Privacy policy

Kredmill (kredmill.com) verifies business documents for lenders, operated by Trademiller Fintech Private Limited (CIN U51909HR2022PTC106261, GSTIN 06AAJCT6427A1ZJ), DCT-810, 8th Floor, DLF City Court, Sikanderpur, Gurugram, Haryana 122002, India (“we”, “us”). A business seeking finance shares its documents with us; we check each one against its official source and, with the business's consent, send one verified file to the banks we approach on its behalf. We issue no credit score, rating or lending recommendation — the lending decision rests entirely with the bank.

This policy explains what we collect, why, who can see it, how long we keep it and your rights under the Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000.

1. What we collect

• Your enquiry: the business's name, constitution, activity, turnover, GST and Udyam status, the finance it is seeking and its existing borrowings, and the contact person's name, email and phone number.
• Documents for verification: PAN of the business and of each partner or director; Aadhaar of the proprietor and co-applicants; address and premises proof; GST, Udyam and incorporation or partnership documents; licences; 12 months' bank statements; GSTR-1 and GSTR-3B returns; three years of income-tax returns and audited financials; current-year provisional figures; and sanction letters and repayment records for running loans.
• Account details: the name and email of each person who signs in, and a password stored only as a one-way hash. This includes bank officers who read the files sent to their bank.
• Technical data: a sign-in cookie, a stored light or dark display preference, and server logs (IP address, time, page) kept for security.

2. Why we use it

• To assess your enquiry and contact you about it.
• To verify each document against its official source and record which source it was checked against and when.
• To prepare one verified file and, only with your consent, send it to the banks we approach on your behalf.
• To run your account and meet our legal obligations.

We do not sell your information, and we do not use it for advertising.

3. Where we verify it

With your authorisation, we check what you declared against official records: the GST portal, the Income Tax Department, the Ministry of Corporate Affairs, the Udyam portal and DigiLocker — directly or through licensed verification providers and API Setu (Government of India). Where you authorise it, we also read your GST filings, commercial credit-bureau record and bank statements through an Account Aggregator. We fetch only what is needed to confirm what you declared.

4. Who can see your information

• You, through your own sign-in.
• The verification officer assigned to your file. Other verification staff cannot see it. Our managers can see every file in order to assign and oversee the work.
• Banks, only after you give permission on screen, and only the banks we approach on your behalf. A bank receives the verified file and the documents behind it — never your Aadhaar or your bank statements, which we use only for our own checks.
• Service providers who run parts of the service for us under contract: our hosting provider, our email provider (Brevo) and verification providers (section 3).
• Authorities, when the law requires it.

5. How we protect it

Data travels over encrypted connections (HTTPS). Access is limited by role, a file is visible only to the officer it is assigned to, and every verification is recorded with who checked it, against which source and when. A file cannot be sent until every required item is verified.

6. How long we keep it

We keep your file while your enquiry is open and for 8 years after it closes, so that a bank's questions about a file it received can be answered. After that we delete or anonymise it unless a dispute or legal requirement means we must keep it longer.

7. Your rights

Under the Digital Personal Data Protection Act, 2023 you can:

• ask what personal data we hold about you and how we use it;
• ask us to correct or complete it, or to erase it where we no longer need it;
• withdraw a consent you gave, including permission to send your file to a bank (this does not undo what was already sent);
• nominate someone to exercise these rights on your behalf; and
• complain to our Grievance Officer, and then to the Data Protection Board of India.

Write to the Grievance Officer below; we will reply within 30 days.

8. Grievance Officer

Smarth Chugh, Director
Trademiller Fintech Private Limited, DCT-810, 8th Floor, DLF City Court, Sikanderpur, Gurugram, Haryana 122002, India
Email: it@trademiller.com

9. Changes to this policy

If we change this policy, we will update the date above and, for significant changes, tell you before the change takes effect.