1. Introduction
This Privacy Policy explains how Reachout Tech Private Limited ("myScorr", "we", "us", "our"), a company incorporated under the laws of India (CIN: U62099KA2024PTC190922) with its registered office at 22, 4th Floor, 1st Main, Royal Placid, Haralur, HSR Layout, Bangalore South, Karnataka – 560102, collects, uses, stores, shares and otherwise processes your personal information when you use the myScorr website, the myScorr mobile application for iOS and Android, and any related services (together, the "Platform").
By accessing or using the Platform, you agree to the collection and use of information in accordance with this Policy. If you do not agree with this Policy, please do not use the Platform.
This Policy is intended to comply with applicable Indian data protection law, including the Information Technology Act, 2000 and the rules made under it, and the Digital Personal Data Protection Act, 2023, to the extent applicable.
2. Information we collect
Information you give us
- Contact and identity details: name, mobile number, email address, date of birth and PAN.
- Employment and income details you choose to share, where relevant to a loan, card or account application.
- Documents you upload: a photo or scan of your PAN card, if we ask for one to verify your PAN manually, and bank or UPI app statements for the Statement Intelligence feature.
- Any information you enter while communicating with our support team.
Information we collect automatically
- Device and usage information: device type, operating system, app version, IP address and general usage patterns within the app.
- In the Android app, app analytics through Google Analytics for Firebase, and advertising measurement through Meta, both including your device’s advertising ID, as described in Section 8.
- Standard web server logs when you visit myscorr.com: the pages requested, the referring page, your IP address and your browser type.
- On the myscorr.com website, and only if you allow them, analytics and advertising cookies, as described in Section 8.
Information from third parties
- Your credit score and credit report, obtained from our credit bureau partner strictly on the basis of your explicit consent for each request.
- When you verify your PAN, our identity-verification partner confirms whether it matches your mobile number and returns the name, date of birth and PAN registered against that number.
- Where you apply for a loan, credit card or bank account through the app, application status updates from the relevant lending, card or banking partner.
3. How we collect it
- Registration: when you sign up using your mobile number or email and verify with an OTP.
- Bureau consent flow: when you provide your PAN and explicit consent for us to request your score and report on your behalf.
- Statement uploads: when you voluntarily upload a bank or UPI statement PDF for analysis. Uploaded statements are deleted when you delete your account (Section 10).
- OTP autofill: on Android, we may use the SMS Retriever API to autofill the OTP you receive, which does not require broad access to your message inbox.
- App analytics and advertising measurement: on Android, Google Analytics for Firebase records how the app is used, and Meta’s app events tool records when the app is installed and opened and the key actions taken in it, so we can measure our advertising. Both are described in Section 8.
- Cookies and browser storage: in the web app, only what is needed to keep you signed in; on the website, analytics and advertising cookies only if you allow them in our cookie banner. Both are described in Section 8.
4. How we use your information
- To create and manage your account and verify your identity.
- To fetch your credit score and report from our credit bureau partner, with your consent, and to generate your personalised improvement plan.
- To analyse uploaded bank or UPI statements and generate spend, income and tamper-check insights.
- To match you with loan, credit card and bank account offers you are likely to qualify for, and to facilitate your application if you choose to apply.
- To send you service updates, score-change alerts and, where you have consented, product communications by SMS, email, push notification or WhatsApp.
- To understand how the app is used, so that we can fix problems and improve it.
- To measure how well our advertising works — for example, how many people install the app or buy a plan after seeing one of our adverts — and to help advertising platforms show our adverts to people likely to find them useful.
- To detect and prevent fraud, and to maintain the security of the Platform.
- To comply with applicable law, regulatory requests and court orders.
5. Credit information & bureau consent
- We request your score and report from our credit bureau partner only after you provide explicit, informed consent for each pull, or for the refresh frequency associated with your chosen myScorr plan.
- Your consent for a bureau pull remains valid for the period disclosed to you at the time of consent, and you may withdraw it at any time by writing to us, subject to any services already in progress.
- We retain your credit report and score only for as long as necessary to deliver the relevant service, and in line with applicable law and our arrangement with the bureau partner.
- We do not share your raw credit report or score with lending, card or account-opening partners unless you have explicitly applied for a specific product through the app, or where required by applicable law.
7. Automated insights
Your improvement plan, score simulator and other insights are generated automatically from the data in your credit report, using rules we define. We do not use artificial intelligence services for these features, and we do not send your information to any third-party AI provider. Automated insights are informational only and do not constitute financial, legal or tax advice; see Section 4 of our Terms & Conditions for further detail.
9. Data security
- All data travelling between the app, the website and our servers is encrypted in transit.
- Your credit bureau report PDF is password-protected. Report PDFs and your uploaded documents are held in private storage that is encrypted at rest, and our database backups are encrypted at rest.
- Access to personal information is restricted to authorised personnel on a need-to-know basis.
- We conduct periodic security reviews of our systems and vendors.
No method of transmission or storage is completely secure, and while we work to protect your information, we cannot guarantee absolute security.
10. Retention & deletion
We keep your personal information for as long as your account is open. When you delete your account we erase it as described below, except for the transaction records the law requires us to keep and the copies described under “Copies held elsewhere”.
