Privacy Policy

Last Updated: 15 October 2026

Creddio ("we", "us", "our") operates the website creddio.in. This Privacy Policy explains what personal data we collect, why we collect it, how we use and protect it, who we share it with, and the rights available to you under the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025.

By using Creddio, you agree to the practices described in this Policy. If you do not agree, please do not use our website or submit your information to us.

1. Who We Are

Creddio is an automotive technology and deal-facilitation platform for car buyers and car sellers in India:

• For Buyers: We help you find competitive new car offers from authorised dealerships without having to visit or negotiate with each dealer individually.
• For Sellers: We provide instant algorithmic fair market valuations and coordinate free doorstep evaluations through certified vehicle-buying partner networks.

Legal entity: Creddio Platforms (OPC) Private Limited
Registered address: Kochi, Kerala, India
Contact for privacy queries: hello@creddio.in

Under DPDP Law, Creddio acts as a Data Fiduciary - we determine the purpose and means of processing your personal data.

2. What Personal Data We Collect

We collect only what is necessary to provide our services. Depending on how you interact with us, this may include:

2.1 When you submit a New Car Buying enquiry

• Name
• Email address
• Phone number
• City and State
• Car model / category of interest
• Budget range
• Purchase timeline
• Exchange / trade-in interest

2.2 When you submit a Sell Car valuation & doorstep inspection request

• Contact Details: Full Name, 10-digit Mobile Number, City / Locality / Pincode.
• Vehicle Data: Registration Year, Brand, Model, Variant, Fuel Type, Transmission, Kilometers Driven, Ownership Count, and State/City of Registration.

2.3 When you contact us

• Name
• Email address
• Your message

2.4 When you report a bug

• Category of issue and description
• Your email address
• The page URL where the issue occurred
• Your browser/device user-agent string

2.5 When you subscribe to our Newsletter

• Name (First name, Last name)
• Email address
• Timestamp of subscription and consent confirmation

2.6 Security & Bot Verification Signals (Cloudflare Turnstile)

When you browse our website or submit forms (such as new car purchase enquiries, sell car valuation & inspection requests, contact messages, newsletter subscriptions, or bug reports), we use Cloudflare Turnstile (including its invisible mode) and Cloudflare's Challenge Platform to distinguish genuine human visitors from automated bots and abusive scripts. For this purpose, Cloudflare Turnstile processes minimal client-side signals ("Signals"), including:

• Client IP address
• TLS Fingerprint
• HTTP User-Agent Header
• Turnstile Sitekey and associated origin domain
• Browser and device interaction characteristics

Cloudflare does not have the ability to directly identify any individuals from any of the Signals Turnstile collects, including IP addresses.

2.7 Automatically collected technical and analytics data

• Basic technical data such as browser type, device type, screen dimensions, operating system, and general usage patterns via standard web analytics, to help us understand site performance. We do not use this data to build advertising profiles of individual users.

We do not knowingly collect sensitive personal data such as financial account numbers, government ID numbers, health data, or biometric data through these forms. Please do not include such information in free-text fields.

3. Why We Collect Your Data

We process your personal data strictly for the following purposes, and no others, unless we ask for your fresh consent:

We do not sell your personal data to any third party. We do not share your data with dealers or partners for any purpose other than facilitating the specific enquiry or evaluation you requested.

4. Your Consent

By submitting any form on Creddio, you give your explicit, informed consent for us to process your personal data for the purpose stated at the point of collection, in line with Rule 3 of the DPDP Rules, 2025.

• Consent is collected through a clear checkbox or affirmative action at each form - it is never pre-ticked or assumed.
• You may withdraw your consent at any time, with the same ease with which it was given, by emailing hello@creddio.in. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
• If you withdraw consent, we will stop further processing and instruct our processors and partners (see Section 6) to do the same, except where we are legally required to retain certain records (see Section 7).

Age requirement: Creddio is intended for use by individuals who are 18 years of age or older. We do not knowingly collect personal data from children. If you believe a child has submitted data to us, please contact us at hello@creddio.in and we will delete it.

5. How We Store Your Data

We take reasonable security safeguards appropriate to the sensitivity of this data, in line with Rule 6 of the DPDP Rules, including:

• Restricted, role-based access to our CRM, spreadsheets, and backend scripts - only authorised personnel can view lead and contact data.
• Secure transmission (HTTPS / TLS encryption) for all data submitted through our forms.
• Automated bot defense, rate-limiting, and verification powered by Cloudflare Turnstile to protect form submission endpoints against fraudulent automated submissions.
• Access logging and periodic review to detect unauthorised access.
• Regular backups to ensure data is not lost.
• Contractual security obligations placed on any processor that handles data on our behalf.

