Privacy Policy
How LumexPay (operating the OpenCredit platform) handles your data — built around consent, not assumption.
Effective Date: January 1, 2026
Consent Before Anything
We only access UPI transaction data, GST filings, or Account Aggregator data after you give explicit, purpose-bound consent. Consent is never assumed and is never pulled before it exists. You can revoke consent at any time, and future data access will stop.
What We Collect
With your consent: UPI transaction patterns, GST filing history, and financial data shared through the Account Aggregator framework. We use this to compute your Trust Confidence Profile — a score, component breakdown, and confidence band.
How Documents Are Shared
Any document a lender reviews as part of your profile is granted as scoped, time-bound, revocable, view-only access inside the platform — never downloaded, never emailed. Every access is logged in a full audit trail.
Explainability
You can see exactly which factors contributed to your Trust Confidence Profile, and exactly which criteria were or weren't met for any lender match. We do not use opaque, unexplainable scoring.
What We Don't Do
We do not sell your personal or financial data to third parties. We do not share your data with a lender without your consent, and we do not use your data for advertising or marketing profiling.
Regulatory Alignment
OpenCredit is built with India's Digital Personal Data Protection (DPDP) Act and the RBI's Digital Lending Directions in mind. As an early-stage platform, we will update this policy as our regulatory status and data practices evolve.
Questions About Your Data?
If you have any questions about this Privacy Policy or want to revoke consent, contact us directly: