Protecting Your Privacy

01Introduction

This Privacy Policy is published in accordance with the Information Technology Act, 2000 and the rules made thereunder, and the Digital Personal Data Protection Act, 2023 ("DPDP Act"). It is an electronic record generated by a computer system and does not require any physical or digital signature. By accessing or using Capnix, you confirm that you have read, understood and agreed to this Policy. If you do not agree, please do not use the platform.

02Who we are

Capnix is a product owned and operated by Webority Technologies Private Limited (CIN: U72900HR2019PTC079747), a company incorporated in India with its registered office at 629-634, Vipul Trade Centre, Sector-48, Sohna Road, Gurugram, Haryana 122018, India ("Capnix", "we", "us", "our"). Capnix prepares, submits and manages loan applications with third-party lenders; it is not a lender and does not lend its own capital. For the personal data processed through this platform, Webority Technologies Private Limited acts as the Data Fiduciary under the DPDP Act.

03Personal data we collect

• Identity & contact details (name, mobile, email, city)
• KYC identifiers for promoters and signatories (PAN, and where a promoter chooses Aadhaar e-KYC, the Aadhaar number used to send a UIDAI one-time code, of which we retain only the last four digits)
• Business details (entity type, GST, Udyam, vintage)
• Financial documents (bank statements, GST returns, ITR)
• Your loan requirement (amount, purpose, tenure)
• The Capnix score we work out for your business each month, and the history of those scores
• Billing details for a Capnix Score subscription (billing name and address, GSTIN, and payment references)
• Usage & device information
• Payout details, for referral partners
• Communications with us

04How we use your data

We process your data only for the purposes notified to you at collection (Section 5, DPDP Act): to understand your borrowing strength, prepare a clear, lender-ready profile of your business, match you to and approach the lenders most likely to fund you, facilitate your application through to disbursal, respond to your enquiries, operate our partner programme, and meet our legal obligations.

Your Capnix score. Each month we work out a Capnix score for your business from the records we hold about it: GST registration and GST returns, bank statements, financial statements, company and other official registers, credit bureau reports where you have consented to us fetching them, and our screening checks. We keep each month's score, so that you can see how your business has changed over time. The Capnix score is our own assessment. It is not a credit score, it is not a loan approval, and lenders make their own decisions.

The Capnix Score subscription. When a business buys the Capnix Score subscription, we also use its records and its score history to give that business its paid reports, trends, improvement plan and alerts. We use the billing details you give us to take payment, issue GST invoices, and handle renewals, cancellations and refunds. Buying the subscription changes nothing about who we share your data with.

Introducing Capnix to businesses and professionals. We may send a short email introducing Capnix to a business owner, a chartered accountant or a DSA (direct selling agent) who does not yet have a Capnix account. We use only business contact details: a name, a work email address, a firm or business name and a role, taken from public business sources such as company and professional directories and a firm’s own website, or given to us by a person who referred them. We send these emails from hello@capnixhq.com, and only a few in total. If you reply “unsubscribe”, or simply ask us to stop, we stop at once and keep your address only to make sure we never email you again. We never share these details with a lender, and we delete them within twelve months if you do not reply.

05Consent

Your consent is explicit, granular, purpose-bound and revocable. Nothing about your loan requirement is shared with a lender or a Lender Partner until you approve it. You can withdraw that approval in your Capnix account and give it again later. Withdrawing stops any new sharing and ends document access for lenders who already hold your file. You may withdraw consent for any purpose at any time; doing so stops further processing for that purpose, though it may limit our ability to facilitate your loan.

06How we share your data

With lenders and Lender Partners, only after you approve. Facilitating a loan means approaching banks and NBFCs (non-banking finance companies) on your behalf, directly or through Lender Partners, the firms that work with those lenders. Only after you approve do we share your business profile and supporting documents with the lenders and Lender Partners we approach for you, so they can assess your requirement and make an offer. We also check your directors' PANs only after you approve. You decide whether to proceed with any offer. Your Capnix score is part of your business profile, so we share it with a lender or a Lender Partner only after you approve, in the same way.