6. Who We Share Your Data With

6.1 Authorised Dealers (New Car Buyers) - Two-Stage, Gated Disclosure

• Stage 1 (Sourcing offers): We share only your car requirement with authorised dealers. Dealers do not receive your contact details at this stage.
• Stage 2 (Accepting an offer): Once you choose to proceed with a specific deal, we share your contact details with that one dealer only.

6.2 Certified Car-Buying Partners (Sell-Car Program)

When you request a doorstep evaluation or competitive quote to sell your vehicle, Creddio shares your contact info (Name, Phone, City) and vehicle specifications with verified vehicle-buying partner platforms for the sole purpose of scheduling your doorstep evaluation, conducting physical condition grading, and presenting genuine purchase quotes as described in our Partner Evaluation Policy.

6.3 Service Providers

We use trusted third-party service providers to host, secure, and operate our platform: Zoho CRM, Netlify, Supabase, Cloudflare, Google Workspace, and WhatsApp Business.

• Cloudflare, Inc. (Cloudflare Turnstile): We use Cloudflare for content delivery, domain routing, and Cloudflare Turnstile (including invisible mode) along with Cloudflare's Challenge Platform to protect our website from malicious bots and automated abuse. Cloudflare acts as a data processor on our behalf when evaluating Signals to protect our website, and as an independent data controller when processing Signals to maintain and improve Turnstile's bot detection capabilities. (See Section 10 for complete details.)

6.4 Legal Requirements

We may disclose your data if required to do so by law, regulation, legal process, or a lawful request from a government authority.

6.5 What We Do Not Do

We do not sell, rent, or trade your personal data to third parties for unrelated advertising or marketing purposes.

7. How Long We Keep Your Data

We retain personal data only for as long as necessary to fulfil the purpose it was collected for, or as required by law:

• Lead form data: Retained for as long as needed to facilitate your enquiry and any follow-up with dealers, and thereafter for a limited period to allow you to reopen or reference your enquiry, unless you request earlier deletion.
• Contact Us / Bug reports: Retained for as long as needed to resolve your query or the issue reported.
• We will inform you before erasing your data where required by law, giving you the opportunity to re-engage if you still wish to use our services.
• Certain data may be retained for longer where required to comply with applicable law, resolve disputes, or enforce our agreements.

8. Your Rights as a Data Principal

Under the DPDP Act and Rules, you have the right to:

1. Access - Request a summary of the personal data we hold about you and the processing activities we carry out.
2. Correction & Updating - Request that we correct inaccurate or incomplete personal data.
3. Erasure - Request that we delete your personal data, where retention is not otherwise required by law.
4. Withdraw Consent - Withdraw your consent to processing at any time (see Section 4).
5. Grievance Redressal - Raise a complaint with us about how your data has been handled.
6. Nominate - Nominate another individual to exercise your rights on your behalf, in the event of your death or incapacity, in accordance with our terms of service.
7. Complain to the Data Protection Board of India - If you are not satisfied with our response, you may escalate your complaint to the Board.

To exercise any of these rights, email us at hello@creddio.in with your name, the email/phone number used in your original submission, and a description of your request. We will respond within a reasonable period, and in any case within 90 days, as required under Rule 14.

9. Cookies and Tracking

Creddio may use essential cookies and similar technologies necessary for the website to function. We may also use basic analytics tools to understand site traffic. We do not use cookies to build cross-site advertising profiles. You can control cookies through your browser settings; disabling essential cookies may affect site functionality.

Security and Bot Detection Signals: The Signals and cookies utilized by Cloudflare Turnstile are strictly necessary for the purpose of detecting and blocking malicious bots and ensuring all visitors enjoy a safe and secure experience when interacting with our forms and web pages.

10. Cloudflare Turnstile & Bot Protection (Turnstile Privacy Addendum)

As a condition of enabling invisible mode on our web properties and forms, we reference and incorporate Cloudflare's Turnstile Privacy Addendum into our Privacy Policy.

