VIKAM Privacy Policy

1. Who we are and what this policy covers

VIKAM is a money-management app for India, made by Fluxusforge Private Limited (CIN U62099DL2026PTC460990), registered office Unit No- 2045-2048, 2nd Floor, Plaza-2, Central Square Mall, Gaushala Road, Kishan Ganj, Delhi - 110006 (“VIKAM”, “we”, “us”). Under India’s Digital Personal Data Protection Act, 2023 (“DPDP Act”), we are the Data Fiduciary for your personal data: we decide why and how it is processed.

This policy applies to the VIKAM Android app, the website at vikam.io, and any support you get from us by phone, email or WhatsApp. It explains what personal data we collect, why, who we share it with, how long we keep it, and how you can use your rights.

When you choose to connect with a regulated partner through VIKAM, such as a bank, NBFC, Account Aggregator or credit bureau, that partner processes your data under its own privacy policy as well as this one. We name those partners in section 6.

VIKAM is not a bank or a lender. Using VIKAM’s core features never depends on agreeing to share your data with a partner.

2. Personal data we collect

We collect only what each feature needs. Most of it is optional: you choose whether to connect SMS, your bank, KYC or a lending partner.

• Account and contact: mobile number (verified by OTP), name, email, date of birth, gender, preferred language, permanent and current address, city, state, PIN code, and a profile photo if you add one.
• Identity verification (KYC), if you choose to verify: your PAN and the name, gender and date of birth on your PAN record. Your Aadhaar number and the details returned by Aadhaar or DigiLocker verification: name, gender, date of birth, address, care-of name and photo.
• Bank and payout details: bank account number, IFSC, bank name, and the account-holder name your bank confirms when we verify the account. Your UPI ID if you take reward payouts by UPI.
• Financial SMS, if you allow SMS access: messages from banks, cards, UPI apps, wallets, billers, demat accounts and EPFO. We keep the message text, sender and date, plus the transactions we read from them: amount, merchant, category, balance and the last 4 digits of the account.
• Bank data through an Account Aggregator, if you approve an AA consent: the transactions and balances your bank shares under that consent, and the consent’s ID and status.
• Credit bureau data, if you ask for a credit check: your CIBIL score and whether you have a credit history. We do not keep the full credit report.
• What you tell us: income, employment type, employer, occupation, money diary entries, budgets, goals, bills, typed or spoken transaction notes, survey answers, and lifestyle details such as housing, vehicles, insurance, investments, interests and loan needs. Spoken notes are turned into text; we do not keep audio.
• Scores we calculate: your Paisa Score and its history, and signals worked out from your data, such as estimated income, savings rate, EMI load, bounced payments and repayment reliability.
• People you add: names and phone numbers of people in your udhaar khata, savings circles, or people you vouch for. See “Data about other people” below.
• Rewards, games and payouts: your coin wallet and history, rewards, redemptions, payout reference numbers, game scores, and fraud checks on redemptions.
• Support: chat messages, photos and videos you send us, and anything you submit through our website’s contact or deletion forms.
• Device and usage: your push notification token, your IP address and device or browser type when you sign in or give consent, and app events such as sign-up, score check, KYC steps and support.
• Consent records: every consent you give or withdraw, with the time, IP address and device.

We do not collect your precise location, call logs, voice recordings or full credit report.

Data about other people

When you add someone to your khata or a savings circle, or vouch for someone, you give us their name and phone number. Only add people who know you are doing this. We use their details only to run that feature. Anyone whose details were added can ask us to remove them by writing to the Grievance Officer (section 12).

3. How we collect it

• From you: when you sign up, fill in your profile, add entries, answer surveys, or contact support.
• From your phone, with your permission: financial SMS (read on your phone, then sent to us), photos you pick or take, and push notification tokens. See section 5.
• From KYC providers: Signzy, Surepass and DigiLocker confirm your PAN, Aadhaar and bank account when you verify them.
• From Account Aggregators: Finvu (through Finfactor) and Surepass share your bank data under the consent you approve in their screens.
• From the credit bureau: TransUnion CIBIL, through Signzy or Surepass, returns your credit score when you ask for a credit check.
• From our lending partner: if you agreed to share your data with them, they tell us the outcome, for example whether you were approved and for how much.
• Automatically: your IP address and device type when you sign in or give consent, app events through Meta’s SDK, and website visits through cookies (section 11).

4. Why we use it

We ask for your consent for each purpose separately. You can withdraw any of them later (section 9). The only exception is the last item, which the law allows without consent.

