractual obligations, fraud prevention requirements or for the establishment, exercise or defence of legal claims.
• Opt-Out of Marketing: You have the option to ‘opt-out’ of all ePayLater newsletters and other general e-mail marketing communications by following the unsubscribe instructions provided in those emails. However, you will not be able to opt-out of receiving essential administrative messages, customer service responses, or operational/transactional communications.

If you have any questions, concerns or complaints regarding the processing of your Personal Information, you may contact our Grievance Officer using the details provided in this Privacy Policy. We will endeavour to acknowledge and resolve your grievance within the timelines prescribed under applicable law.

10. Cookies and Third-Party Links

Cookies
Our website may use cookies and similar technologies to maintain secure user sessions, improve website functionality and performance, understand website usage patterns, and enhance user experience. Most web browsers allow you to manage or disable cookies through browser settings. Please note that disabling certain cookies may affect the functionality of the website. The ePayLater mobile application does not rely on browser cookies but may use similar technologies necessary for authentication, application security and performance.

Use of Third-Party Websites
You may be able to access third-party websites directly from the ePayLater Platform. This Privacy Policy only addresses the disclosure and use of data collected by us. If you visit any other websites through links on our Platform, you should review the privacy policies of those specific websites. Their data collection practices and policies might be different, and ePayLater disclaims all responsibility or liability with respect to those external policies or websites.

11. Limitation of Liability and Severability

Limitation of Liability
Notwithstanding anything contained in this Privacy Policy or elsewhere, ePayLater shall not be held responsible for any loss, damage or misuse of your Personal Information, if such loss, damage or misuse is attributable to a Force Majeure Event. A “Force Majeure Event” shall mean any event that is beyond the reasonable control of ePayLater and shall include, without limitation, sabotage, fire, flood, explosion, acts of God, civil commotion, strikes, lockouts or industrial action of any kind, riots, insurrection, war, acts of government, computer hacking, civil disturbances, unauthorised access to computer data and storage device, computer crashes, breach of security and encryption, and any other similar events not within the control of ePayLater.

Severability
ePayLater has made every effort to ensure that this Privacy Policy adheres to applicable laws. The invalidity or unenforceability of any part of this Privacy Policy shall not prejudice or affect the validity or enforceability of the remainder of this Privacy Policy.

12. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our business operations, technology, legal requirements or regulatory obligations. The updated Privacy Policy will be published on our Platform together with the revised effective date. Where required by applicable law, we will notify you of material changes through appropriate communication channels. Your continued use of the Platform after the revised Privacy Policy becomes effective constitutes your acceptance of the updated Privacy Policy, to the extent permitted under applicable law.

List of NBFC partners

• Piramal Capital & Housing Finance Ltd:
  

  https://www.piramalfinance.com/about-us/lending-partners

• Muthoot Finance:

  https://www.muthootfinance.com/sme-loan

• Arthashastra Epaylater Financial Private Limited (AEFPL):

  https://www.aefpl.in/policies

• SMFG India Credit Company Ltd:

  https://www.smfgindiacredit.com/digital-lending-partner.aspx?tab=partner_details

• Samunnati Finance Private Limited
• Caspian Impact Investments Private Limited

13. Contact Us and Grievance Redressal

If you have any questions, concerns or grievances regarding this Privacy Policy or the manner in which your Personal Information is processed, you may contact us using the details below:

Grievance Officer

• Name: Pranesh Acharya
• Designation: Grievance Officer
• Email: grievanceofficer@epaylater.in
• Address: Unit No. 510, Fifth Floor, Vipul Business Park, Sohna Road Gurgaon, HR 122001 IN

For general customer support or service-related queries, you may also contact:

• Customer Support Email: support@epaylater.in
• Website: https://epaylater.in

We will endeavour to acknowledge and resolve grievances in accordance with applicable laws and regulatory requirements.

Our Collection Agencies