Privacy policy

1. Who we are, and what we are not

BZi Growth is a technology and origination platform for invoice finance. We act as a Lending Service Provider to banks and NBFCs.

We are not a lender and we are not a regulated financial institution. We hold no RBI licence or registration and need none in this role - the lender holds the licence and makes every credit decision. We are not a participant in any TReDS exchange.

For the personal data you give us through this platform we are the Data Fiduciary under the Digital Personal Data Protection Act, 2023. For the lending decision itself the bank or NBFC is the fiduciary, and their policy applies alongside this one.

2. The lawful basis we rely on

Mostly your consent, given when you create an account or submit an invoice. For a narrower set of processing we rely on the Act’s legitimate uses - meeting a legal obligation, and data you have voluntarily provided for a specific purpose.

Consent is asked for in plain language, separately from the terms of use, and is specific to the purposes listed below. We do not treat continued use of the site as consent.

3. What we collect, and why

Each purpose below is the reason we hold that data. We do not collect anything for a purpose that is not on this list.

If you are a supplier

• Business identity - name, GST number, Udyam registration, PAN, registered address. To verify you exist and are eligible.
• People who use the account - name, email, mobile, role. To let you sign in, and to tell you what is happening to your invoices.
• Bank account for payouts, verified by a one-rupee credit. To make sure money reaches you and not someone else.
• Invoices, purchase orders and delivery evidence. This is the asset being financed.
• Data fetched from government sources - GST filing status, e-invoice references, e-way bills. To confirm the invoice is genuine.
• Bank statements provided at onboarding. For the lender’s credit assessment.

If you are a buyer

• Company name, sector and turnover band
• The contact who confirms invoices, and their confirmation decisions
• How promptly you have paid the suppliers financed through us

We do not ask a buyer for bank statements, balances or financial records - you are not borrowing. There is one exception, and it is entirely in your hands: a financier considering a specific invoice may ask you for a specific document, and must say why. You can refuse. Refusing does not affect your account, your suppliers, or anything else on this platform - the lender is simply told you declined and decides on the invoice without it. We never pass on a document you have not chosen to give. What a financier can and cannot see about you is set out in full here.

Everyone

• Technical logs needed to run and secure the service
• A record of what happened and who did it, for audit

The public pages, including the calculator, need no account. Using the calculator does not create a record of you, and we do not ask for a phone number in exchange for a number.

4. Who we share it with

• Lenders - only those holding an approved limit on you, and only for an invoice you have submitted.
• Your buyer - the invoice details we ask them to confirm, which they already hold.
• Registry verification providers - named, because “third parties” is not a disclosure. When you apply we send the identifiers you gave us to these services to check them against the public registers, and nothing more than the identifier each one needs:
  • Sandbox (API Sandbox, India) - your PAN with the name and date of incorporation it should match, your GSTIN, and your CIN. Used to confirm the PAN is valid and belongs to you, that the GST registration is active, whether returns have been filed, and the company’s status with the MCA.
  • FileSure (India) - your CIN, and the DIN of each director it returns. Used to read the company’s public MCA record: directors, key managerial personnel, registered charges and the date of the last filed accounts.
  Both receive identifiers that are already on public registers. Neither receives your documents, your bank details, your invoices or anything about your customers. We pay them per lookup; they are not paid in data and we receive nothing for sending it.
• CERSAI and GST Suvidha Providers - not in use today. When either goes live we will say so here before it does, not afterwards.
• Infrastructure providers - hosting, email and storage, acting as Data Processors under contract and only on our instructions.
• Meeting scheduling - if you book a meeting from our contact page, Cal.com receives your name, email address and anything you write in the booking, to arrange it.
• Regulators, auditors and courts - where we are legally required to.

We do not sell your data. We do not share it for anyone else’s marketing, and we do not build a separate credit product out of it.

5. Where it is stored

On servers located in India. If we ever transfer personal data outside India we will do so only to countries not restricted by the Central Government, under contractual safeguards, and we will say so here before it happens.

6. How long we keep it

• Transaction and KYC records - eight years after the facility closes, which is what tax and anti-money-laundering rules require of our partners.
• Documents for an invoice that was never financed - twelve months.
• Technical logs - twelve months.
• Marketing contact details - until you ask us to stop, then deleted.

When a purpose has been served and no legal obligation requires us to keep the data, we erase it. Closing your account does not shorten the periods above, because they are not ours to waive.

7. Your rights

Under the DPDP Act you may:

• Ask what we hold about you, and who we have shared it with
• Have it corrected if it is wrong, incomplete or out of date
• Have it erased where no legal obligation requires us to keep it
• Withdraw consent at any time, as easily as you gave it. Withdrawal does not undo processing already carried out, and may mean we can no longer offer you the service
• Nominate someone to exercise these rights if you die or become incapacitated
• Complain to us, and then to the Data Protection Board of India

Ask through the grievance officer. We reply within the statutory timeline, and if we refuse a request we will tell you which obligation we are relying on rather than simply declining.

8. Security

Access is scoped on the server, per organisation and per role - a financier without a limit on a supplier cannot load that supplier’s deal at all, rather than merely being shown no link to it. Passwords and one-time sign-in codes are stored hashed, never in readable form. Every state change is written to an append-only audit log recording who did it and when.

If a breach occurs that affects your data, we will notify you and the Data Protection Board of India as the Act requires.

9. Cookies

Two cookies, both strictly necessary, both set by us and readable only by our server (httpOnly), so no script on the page - ours or anyone else’s - can read them:

• bzigrowth_session - keeps you signed in. It holds a signed token identifying your account and nothing else. It expires after 30 minutes of inactivity on staff and lender screens, 12 hours on supplier and buyer screens, and in every case no more than 12 hours after you signed in, however active you are.
• bzigrowth_signup_email - set only during sign-up, after you enter the code we email you, so the form knows the address is yours. It lasts 60 minutes, is limited to the sign-up pages, and is deleted the moment your account is created.

That is the complete list. There is no advertising network, no third-party analytics, no pixel, no fingerprinting and no cross-site tracking anywhere on this site. Nothing here is used to profile you or to follow you elsewhere.

That is why there is no cookie banner. Consent is required for cookies that are not necessary to provide a service you asked for; a banner offering you a choice we do not in fact make would be theatre. If we ever add a cookie that is not strictly necessary, we will ask you first, it will be off until you say yes, and saying no will cost you nothing.

9a. Consent, and taking it back

The processing described above runs on the consent you gave when you opened the account. You saw the specific purposes, ticked them yourself, and we store which version of that wording you agreed to and when, so there is a record of what you actually consented to rather than what the page says today.

Marketing email is separate and always was. It has its own box, it is never bundled into the required declarations, refusing it has no effect on your application, and every such email carries a one-click unsubscribe.

You can withdraw consent at any time by writing to support@bzigrowth.com. Withdrawing it stops further processing; it cannot undo what has already lawfully happened, and where we are required by law to keep a record - an audit trail, a completed transaction - we keep that and nothing else. If withdrawing means we can no longer run the service for you, we will tell you plainly rather than letting the account quietly stop working.

10. Children

This is a service for registered businesses. We do not knowingly process the personal data of anyone under 18, and no part of this platform is directed at children.

11. Changes

If we change this policy in a way that affects what we do with data we already hold, we will tell you directly rather than quietly reposting the page.