PSL Phone Se Loan
Business X-Ray
Enter the access code to continue
Demonstration access gate — not a substitute for authenticated login.
Phone Se Loan Terms & Consent ● BUSINESS X-RAY Business X-Ray · information capture by the Mitra · DPDP 2023 · RBI Digital Lending · Account Aggregator

Terms & Consent — Business X-Ray information capture

These terms govern the on-site capture of photographs and business information by an authorised field agent (the “Mitra”) for a first-pass, human-supervised credit assessment (“Business X-Ray”). Capture only begins after the customer has consented and both the Mitra and the customer have verified their identity by one-time password (OTP).

Plain-language summary. We take photos of your business premises and read a few figures from them to estimate your business activity. You decide whether to allow it. We collect only what is needed, blur faces and number plates, keep it secure, use it only for your loan assessment, and you can withdraw your consent. A human — not a model — makes the final lending decision.

1. Who is involved

Litehouse / Phone Se Loan (the “Platform”) provides the Business X-Ray assessment. The Mitra is the Platform’s authorised field agent who performs the capture on-site. The Customer is the business owner (or authorised representative) whose premises are captured.

2. What is captured

  • Live photographs of the business premises (exterior, interior, stock, signage, meters, and — where relevant — documents such as GST board, licence, invoices).
  • Figures read from those photographs (e.g. GSTIN, UPI/QR identifier, utility consumer number, sample prices/amounts) to estimate turnover and working capital.
  • Location (GPS) of the capture, a timestamp, and the Mitra-marked business boundary (geofence).

All photographs are live-captured using the camera only (no gallery uploads), in a single session, from inside the same establishment. Faces and vehicle number plates are cropped before a frame enters the assessment.

3. Consent (DPDP Act 2023)

Under the Digital Personal Data Protection Act, 2023, the Customer’s consent is free, specific, informed, unconditional and unambiguous, given by a clear affirmative action. Before capture, the Customer records consent in the app and both parties verify by OTP. Consent is recorded with the date, time, the mobile numbers used, and the business profile selected.

Consent is limited to the purpose in Section 4. The Customer may withdraw consent at any time (see Section 8); withdrawal does not affect processing already carried out lawfully before withdrawal.

4. Purpose & purpose limitation

The information is used solely to produce an auditable, first-pass estimate of the business’s financial activity to support a credit assessment, and to verify the capture’s integrity (that it was taken on-site, in-session, within the marked boundary). It is not used for any unrelated purpose, and it is not sold.

5. Data minimisation & accuracy

Only information necessary for the assessment is collected. Figures read by the on-device model are shown to the Mitra and confirmed or corrected by a human before use; every read and edit is logged. Outputs are illustrative rule-engine estimates, not a validated credit score.

6. Regulatory framework

  • DPDP Act 2023 — consent, purpose limitation, data-principal rights, security safeguards.
  • RBI Digital Lending Guidelines — need-based data collection, transparency, auditability and explainability; no automatic credit decision without human oversight.
  • Account Aggregator (AA) framework & RBI Master Direction — any consented pull of GST / bank-statement / utility data follows the AA consent architecture.

7. Identity verification — dual OTP

Before capture, the Platform sends two different one-time passwords over SMS — one to the Mitra’s registered mobile and one to the Customer’s mobile — simultaneously. Both must be entered together to start the Business X-Ray. This proves the Mitra is authorised and that the Customer is present and consenting. In the current sandbox environment the OTPs are simulated in-app; in production they are delivered over DLT-registered SMS and are never displayed on screen.

8. Customer rights

  • Access & correction of the information captured about the business.
  • Withdrawal of consent and erasure of personal data no longer required, subject to lawful retention obligations.
  • Grievance redressal — the Customer may contact the Platform’s Grievance Officer; a nomination may be exercised as provided under the DPDP Act.

9. Storage, security & retention

Information is stored securely with access controls and is retained only as long as necessary for the assessment and applicable legal/regulatory requirements, after which it is deleted or anonymised. Nothing is uploaded from the device during the on-device read step; transfers to the Platform occur over secured channels.

10. Human-only lending decision

The Business X-Ray extracts and recommends; it does not sanction or disburse. Any loan approval and disbursement is made by a human underwriter on independently verified repayment capacity. The indicative review band is a policy overlay, not a sanction.

This page is a configurable template for demonstration and must be reviewed and finalised by the Platform’s legal counsel and Data Protection Officer before production use. It does not constitute legal advice. Sandbox environment: OTP delivery is simulated.