With our service providers. We engage processors for hosting (in India), email, analytics (Google Analytics and Microsoft Clarity on this website; PostHog inside the customer, partner, Lender Partner and lender portals, which records session replays), error monitoring, credit bureau and business-registry lookups, content delivery and security, and partner payouts, each under a written confidentiality and data-processing arrangement. When you send an enquiry through our contact form or website chat, Google reCAPTCHA checks that the request comes from a person and not a script. It receives your IP address and browser signals, which Google processes under its own privacy policy (opens in a new tab) to improve reCAPTCHA and for general security purposes, and not for personalised advertising. We do not sell, rent or lease your personal data to anyone.

With our payment processor. Razorpay processes payments for the Capnix Score subscription. You enter your card, UPI or bank details on Razorpay's payment page, and Razorpay handles them under its own privacy policy (opens in a new tab). If your subscription renews automatically, Razorpay also holds the payment mandate you authorised. We never see or store your full card number. We receive the payment's status and reference, and the details we need to issue your invoice. Invoices for the subscription are issued by Capnix First Private Limited.

With our advertising partners. We advertise Capnix on Google and on Meta platforms (Facebook and Instagram). So that we can see which advertisements bring people to us and stop paying for the ones that do not, Google Tag Manager, Google Ads and the Meta pixel run on this website and in the customer portal. They receive the pages you visit, actions such as sending us an enquiry, and your browser and device signals, and they set the advertising cookies listed in our Cookie Policy. Our servers also tell Google and Meta how far an enquiry went, so they can match it to an advertisement. We send your email address and mobile number in hashed form (SHA-256, a one-way code), the advertisement's click or lead reference, and a stage: that you became a qualified lead, or that a lender sanctioned or disbursed your loan. They never receive your documents, your loan amount or any other figure from your file, your IP address from our servers, or the contents of your enquiry. Google processes this data under its own privacy policy (opens in a new tab) and Meta under its privacy policy (opens in a new tab), and each may use it to measure and improve advertising across its own services. Section 10 explains how to stop this.

With the partner who referred you. If a chartered accountant, DSA or consultant referred you to Capnix, they can see your business name, your loan requirement amount and its current status, so they can answer your questions about progress. They never see your documents, your financial statements or your contact details through Capnix. Tell us at dpo@capnix.ai if you want that visibility stopped.

Cross-border processing. To read and analyse your uploaded documents, to power the AI assistant in our website chat, and to power Capnix Assistant in the customer portal, we use Microsoft Azure OpenAI (Azure AI Foundry), which processes this content on servers located outside India (currently in the United States) under Microsoft's data-processing agreement. Capnix Assistant answers your questions from the records in your own Capnix account: your businesses, loan requirements, lender applications and offers, and the list of documents requested from you. It does not read the contents of your uploaded documents, and it can only raise a support ticket or a callback request after you confirm it. Your content is not used to train any AI model. Our website analytics providers, our advertising partners (Google Ads and Meta) and Google reCAPTCHA also process usage and device data outside India. PostHog, which records the session replays in our portals, including what you type, processes that data in the United States. Section 16 of the Digital Personal Data Protection Act, 2023 permits transfers to any country the Central Government has not restricted by notification, and we make them only to perform the services you have asked us for. Where a sectoral law requires a particular record to be held in India, we keep that record in India. Apart from the processing described in this paragraph, personal data and documents remain hosted in India.

07How to access & control your data

You have the right to access your data, correct it, erase it, nominate a representative, and seek grievance redressal (Sections 11 to 14, DPDP Act), and to withdraw consent at any time. Email dpo@capnix.ai. We acknowledge within 1 working day. A member of our team then handles your request by hand and confirms in writing once it is done.

You can ask us for this notice in Hindi or in any other language listed in the Eighth Schedule to the Constitution of India by writing to dpo@capnix.ai, and we will send it to you.

08Links to third-party websites

Our platform may link to lender, partner or other third-party websites. Their privacy practices are their own, and this Policy does not cover them. We encourage you to read the privacy policy of any site you visit through Capnix.

09Security

We protect your data with TLS 1.2 or newer in transit, AES-256 at rest, India-based hosting (other than the processing described in Section 6), and role-based access controls. While we apply strong safeguards, no method of transmission or storage is completely secure, and Webority Technologies Private Limited cannot guarantee absolute security against every loss, misuse or unauthorised access.

If there is a breach. If a personal data breach affects your data, we will tell you about it and report it to the Data Protection Board of India, in the form and within the timelines set by Section 8(6) of the DPDP Act, 2023 and the DPDP Rules, 2025. Our notice to you will describe what happened, what data was involved, what we are doing about it, and what you can do to protect yourself.