1. Run and secure your account. Mobile number, OTP, name, IP address and device. Used to sign you in, keep sessions safe, and stop misuse.
2. Track your money. Financial SMS, Account Aggregator data and your own entries. Used to build your money diary, bills, budgets and goals. Our AI provider reads SMS only after we hide links, long numbers and codes in them.
3. Work out your Paisa Score and money tips. Your transactions, entries, khata, circles and vouches. Used to calculate your score and show tips in your language.
4. Check your credit score. PAN, name, date of birth, gender, address and PIN code, sent to the credit bureau through our KYC provider.
5. Verify your identity and bank account. PAN, Aadhaar and bank details, checked with our KYC providers. Needed before payouts or a loan.
6. Find you a loan, only if you agree. With your “credit check” consent, once your KYC and bank connection are complete, we automatically send our lending partner your profile, contact details, addresses, employment, transaction history, scores and survey answers, with PAN and Aadhaar masked. If you also agree to “share with lender”, we add your full PAN, Aadhaar details and bank account so they can process and pay out a loan. The lending partner decides on any loan, not VIKAM.
7. Rewards, games and payouts. Wallet, game scores, redemption details, bank or UPI details. Used to credit rewards, pay them out, and check redemptions for fraud.
8. Help you. Support chats, attachments and form submissions. Used to answer questions and resolve complaints.
9. Send updates and offers. Push token and your preferences. Used for reminders and offers if you agree to app updates.
10. Improve VIKAM and measure our ads. App events and website visits (section 11).
11. Follow the law. We may use or keep data when a law, court or regulator requires it, or to respond to a medical emergency or disaster, as the DPDP Act allows without consent.

5. App permissions

The app asks for each permission only when you use the feature that needs it. You can turn any of them off in your phone’s Settings → Apps → VIKAM → Permissions.

• SMS (read and receive): to find bank, card, UPI, wallet and bill messages and add them to your money diary. The app filters out OTPs, promotions and messages from personal numbers on your phone. It sends only the remaining financial messages to us. It also checks new messages when the app is closed, so your diary stays up to date. If you turn it off, you can still add transactions yourself.
• Notifications: for bill reminders, reward alerts and support replies.
• Camera and photos: only when you take or pick a profile photo, or attach a photo or video in a support chat.
• Contacts: only when you use “Invite friends”, to let you pick who to invite on WhatsApp. Your contacts stay on your phone. We do not upload them.

We do not ask for location, call logs, or the microphone.

6. Who we share it with

We do not sell your personal data. We share it only with the companies below, only what each needs, and each is bound by a contract or its own regulation.

• Lending partner, only with your consent: Quikkred (a brand of Fluxusforge Private Limited) and its partner NBFC Maple Mercantile Private Limited (RBI NBFC Reg. No. B-05.05645). What is shared depends on your consent (section 4, item 6). Each share is logged.
• Partner companies, only with your consent: Quikkred can view your profile through our partner system only if you consented to that purpose. They see a limited set of fields, with PAN and Aadhaar masked, and every view is logged.
• Identity and bank verification: Signzy and Surepass (PAN, Aadhaar, DigiLocker, bank account checks).
• Credit bureau: TransUnion CIBIL, through Signzy or Surepass.
• Account Aggregators: Finvu (through Finfactor) and Surepass.
• OTP messages: MSG91 and Gupshup.
• Payouts: RazorpayX (reward payouts to your bank or UPI) and Federal Bank (loan disbursement files sent on our lending partner’s instructions).
• AI processing: OpenRouter, which passes requests to AI model providers such as OpenAI or Google. We send SMS text with links, long numbers and codes hidden; the text of transaction notes you type or speak; and a summary of your money. For survey suggestions we send only city, state, gender, age range, occupation, income range and score, with no name or phone number.
• Notifications: Expo and Google Firebase Cloud Messaging.
• Analytics and advertising: Meta (Pixel on our website, App Events in the app) and Google Analytics (section 11).
• Other VIKAM users: your profile name can appear on game leaderboards and in lucky-draw winner announcements. People in your khata or savings circles see the entries you share with them.
• When the law requires it: regulators, courts, law enforcement and government bodies, when we receive a lawful request.
• If our business changes hands: a buyer or successor, who must keep protecting your data under this policy.

7. Where it’s stored and how it’s protected

Our main servers and database are in Mumbai, India. Some of our providers handle data outside India: our AI providers, Meta, Google, Expo and parts of Cloudflare’s network. We use them only as Indian law allows, and never in a country the Government of India has restricted.

