Privacy Policy

1. Who we are and what this Policy covers

Satya Financial Technologies Pvt Limited (“Satya”, “we”, “us” or “our”) operates satyafinancial.com and the Satya loan-application support platform (the “Platform”). Satya is responsible for the personal information it collects and controls through the Platform.

This Privacy Policy explains what information we collect, why and how we use it, when we disclose it, how long we keep it, and the choices available to you. It applies to visitors, applicants, authorised representatives and people whose information is included in an application. It should be read with our Terms & Conditions.

2. Information we collect

The information we collect depends on how you use the Platform. A loan application may contain sensitive personal, financial and official-document information.

Information you provide

• Identity and contact information: name in Latin and Devanagari script, date of birth, gender, marital status, mobile number, email address, occupation and signatures or attestations.
• Government identifiers and documents:citizenship certificate, national identity number and card, document numbers, issuing authority and dates, and an optional driving licence.
• Images and identity-verification material:uploaded document images and a live-captured selfie. The current Platform stores the selfie as an identity-verification image; it does not create a face template or perform automated facial recognition.
• Address and location information: permanent and current address, province, district, postal code, proof-of-address documents, and coordinates when you choose or are required to place a map pin.
• Family information: family members' names, relationships, ages and occupations, and family or marriage certificates where applicable.
• Financial and employment information: income sources and amounts, employee and employer names, employer address, job title, employment status and level, salary and allowance details, existing monthly debt, income certificates, bank statements, bank and account-holder names, statement periods and average monthly credits.
• Loan and collateral information: requested amount, purpose, tenure, indicative interest-rate range, repayment frequency and calculated installment estimates, property coordinates, ownership and land records, revenue receipts, plans, boundary records and related evidence.
• Consents and communications: your consent selections and timestamps, declarations, application status, decisions, questions and other communications with Satya. If you answer the optional product-interest question, this also includes whether you authorised contact, the general product categories selected, permitted contact methods, disclosure version and locale, and any later withdrawal.

Information generated or collected automatically

• data extracted or inferred from submitted documents using optical character recognition (OCR), transliteration and structured data-extraction tools, which you are asked to review;
• internet protocol address, request time, security and rate-limit signals, error and server logs, and basic device or browser information made available through normal web requests;
• anonymous website-usage information such as the page viewed, referral domain, approved campaign tags, language, browser and device category, and approximate location. Our analytics configuration does not record form contents, application identifiers or identified user profiles; and
• cookies and similar local identifiers used to remember language, resume an application, maintain an authenticated session and prevent abuse.

3. How and why we use information

We process personal information only for specified, legitimate purposes, including to:

• create, save, resume, organise, review and submit your application;
• scan documents, extract fields, transliterate names and reduce repetitive data entry;
• verify identity, document completeness, accuracy and application eligibility for referral;
• with your consent, share the application with selected partner banks or financial institutions (“Partner Institutions”) for their independent assessment and processing;
• if you separately opt in, share your selected product interests, permitted contact methods and relevant contact details with selected Partner Institutions so they may contact you about only those product categories;
• communicate with you, request clarifications and provide application or service notices;
• authenticate access, prevent duplicate or fraudulent applications, rate-limit requests, detect abuse, investigate incidents and protect applicants, Satya and others;
• operate, troubleshoot, audit and improve the reliability, accessibility and user experience of the Platform, using aggregated or de-identified information where reasonably possible; and
• meet contractual, legal, regulatory, accounting, reporting and dispute-resolution obligations, and establish, exercise or defend legal claims.

We rely on your request for our services, your express consent, our legitimate need to operate and secure the Platform, and our legal obligations, as applicable. Where the law requires consent for a particular collection, use or disclosure, we will request it. We will not use information collected for a loan application for an unrelated purpose without an appropriate legal basis and notice or consent where required.

We do not sell or rent personal information, and we do not use loan-application information for third-party targeted advertising.

4. Document scanning and automated tools

When you ask the Platform to scan an eligible document, the document or its contents are transmitted to Mistral AI's services to perform OCR and structured extraction. This can include government ID, address, family, income and bank-statement information. Mistral processes that information as a service provider for the requested scanning function.

Automated extraction may be inaccurate. Extracted fields are intended to assist data entry and are presented for human review or correction. Satya's OCR tools do not make a final lending decision. A Partner Institution may use its own verification or decision systems under its own terms and privacy notice.

5. When we disclose information

We may disclose relevant information to:

• Partner Institutions: after the applicable consent, so they can verify, assess and process the loan application. If you separately request contact about other products, we may instead or additionally give selected Partner Institutions your selected categories, permitted contact methods and relevant contact details for that limited purpose. Once received, a Partner Institution may independently control its copy under its own legal duties and privacy notice.
• Service providers: vendors supporting cloud hosting, encrypted document storage, database operations, OCR and document extraction, security, anonymous website analytics, communications, support and professional advice. Current core providers include Amazon Web Services, Mistral AI and PostHog. They receive only the information reasonably needed for their function and are subject to applicable confidentiality and data-protection obligations.
• Authorities and affected parties: where we reasonably believe disclosure is required or permitted by law, court order or lawful process; is needed to protect rights, safety, property or Platform integrity; or is appropriate to investigate fraud, security incidents or unlawful conduct.
• Corporate transaction participants:professional advisers and prospective or actual investors, lenders, buyers, successors or transaction counterparties in connection with due diligence, financing, reorganisation, merger, acquisition, insolvency or a transfer of all or part of our business, subject to appropriate confidentiality and legal safeguards.