How to delete your account
You can delete your account yourself, at any time, in either of two ways:
- In the app: open the Account tab and tap Delete account, below Log out.
- On the web, without the app installed: at myscorr.com/delete-account.
Either way, we send a one-time code to the mobile number or email address on your account to confirm the request is yours. If you cannot receive a code, write to alerts@myscorr.com and we will verify your request another way.
You have 14 days to change your mind
We do not delete your account the moment you ask. Confirming the request schedules deletion for 14 days later and signs you out on every device. If you sign in to myScorr before that date, on any device, the deletion is cancelled automatically and your account carries on as before. Once the date passes, deletion runs and cannot be undone.
What we delete
- Your profile: name, date of birth, mobile number and email address.
- Your PAN and KYC records, including any PAN card image you uploaded, and the details our identity-verification partner returned for your mobile number.
- Every credit report and score we hold for you, and every report PDF — the credit bureau report and the myScorr Advanced Report.
- Your bank statement analyses.
- Your sign-in methods, your signed-in sessions and the device details recorded with them (device name and IP address), and any one-time codes sent to you.
- The bank account details you saved for referral payouts.
- Your referral code, which stops working.
You also lose anything still owed to you under the account: unused refreshes left on a plan (these are not refunded), and referral earnings not yet paid out — including a withdrawal you have requested that has not been paid, because the bank details it would be paid to are deleted.
What we keep, and why
Indian tax and accounting law requires us to keep records of the transactions made on the Platform, and a payment later queried with our payment partner has to be answerable. We therefore keep the following for eight financial years after the financial year in which the transaction took place, as the Companies Act, 2013 requires for a company’s books of account:
- Order and payment records: what was bought, the amount and any discount, when it was paid, and our payment partner's payment and bank references.
- Referral records: amounts credited and paid out, and for a payout, the last four digits and IFSC of the bank account it was sent to, so it can be matched against our own bank statements.
These records are kept with your name, mobile number, email address and payment handle (such as a UPI ID) removed, against an anonymous account record that holds no name or contact details. We use them only for accounting, tax, audit and payment-dispute purposes. If you joined through someone else’s referral, the reward they earned is theirs and is not reversed.
We also keep a record of the deletion request itself — when it was made and confirmed, and a masked form of the contact it was confirmed through (for example +91******0604) — as evidence that we honoured it.
Copies held elsewhere
- Residual copies in our encrypted database backups are removed as those backups expire, within 35 days.
- Our file storage keeps earlier versions of stored files as protection against accidental loss. When your account is deleted, your report PDFs and any PAN card image you uploaded are removed from active storage and can no longer be opened from the app, but earlier versions of those files remain in that storage and are not currently deleted automatically. They stay private and encrypted at rest, and you can ask us to erase them by writing to alerts@myscorr.com.
- App analytics and advertising measurement data already sent to Google and Meta from the Android app (Section 8) is held by them, linked to your device’s advertising ID and app installation rather than to your name or contact details, and is kept under their own retention policies. Deleting your myScorr account does not delete it; deleting your device’s advertising ID in your Android settings stops it being linked to anything new.
- Information already shared with our credit bureau partner, payment partner or other service providers under Section 6 is held by them under their own legal obligations. Deleting your myScorr account does not delete records they hold — for example, the record of an enquiry on your credit file stays with the bureau.
11. Your rights
- Access: request a copy of the personal information we hold about you.
- Correction: ask us to correct inaccurate or incomplete information.
- Deletion: delete your account and personal data yourself, in the app or at myscorr.com/delete-account (Section 10).
- Withdraw consent: withdraw consent for a future bureau pull or marketing communication at any time. Withdrawing consent does not affect processing already carried out on the basis of it.
- Nominate: nominate another person to exercise these rights on your behalf in the event of your death or incapacity.
- Grievance redressal: raise a complaint about how we handle your personal data with our Grievance Officer (Section 14). If you are not satisfied with our response, you may complain to the Data Protection Board of India.
To exercise any of these rights other than deletion, write to alerts@myscorr.com. We aim to respond within 30 days.
12. Children's privacy
The Platform is intended for use by individuals who are 18 years of age or older and legally capable of entering into a binding contract under Indian law. We do not knowingly collect personal information from anyone under 18.
13. Changes to this policy
We may update this Policy from time to time to reflect changes in our practices or applicable law. The "Last updated" date at the top of this page will reflect the most recent revision. Continued use of the Platform after an update constitutes your acceptance of the revised Policy.
14. Grievance officer & contact
If you have any concern about how your personal information is handled, or wish to exercise any of your rights under Section 11, please contact our Grievance Officer:
| Grievance Officer | Grievance Officer, Reachout Tech Private Limited |
|---|---|
| alerts@myscorr.com | |
| Address | 22, 4th Floor, 1st Main, Royal Placid, Haralur, HSR Layout, Bangalore South, Karnataka – 560102 |
How complaints are handled and escalated is set out on our Grievance Redressal page.
15. Governing law
This Policy is governed by the laws of India, and the courts at Bangalore, Karnataka shall have exclusive jurisdiction over any disputes arising from it.