Privacy Policy

What this policy covers

This policy explains what MORFGAGE collects when you use the platform, why it is collected, who it is shared with, and what you can ask us to do with it. It applies to morfgage.com and to the customer and partner portals on it.

What we collect

We collect only what the platform needs to show you which loan products your details match. Nothing is bought from a third party and nothing is scraped.

• Account details — your email address and a password, which is stored only as a one-way hash and is never readable by us.
• Profile details — name, date of birth, gender, phone number, employment type, employer name, monthly income, and your city, state and PIN code.
• Financial details — other monthly income, existing EMIs, number of existing loans and credit cards, years of employment, and the credit score you choose to tell us. The credit score is self-declared: we do not pull a bureau report.
• Enquiry details — the loan type, amount, tenure and property location you are asking about.
• Documents you upload — identity and income papers you choose to attach to an enquiry.
• Technical records — the time of a request, the page it was for and whether it succeeded. We do not log the contents of your requests.

What we do not collect

We do not operate advertising trackers or third-party analytics on the platform, and we do not sell data to anyone, in any circumstances.

• No payment card or bank account numbers — the platform takes no payments.
• No credit bureau report is pulled by MORFGAGE.
• No one-time passwords, session tokens or passwords are ever written to our logs.

Why we hold it

Your profile and financial details are assessed against each lender's published eligibility criteria so the platform can show you which products you currently match. That assessment is an educational estimate. It is not an approval, and MORFGAGE does not decide whether any lender will lend to you.

Your enquiry details allow a MORFGAGE advisor or a Direct Selling Agent partner to follow up on a loan you have asked about.

Who it is shared with

Access is limited to what each party needs in order to help you.

• A Direct Selling Agent partner assigned to your enquiry can see the enquiry and the documents attached to it. A partner cannot see enquiries that are not theirs.
• MORFGAGE staff with an administrator account can see enquiries in order to assign and support them.
• Our email provider handles delivery of one-time passwords and notification emails.
• Enquiry summaries may be mirrored to an internal spreadsheet used by the operations team.
• We disclose data to a government authority only where the law requires it.

Where it is stored and how it is protected

Data is stored on servers located in India. Connections to the platform are encrypted in transit. Passwords are stored as bcrypt hashes and one-time passwords as keyed hashes, so neither can be read back by us.

Uploaded documents are held outside the public web root and can only be retrieved through an authenticated request that checks ownership. The file type of every upload is verified from its contents, not from its filename.

Session tokens are held in cookies that JavaScript cannot read, which means a script injected into a page cannot steal your session.

How long it is kept

Account and enquiry records are kept for as long as your account is open. Deleting your account removes your profile, financial details, enquiries and uploaded documents.

Records we are required to retain for legal or audit reasons are kept for the period the law requires and then deleted.

Your rights

You can exercise any of the following by writing to morfgage@gmail.com from the email address on your account.

• See the data held about you.
• Correct anything inaccurate — most of it you can edit yourself in your profile and financial profile.
• Delete your account and the data attached to it.
• Withdraw consent for processing, which ends your use of the matching features.
• Complain to the Data Protection Board of India if you believe your data has been mishandled.

Cookies

The platform sets one cookie, which holds your sign-in session. It is removed when you sign out. There are no advertising or tracking cookies.

Some preferences, such as an unfinished form, are kept in your own browser's storage and never sent to us.

Children

The platform is intended for adults who can enter into a loan agreement. We do not knowingly collect data from anyone under 18.

Changes

If this policy changes in a way that affects how your data is handled, we will say so on this page and, where the change is significant, by email.