10Cookies & similar technologies

Strictly-necessary cookies keep you signed in and the site working. Analytics, preference and advertising cookies are on when you arrive. Analytics cookies tell us which pages people use, where they get stuck, and which parts of the site to improve. Our analytics also records session replays of clicks, scrolling and page content, on this website through Microsoft Clarity, and inside the customer, partner, Lender Partner and lender portals through PostHog. PostHog replays also record what you type into the portals. Advertising cookies, set by Google Ads and the Meta pixel on this website and in the customer portal, tell us which of our advertisements brought you here and whether you sent us an enquiry. All of them are described in our Cookie Policy. We do not show you a cookie banner. To stop analytics or advertising cookies, block or delete cookies for this site in your browser settings, or write to dpo@capnix.ai and we will action it for you. Either way it does not affect your loan requirement or how your file is handled.

11Your Capnix account

You sign in with a single-use link sent to your registered email address, so there is no password to remember or leak. That link is personal to you: do not forward it. Please keep access to your email account secure and let us know promptly of any unauthorised use by writing to dpo@capnix.ai.

12Data retention

We keep your data only as long as needed for the purposes above and to meet our legal obligations. These are the longest periods we keep each kind of record: application and facilitation records for 7 years after your last loan requirement is closed or disbursed, KYC and tax invoices for 8 years (CGST), and consent records for the period set by the DPDP Rules, 2025. Capnix Score subscription invoices and their payment records are tax records, so they are kept for the same 8 years. Conversations with Capnix Assistant and with our website chat are kept for 180 days after the last message and then deleted. The website chat keeps your conversation against a random identifier stored in a cookie on your device, not against your name; if you then sign up from the chat, that conversation is joined to your new account so our team can see what you asked. You can also request erasure at any time, see Section 13, Data deletion & erasure.

13Data deletion & erasure

Section 12 of the DPDP Act, 2023 gives you the right to erasure, no reason required and no retention queue. Request it by email to dpo@capnix.ai, where the word "delete" is enough.

The process. We acknowledge within 1 working day and may ask you to confirm your identity first. A member of our team then carries out the erasure by hand and confirms in writing once it is done.

What gets deleted:

• Account and business profile
• All uploaded documents
• Your loan enquiry and facilitation records
• Financial analysis we generated
• Your business's Capnix score history
• Support and contact history
• Capnix Assistant and website chat conversations
• Consents and the data pulls made under them
• Analytics and error-monitoring records

Statutory exceptions. A few records are retained where law requires: KYC and tax invoices, including Capnix Score subscription invoices and their payment records, for 8 years (CGST Section 36), consent records for the period set by the DPDP Rules, 2025, records under an active legal claim or regulatory obligation, and anonymised analytics that no longer identify you. Where you have an active loan application or a disbursed loan, the lender holds its own copy of the records you submitted to it, governed by that lender's own policies.

If we decline. Only when law requires it. You may escalate to our Grievance Officer (see Section 16) and then to the Data Protection Board of India.

14Children's privacy

Capnix is for authorised signatories of registered businesses and is not directed at anyone under 18. We do not knowingly collect the personal data of children, and there is no circumstance in which we process it: if we learn that we hold a child's data, we delete it. In line with Section 9 of the DPDP Act, 2023, we never track or behaviourally monitor children and never direct advertising at them.

15DPDP compliance & grievance redressal

We map our processing to Sections 4 to 14 of the DPDP Act, 2023 and the DPDP Rules, 2025, and maintain consent and grievance records accordingly. If a grievance is not resolved to your satisfaction, you may escalate to the Data Protection Board of India.

16Grievance Officer & contact

Mr. Asraf Hussain is our Grievance Officer, and is also the person who answers questions about how we handle your data. For a data-protection question or to exercise a right, write to dpo@capnix.ai; for a formal grievance, write to contact@capnix.ai. Both reach him. Post: Webority Technologies Private Limited (CIN: U72900HR2019PTC079747), 629-634, Vipul Trade Centre, Sector-48, Sohna Road, Gurugram, Haryana 122018, India. Phone +91 95990 06518. We acknowledge every grievance within 24 hours and resolve it within 15 days of receipt. This Policy is governed by the laws of India and the courts at Gurugram, Haryana have exclusive jurisdiction. We give 15 days' notice before any material change to this Policy.