Effective 18 June 2026. Last updated 15 August 2026.
01Introduction
This Privacy Policy is published in accordance with the Information Technology Act, 2000 and the rules made thereunder, and the Digital Personal Data Protection Act, 2023 ("DPDP Act"). It is an electronic record generated by a computer system and does not require any physical or digital signature. By accessing or using Capnix, you confirm that you have read, understood and agreed to this Policy. If you do not agree, please do not use the platform.
02Who we are
Capnix is a product owned and operated by Webority Technologies Private Limited (CIN: U72900HR2019PTC079747), a company incorporated in India with its registered office at 629-634, Vipul Trade Centre, Sector-48, Sohna Road, Gurugram, Haryana 122018, India ("Capnix", "we", "us", "our"). Capnix prepares, submits and manages loan applications with third-party lenders; it is not a lender and does not lend its own capital. For the personal data processed through this platform, Webority Technologies Private Limited acts as the Data Fiduciary under the DPDP Act.
03Personal data we collect
- Identity & contact details (name, mobile, email, city)
- KYC identifiers for promoters and signatories (PAN, and where a promoter chooses Aadhaar e-KYC, the Aadhaar number used to send a UIDAI one-time code, of which we retain only the last four digits)
- Business details (entity type, GST, Udyam, vintage)
- Financial documents (bank statements, GST returns, ITR)
- Your loan requirement (amount, purpose, tenure)
- Usage & device information
- Payout details, for referral partners
- Communications with us
04How we use your data
We process your data only for the purposes notified to you at collection (Section 5, DPDP Act): to understand your borrowing strength, prepare a clear, lender-ready profile of your business, match you to and approach the lenders most likely to fund you, facilitate your application through to disbursal, respond to your enquiries, operate our partner programme, and meet our legal obligations.
05Consent
Your consent is explicit, granular, purpose-bound and revocable. Nothing is shared with a lender until you approve it. You may withdraw consent for any purpose at any time; doing so stops further processing for that purpose, though it may limit our ability to facilitate your loan.
06How we share your data
With lenders, only on your consent. Facilitating a loan means approaching banks and NBFCs on your behalf. With your explicit consent, we share your business profile and supporting documents with the lenders we approach for you, so they can assess your application and make an offer. You decide whether to proceed with any offer.
With our service providers. We engage processors for hosting (in India), email, analytics, error monitoring, credit bureau and business-registry lookups, content delivery and security, and partner payouts, each under a written confidentiality and data-processing arrangement. We do not sell, rent or lease your personal data to anyone, and we never share it for advertising.
With the partner who referred you. If a chartered accountant, DSA or consultant referred you to Capnix, they can see your business name, your loan requirement amount and its current status, so they can answer your questions about progress. They never see your documents, your financial statements or your contact details through Capnix. Tell us at dpo@webority.com if you want that visibility stopped.
Cross-border processing. To read and analyse your uploaded documents, and to power the AI assistant in our website chat, we use Microsoft Azure OpenAI (Azure AI Foundry), which processes this content on servers located outside India (currently in the United States) under Microsoft's data-processing agreement. Your content is not used to train any AI model. Our website analytics providers also process usage and device data outside India. Section 16 of the Digital Personal Data Protection Act, 2023 permits transfers to any country the Central Government has not restricted by notification, and we make them only to perform the services you have asked us for. Where a sectoral law requires a particular record to be held in India, we keep that record in India. All other personal data and documents remain hosted in India.
07How to access & control your data
You have the right to access your data, correct it, erase it, nominate a representative, and seek grievance redressal (Sections 11 to 14, DPDP Act), and to withdraw consent at any time. Email dpo@webority.com. We acknowledge within 1 working day and complete your request within 7 working days.
You can ask us for this notice in Hindi or in any other language listed in the Eighth Schedule to the Constitution of India by writing to dpo@webority.com, and we will send it to you.
08Links to third-party websites
Our platform may link to lender, partner or other third-party websites. Their privacy practices are their own, and this Policy does not cover them. We encourage you to read the privacy policy of any site you visit through Capnix.
