What they may do · DPDP §6(4)
What TransUnion CIBIL does with your data
India's largest credit bureau. Its policy discloses Google Remarketing ads that follow you onto other sites, sharing with member lenders and partners, and a CICRA-mandated minimum 7-year retention of credit records that withdrawing consent does not clear.
-
Shares your data with partners
Passed to group companies, advertisers or analytics firms you never chose.
What this costs you. Your number and habits travel to companies you have never heard of and never agreed to. This is the step where the spam calls start.
Show me where they say that
TransUnion CIBIL’s own policy says “If and to the extent permissible under and subject to the applicable laws, TransUnion CIBIL may share your information with third parties (including not limited to its members and partners) for fulfilment of its functions under CICRA or activities ancillary thereto.”
Our summary discloses sharing with members and partners under CICRA, disclosure to companies performing functions on its behalf including data analysis and marketing assistance, supplying contact information to select third parties for marketing where the user indicates interest, and transfer to an acquirer on merger or sale.
-
Builds an advertising profile of you
They watch what you view, tap and buy, and use it to decide which ads you see.
What this costs you. Your attention gets priced. What you hesitate over becomes a bid — and a profile built to predict you is a profile built to persuade you.
Show me where they say that
TransUnion CIBIL’s own policy says “TransUnion CIBIL and third-party vendors, including Google, use first-party cookies (such as the Google Analytics cookie) and third-party cookies (such as the DoubleClick cookie) together to inform, optimize, and serve ads based on website visitors past visits to our website.”
Our summary states that first- and third-party cookies are combined to serve ads based on the visitor's past browsing of the site, and separately that it would use Google's interest-based advertising or third-party audience data such as age, gender and interests.
-
Follows you onto other websites and apps
Their tracking carries on after you leave, through pixels and SDKs embedded elsewhere.
What this costs you. You get recognised on sites that have nothing to do with them. Closing the app does not close the file.
Show me where they say that
TransUnion CIBIL’s own policy says “Remarketing is a feature that lets us reach people who have previously visited our site and show them relevant ads when they visit other sites on the Google Display Network.”
Our summary describes Google Adwords Remarketing dropping cookies on the visitor's device so that ads follow the visitor onto other websites after they leave, and separately says it observes which website you visited before arriving and where you go after you leave.
-
Keeps your records long-term
Held on after you stop using the service.
What this costs you. Years after you delete the app, the record is still sitting there — and every year it sits there is another year it can leak.
Show me where they say that
TransUnion CIBIL’s own policy says “However, as per the provisions of CICRA, we are required to retain credit information and personal data, as defined under CICRA, for a minimum period of 7 (seven) years from the date of collection.”
Our summary sets a statutory floor of seven years from collection for credit information and personal data as defined under CICRA, stated as a minimum with no stated maximum.
What the policy does not mention
These are uses TransUnion CIBIL’s policy is silent on. Silence is not a promise — it means the document does not say, and we do not infer either way.
- Processes your face or other biometrics
- Trains AI models on your content
TransUnion CIBIL is one app. How many are on your phone?
Most people carry twenty to forty. Add yours and see the total in one screen — how many share your data, profile you for ads, or follow you across the web. Then take it back from all of them at once.
Manage my data with Saaph.in →Free to check · no account needed · built in India for the DPDP Act
Questions
What does TransUnion CIBIL do with my personal data?
According to TransUnion CIBIL's own privacy policy, read on 2026-08-14, it discloses 4 of the six uses we track: shares your data with partners, builds an advertising profile of you, follows you onto other websites and apps, keeps your records long-term.
Can I withdraw my consent from TransUnion CIBIL?
Section 6(4) of India's Digital Personal Data Protection Act 2023 gives you the right to withdraw consent for processing you agreed to. The Act's substantive provisions commence in stages up to May 2027, so a request made now asks for voluntary compliance and puts the date on record. Processing a company carries out under a legal obligation — such as KYC records the RBI requires — cannot be withdrawn.
Does TransUnion CIBIL track me for advertising?
Yes — TransUnion CIBIL's published policy discloses this. The exact sentence it is based on is quoted on this page, with the date we read it and a link to the source.
Every use above is one TransUnion CIBIL declared in its own published privacy policy, which we
read on 2026-08-14. Quotes are verbatim; the summary beside each one is ours
and is labelled as ours. Nothing here is inferred.
Saaph.in is a DPDP consent and request management platform operated by Ronin Works
Private Limited. It is a communication facilitator, not your legal or authorised
representative. The DPDP Act 2023 commences in stages up to May 2027, so a request
made today asks for voluntary compliance and records the date you asked.
Our privacy policy