Creddio uses Cloudflare Turnstile and Cloudflare's Challenge Platform, developed by Cloudflare, Inc. ("Cloudflare"), as a pro-privacy website security tool. Turnstile processes minimal Signals solely to protect our web properties against malicious activity by distinguishing human users from bots and blocking bot traffic.

10.1 Scope of the Addendum

Cloudflare's Turnstile Privacy Addendum is supplemental to Cloudflare's main Privacy Policy and provides additional information specific to your use and interaction with Turnstile and the Challenge Platform on our website. The Cloudflare Privacy Policy continues to apply to your interaction with Turnstile, except where the Turnstile Addendum provides more specific information, in which case the more specific information applies.

10.2 Information Collected

Cloudflare Turnstile processes a variety of client-side signals ("Signals"), including:

• Client IP address
• TLS Fingerprint
• User-Agent Header
• Sitekey and associated origin domain
• Device and browser interaction characteristics

Cloudflare does not have the ability to directly identify any individuals from any of the Signals Turnstile collects, including IP addresses.

10.3 How Information Is Used & Roles of the Parties

(i) Bot detection and blocking (Cloudflare as Data Processor):
Turnstile protects web properties by distinguishing human users from bots and blocking detected bot traffic that could otherwise harm the safety, availability, and security of the website. It does so by evaluating the Signals listed above specific to both the website visitor and the website visited. The purpose of collecting these Signals is not to identify, profile, or target any individuals, but solely to detect and block bots. The Signals collected by Turnstile are strictly necessary for this purpose (i.e., detecting and blocking bots to enable visitors to enjoy a safe and secure experience when visiting websites that have implemented Turnstile).

Cloudflare is a data processor of Signals processed to provide the Turnstile service to Creddio (securing our website). This means Cloudflare processes Signals for this purpose on behalf of, and pursuant to instructions issued by, Creddio (who is the data controller / fiduciary of any data processed for this purpose). If you have questions or wish to exercise any data protection rights regarding the processing of Turnstile data to provide our service, please contact Creddio at hello@creddio.in.

(ii) Improving Turnstile's bot detection capabilities (Cloudflare as Data Controller):
Cloudflare also processes the Signals described in this notice to improve Turnstile. This is necessary to refine and improve bot detection algorithms in order to respond to evolving bot threats and maintain the security of web properties that visitors choose to visit.

Cloudflare is an independent data controller of Signals processed to improve Turnstile's bot detection capabilities. Cloudflare's Turnstile Privacy Addendum (in conjunction with Cloudflare's main Privacy Policy) governs Cloudflare's processing of Signals for this purpose.

10.4 Notice to EU, UK, and Global Residents

To the extent that the data described in the Turnstile Privacy Notice qualifies as personal data, then:

• When processing this personal data as a processor to protect our website, Creddio, as controller, determines the lawful basis of this processing (our legitimate interests in protecting our website, infrastructure, and visitors from abuse and automated attacks), and Cloudflare processes this data under our instruction and on our behalf; and
• When processing this personal data as an independent controller, Cloudflare relies on its legitimate interests in improving the effectiveness of Turnstile's bot detection capabilities to process this Turnstile data.

10.5 Cookies and Local Storage

The Signals collected by Turnstile are strictly necessary for the purpose of detecting and blocking bots to enable visitors to enjoy a safe and secure experience when visiting websites that have implemented Turnstile. For more information about the cookies used by Cloudflare, please check the Cloudflare Cookie Policy and Cloudflare Turnstile Developer Documentation.

11. Children's Data

Our services are intended for adults seeking to purchase a vehicle. We do not knowingly market to or collect data from children. Where we become aware that a child's data has been submitted without appropriate parental consent, we will delete it promptly upon becoming aware.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. The "Last Updated" date at the top of this page will reflect the most recent revision. Material changes will be communicated through a notice on our website. Continued use of Creddio after changes take effect constitutes acceptance of the updated Policy.

13. Grievance Officer / Contact Information

In accordance with Rule 9 of the DPDP Rules, 2025, the following contact is available to answer any questions about how your personal data is processed, and to receive grievances:

Business Contact for Data Protection Queries
Email: hello@creddio.in
Website: https://creddio.in

We aim to acknowledge all privacy-related queries promptly and resolve them within a reasonable period, not exceeding 90 days.

14. Governing Law

This Privacy Policy is governed by the laws of India, including the Digital Personal Data Protection Act, 2023, the Digital Personal Data Protection Rules, 2025, the Information Technology Act, 2000, and other applicable Indian laws.