09Security
We protect your data with TLS 1.3 in transit, AES-256 at rest, India-based hosting (other than the processing described in Section 6), and role-based access controls. While we apply strong safeguards, no method of transmission or storage is completely secure, and Webority Technologies Private Limited cannot guarantee absolute security against every loss, misuse or unauthorised access.
If there is a breach. If a personal data breach affects your data, we will tell you about it and report it to the Data Protection Board of India, in the form and within the timelines set by Section 8(6) of the DPDP Act, 2023 and the DPDP Rules, 2025. Our notice to you will describe what happened, what data was involved, what we are doing about it, and what you can do to protect yourself.
10Cookies & similar technologies
Strictly-necessary cookies keep you signed in and the site working. Analytics and preference cookies are on when you arrive. They tell us which pages people use, where they get stuck, and which parts of the site to improve. Our analytics also records anonymised session replays of clicks, scrolling and page content, described in our Cookie Policy. We do not show you a cookie banner. To stop analytics, block or delete cookies for this site in your browser settings, or write to dpo@webority.com and we will action it for you. Either way it does not affect your loan requirement or how your file is handled.
11Your Capnix account
You sign in with a single-use link sent to your registered email address, so there is no password to remember or leak. That link is personal to you: do not forward it. Please keep access to your email account secure and let us know promptly of any unauthorised use by writing to dpo@webority.com.
12Data retention
We keep your data only as long as needed for the purposes above and to meet our legal obligations: application and facilitation records for 7 years after your last loan requirement is closed or disbursed, KYC and tax invoices for 8 years (CGST), consent records as required by the DPDP Rules, 2025, and access logs for 90 days. After its retention window, data is deleted or anonymised. You can also request erasure at any time, see Section 13, Data deletion & erasure.
13Data deletion & erasure
Section 12 of the DPDP Act, 2023 gives you the right to erasure, no reason required and no retention queue. Request it by email to dpo@webority.com, where the word "delete" is enough.
The process. We acknowledge within 1 working day, verify your identity with a one-time code if the request looks suspicious, complete the erasure within 7 working days (logged with a deletion hash), and confirm in writing once it is done.
What gets deleted:
- Account and business profile
- All uploaded documents
- Your loan enquiry and facilitation records
- Financial analysis we generated
- Support and contact history
- Consents and the data pulls made under them
- Analytics and error-monitoring records
Statutory exceptions. A few records are retained where law requires: KYC and tax invoices for 8 years (CGST Section 36), consent records for the period set by the DPDP Rules, 2025, records under an active legal claim or regulatory obligation, and anonymised analytics that no longer identify you. Where you have an active loan application or a disbursed loan, the lender holds its own copy of the records you submitted to it, governed by that lender's own policies.
If we decline. Only when law requires it. You may escalate to our Grievance Officer (see Section 16) and then to the Data Protection Board of India.
14Children's privacy
Capnix is for authorised signatories of registered businesses and is not directed at anyone under 18. We do not knowingly collect the personal data of children, and there is no circumstance in which we process it: if we learn that we hold a child's data, we delete it. In line with Section 9 of the DPDP Act, 2023, we never track or behaviourally monitor children and never direct advertising at them.
15DPDP compliance & grievance redressal
We map our processing to Sections 4 to 14 of the DPDP Act, 2023 and the DPDP Rules, 2025, and maintain consent and grievance records accordingly. If a grievance is not resolved to your satisfaction, you may escalate to the Data Protection Board of India.
16Grievance Officer & contact
Mr. Navneet Singh is our Grievance Officer, and is also the person who answers questions about how we handle your data. For a data-protection question or to exercise a right, write to dpo@webority.com; for a formal grievance, write to contact@webority.com. Both reach him. Post: Webority Technologies Private Limited (CIN: U72900HR2019PTC079747), 629-634, Vipul Trade Centre, Sector-48, Sohna Road, Gurugram, Haryana 122018, India. Phone +91 95990 06518. We acknowledge every grievance within 24 hours and resolve it within 30 working days. This Policy is governed by the laws of India and the courts at Gurugram, Haryana have exclusive jurisdiction. We give 15 days' notice before any material change to this Policy.