We may also disclose aggregated or de-identified information that does not reasonably identify an individual. We do not make an application available to every Partner Institution by default; the selection and disclosure depend on your consent, application circumstances and operational arrangements.

Choosing optional product contact does not permit a Partner Institution to use Satya's copy of your loan application for unrelated promotion. We share only the information reasonably needed for the selected contact request unless another use or disclosure has its own lawful basis and notice.

6. Processing outside Nepal

Some service providers or their infrastructure may be located outside Nepal. As a result, personal information may be transmitted to, stored in, or accessed from countries whose privacy rules differ from Nepal's. Where required, we use appropriate contractual, technical or organisational measures for such processing. Information may also be subject to lawful access by authorities in the country where it is processed.

7. Retention

We retain personal information only for as long as reasonably necessary for the purposes described in this Policy, including to manage a draft or submitted application, support Partner Institution review, prevent fraud and duplicate submissions, comply with legal or regulatory obligations, resolve disputes and enforce agreements. Retention periods vary according to the type and sensitivity of information, application status, operational need and applicable law.

When information is no longer required, we take reasonable steps to delete, anonymise or securely isolate it. Deletion from active systems may not immediately remove encrypted backups, logs or non-current storage versions, which are removed or overwritten on their normal cycles. A Partner Institution controls its own retention after receiving an application.

Product-interest selections, contact permissions and withdrawals are retained with the application for as long as reasonably needed to evidence your instructions, prevent contact after withdrawal, address complaints and meet legal or regulatory obligations. A Partner Institution that receives the request controls its own contact and retention records and should explain those practices in its privacy notice.

8. Security

We use reasonable technical and organisational safeguards appropriate to the nature of the information, including restricted administrative access, non-public document storage, encryption of stored documents, access controls, session protections, request rate limiting and security logging. We limit access to people and providers who need it for authorised purposes.

No internet transmission or storage system is completely secure, and we cannot guarantee absolute security. You should use a trusted device and network, protect access to your phone, email and application sessions, and notify us promptly if you suspect unauthorised access. Where required by law, we will notify affected people and authorities of a qualifying personal-data incident.

9. Your choices and rights

Subject to applicable law and appropriate identity verification, you may ask us to:

• confirm whether we hold personal information about you and provide access to it;
• correct or complete inaccurate or incomplete information;
• delete information that we no longer have lawful grounds or a requirement to retain;
• withdraw a consent or object to certain processing, where applicable; or
• explain how your information has been used or disclosed and review a privacy concern.

You can correct many extracted or entered fields before submitting an application. To make another request, email privacy@satyafinancial.com. We may request information needed to verify your identity and authority. We may refuse or limit a request where permitted or required by law and will explain when applicable.

Withdrawing consent does not affect prior lawful processing. It may prevent us from continuing or referring an application, and it may not require deletion of records we or a Partner Institution must retain for fraud-prevention, legal, regulatory or dispute purposes.

You may decline optional product contact without affecting your loan application. If you previously opted in, email privacy@satyafinancial.com to withdraw that permission and ask any Partner Institution that contacts you to stop. We will record the withdrawal and stop making your preference available for new product outreach. Withdrawal does not affect product-related contact or disclosure lawfully completed before it was processed.

10. Cookies and similar technologies

The Platform currently uses cookies and related identifiers for essential or functional purposes:

• workforce authentication and security for authorized Partner Institution users; and
• a language preference that lasts up to 1 year.

Browser settings can block or delete cookies, but essential Platform functions may then fail. We do not currently use advertising cookies on the Platform.

PostHog website analytics operate in cookieless mode and do not store PostHog identifiers in cookies, local storage or session storage. PostHog counts anonymous visitors using a privacy-preserving value calculated on its servers. We disable session replay, automatic interaction capture and identified user profiles, and restrict analytics to approved page paths and high-level events.

11. Children and third-party information

The Platform is not intended for people under 18 to apply in their own name, and we do not knowingly invite them to do so. An adult applicant may provide limited information about minor family members where relevant to the application and where the adult has lawful authority. If you believe a child's information was submitted without proper authority, contact us so we can review it.

If you submit any other person's information, you must have authority to do so, inform them as appropriate about this Policy, and provide any notice or obtain any consent required by law.

12. External services

A Partner Institution or external website may have separate terms and privacy practices. This Policy does not govern information a third party collects independently from you or receives from Satya and then controls for its own purposes. Review that party's notice before providing additional information directly to it.

If a Partner Institution contacts you about a selected product, it is responsible for its subsequent communications and any additional information it collects. You may use its stated opt-out or complaint channels as well as contacting Satya about the preference recorded on the Platform.

13. Changes to this Policy

We may update this Policy as our Platform, providers, Partner Institution relationships or legal obligations change. We will post the revised Policy and change the effective date. If a change materially affects how we use information already collected, we will provide additional notice or request consent where required by law.