How we protect your data:

• All data travels over encrypted connections (HTTPS).
• [Encryption at rest: confirm what is encrypted before publishing]
• Staff can see only what their role needs, and we log every time staff view or export your identity details.
• OTPs are stored only in scrambled (hashed) form and expire within minutes. You can be signed out of all devices at once.
• The app’s data is excluded from Android cloud backups.

If a breach affects your data, we will tell you promptly. We will also report it to the Data Protection Board of India and to CERT-In within the time the law sets: 6 hours for CERT-In, and a detailed report to the Board within 72 hours.

8. How long we keep it and how deletion works

We keep your data while your account is open and you have not withdrawn consent. After that we erase it, except what a law requires us to keep.

• Profile, entries, scores and rewards: while your account is open. Erased within 30 days after you delete your account.
• Raw SMS text: 180 days from when we receive it. The transactions read from it stay while your account is open.
• KYC and bank details: while your account is open, or longer only if a law or our lending partner’s regulations require it, for 5 years after your account closes.
• Consent records, share logs and staff access logs: 3 years, so we can prove what you agreed to and who saw your data.
• Security logs: at least 180 days, as CERT-In requires.
• OTPs: expire within 5 minutes. Sign-in sessions: expire after 90 days.
• Records shared with other people: if you are in someone’s khata or an active savings circle, your entries are anonymised rather than deleted, so their records stay correct.
• Data already shared with a lending partner: the partner keeps it under its own policy and the law. When you withdraw consent, we ask them to delete it where the law allows.

How to delete your account

In the app, go to Settings → Permissions → Request account closure. If you can’t use the app, use the form at vikam.io/delete-data. We check the request against your registered mobile number, close your account straight away, and erase your data within 30 days, except the records listed above.

9. Your rights and how to withdraw consent

Under the DPDP Act you have these rights. Most can be used in the app under Settings → Permissions; for anything else, write to the Grievance Officer (section 12).

• See your data: ask us for a summary of the data we hold, how we use it, and every company we have shared it with, or for a full copy.
• Correct or complete it: edit your profile in the app, or ask us to fix anything you can’t edit.
• Delete it: see section 8.
• Withdraw consent: turn off app updates, Account Aggregator data, credit check, or sharing with lenders under Settings → Permissions → Withdraw Consent. To stop SMS reading, turn off the SMS permission in your phone’s settings. Withdrawing is as easy as giving consent. It stops future use; it does not undo what was done before. Some features, such as the Paisa Score or loan offers, may stop working.
• Nominate someone: name a person who can use your rights if you die or can’t act for yourself.
• Complain: to our Grievance Officer first, then to the Data Protection Board of India if you are not satisfied.

We reply within 30 days, and never later than the 90 days the law allows. We may ask you to confirm your identity first, usually with an OTP to your registered number.

10. Children’s data

VIKAM is only for people aged 18 or over. We ask for your date of birth at sign-up and do not open accounts for anyone younger. If we learn that we hold data of someone under 18 without verified consent from their parent or guardian, we delete it.

11. Cookies and analytics

• On our website: Google Analytics and the Meta Pixel use cookies to count visits and measure how well our ads work. We do not send them your name, phone number or financial data. The site also remembers your language choice in your browser, and estimates your city from your IP address to show the right language.
• In the app: Meta’s SDK records app installs and key steps, such as sign-up, score check, KYC and contacting support, so we can measure our ads. We have set it not to collect your advertising ID.
• Your choices: block or delete cookies in your browser settings. On Android, you can reset or delete your advertising ID under Settings → Google → Ads.

12. Grievance Officer and complaints

For any question, request or complaint about your data, or about a loan arranged through VIKAM, contact our Grievance Officer. They also act as our nodal grievance officer for digital lending.

• Name: Namrata Sharma
• Designation: Grievance Officer
• Email: [email protected]
• Phone: +91 94232 47725, Mon–Sat, 9 AM – 6 PM
• Address: Unit No- 2045-2048, 2nd Floor, Plaza-2, Central Square Mall, Gaushala Road, Kishan Ganj, Delhi - 110006

We acknowledge every complaint within 48 hours and resolve it within 30 days.

If you are not satisfied with our answer, you can complain to the Data Protection Board of India. For a complaint about a loan, you can also go to the lender. If they don’t resolve it within 30 days, you can go to the RBI Ombudsman at cms.rbi.org.in.

13. Changes to this policy

We will update this policy when our features, partners or the law change. The new version and its date appear here, in the app and on our website. If a change affects how we use data you already gave us, we will tell you in the app and ask for your consent again where the law requires it. Earlier versions are available on request.

Version 1.0 · Effective from 2 November 2026