Privacy Policy

Last updated: 8 October 2026

trustRate is built and operated by House of BumbleBees Technologies LLP ("trustRate", "we", "us"). This policy explains what information we collect from you, why we collect it, who we share it with, and what choices you have — written in plain language, not legal filler.

1. What trustRate actually is

trustRate is a platform where businesses and individuals extend trade credit to each other — goods, money, or services given now, paid for later — and both sides confirm how repayment actually went. That confirmed history builds a trustRate rating: a behavioural reliability signal, not a line of credit, not a loan, and not a government-recognised credit bureau record. trustRate never lends money itself and is never a party to any agreement you make with another user.

2. Information we collect

We collect only what the product actually needs to work. Specifically:

• Account details — your name, mobile number, a username you choose, and a PIN (stored as a one-way cryptographic hash — we never see or store your PIN in plain text).
• Identity verification data — to confirm you are a real person before you can transact, we verify your Aadhaar and PAN through a licensed verification partner. We never store your raw Aadhaar number, anywhere — not in our database, not in our logs, not in backups. We keep only a one-way cryptographic hash (used solely to detect the same identity re-registering under a different mobile number) and a masked reference (for example, the last four digits of your PAN). The hash cannot be reversed back into your Aadhaar number.
• Business details — if you register a business, we collect your GSTIN or company CIN and verify it against the relevant government registry (GST or MCA). For companies, we also record the directors linked to that company.
• Transaction and repayment data — the agreements you create or accept, their amounts and due dates, and the repayment record (on time, late, settled, disputed) that your trustRate rating is built from. This is the core data this product exists to track, and it is visible to counterparties by design — see section 4.
• Documents you upload — invoices, purchase orders, delivery receipts, payment proof screenshots, trademark certificates, and similar documents you attach to an agreement or a verification request. These are stored in a private file store and are never public by default.
• Device and usage data — your IP address at signup (used only to help detect coordinated fraud, such as many accounts created from the same source), and basic session information needed to keep you logged in securely.
• Communications — your mobile number is shared with our SMS/WhatsApp provider solely to deliver one-time passwords and account notifications.

3. Why we collect it

• To create and secure your account, and to prove you are who you say you are before you can transact.
• To let you create, accept, and settle trade-credit agreements with other users.
• To calculate your trustRate rating from your own real, confirmed repayment history.
• To detect and act on fraud, collusion, and fake agreements between accounts.
• To calculate and collect the commission fee due on a settled agreement.
• To respond to support requests and legal obligations.

We do not use your data for advertising, and we do not sell your personal data to anyone.

4. What's visible to other users — read this carefully

trustRate is, by design, a credit-reference-style platform: your trustRate rating, your verified business details (such as a verified GSTIN/CIN and registered legal name), and a summary of your repayment record are visible to other users who deal with you or who look up your profile before extending you credit. This is the entire point of the product — it would not work as a trust signal if it were fully private, the same way a reference letter only works if the person checking it can actually read it. We do not show your raw Aadhaar, PAN, or your full address to a stranger — only what a genuine counterparty reasonably needs to decide whether to trust you.

5. Who we share information with

• Identity verification partners (currently Surepass) — to verify your Aadhaar/PAN and, for businesses, your GSTIN/CIN against the relevant government database. They receive only what's needed to run that specific check.
• SMS/WhatsApp delivery partner (currently MSG91) — your mobile number, solely to deliver OTPs and account notifications.
• Chartered Accountants on our review network — if you submit a document for CA review (for example, a trademark certificate or a GST-turnover declaration), the reviewing CA sees only that document and the business facts it concerns. They are never shown your personal mobile number or any other way to contact you directly.
• Law enforcement or regulators — only where we are legally required to disclose information, and only to the extent required.

We never sell your personal data to third parties, and we never share it for marketing purposes.

6. How we protect your data

• Raw Aadhaar numbers are never stored — only an irreversible one-way hash and a masked reference.
• Your PIN is hashed with a per-account random salt; we cannot read it back, ever.
• API keys and other secrets are encrypted at rest, not stored in plain text.
• Every database table enforces row-level access control, independent of application-level checks.
• Session cookies are set to reject cross-site use, reducing the risk of session hijacking.

7. How long we keep your data, and account deletion

You can delete your account at any time from your profile (or, on mobile, from Account & Security), as long as you have no active agreement — pending, confirmed, overdue, or disputed — with any other user. Once you delete your account, we anonymise your personal details (your name, username, GSTIN, and mobile number are replaced; your real Aadhaar-derived name and references are cleared) rather than deleting the row outright. We do this because a settled agreement is also part of someone else's trust record, and removing it entirely would corrupt their own history of a deal that genuinely happened. The one thing we keep indefinitely, even after deletion, is the one-way Aadhaar hash itself — this cannot be turned back into your Aadhaar number, and we keep it only to stop the same identity from quietly re-registering after being banned for serious wrongdoing.

8. Your rights

Under India's Digital Personal Data Protection Act, you have the right to:

• Know what personal data we hold about you — your dashboard already shows most of it directly.
• Request a copy of your transaction data (CSV export is available from your dashboard).
• Request correction of inaccurate personal data.
• Withdraw consent and delete your account, subject to the active-agreement limitation in section 7.
• Raise a grievance with our Grievance Officer (contact details below).

9. Children

trustRate is a platform for entering real credit agreements and is not intended for anyone under 18. We do not knowingly collect data from minors.

10. Changes to this policy

If we make a material change to this policy, we'll update the date at the top and, where the change is significant, notify you in-app.

11. Contact us / Grievance Officer

For any privacy question, correction request, or grievance, write to privacy@trustrate.club.