Customer privacy · Customer terms · Refunds · Partner privacy · Partner terms · Partner KYC

CraNau Partner App — KYC & Verification Consent

Last updated: 27 August 2026

Version: 2026-08-27

Operator / Data Fiduciary: CraNau India Private Limited (brand: CraNau)

Registered office: M.M. Choubey Ward, Behind Chaturvedi Complex, Katni, Madhya Pradesh 483501, India

Support / Privacy contact: support@cranau.com · Website: https://cranau.com

1. Scope and Purpose

1.1. This KYC & Verification Consent ("Consent") is a standalone notice and consent document for partners using the CraNau Partner mobile application and related onboarding services.

1.2. By ticking the consent checkbox, submitting verification details, or continuing partner onboarding, you provide free, specific, informed, unconditional, and unambiguous consent under the Digital Personal Data Protection Act, 2023 ("DPDP Act") for the identity, business, licence, and payout verification processes described below.

1.3. This Consent supplements and should be read with the CraNau Partner Terms of Service and Privacy Policy. In case of conflict regarding verification processing, this Consent prevails for KYC-specific matters.

1.4. This Consent applies to all partner categories: restaurant and food partners, online store partners (grocery, pharmacy, electronics, fashion, stationery), home services partners, ride partners, and delivery partners.

1.5. Checks actually run for your category are those shown on the Verify steps in the app (for example, FSSAI for food, Form 20/21 for pharmacy, DL/RC for rides and delivery). Unused category checks are not performed.

2. Consent to Verification Checks

2.1. You expressly authorize CraNau India Private Limited and its licensed, regulated verification partners to perform the following checks for onboarding, ongoing compliance, fraud prevention, payout risk management, and regulatory obligations:

2.1.1. Identity Verification

• Aadhaar OTP-based identity confirmation — verification of your identity through one-time password authentication linked to your Aadhaar, processed only through UIDAI-authorized Authentication User Agencies and licensed KYC service providers. CraNau does not store your Aadhaar number in plain text where masking or tokenization is available.

2.1.2. Tax and Business Registration

• PAN verification — validation of Permanent Account Number against authorized income tax databases;
• GSTIN validation — confirmation of Goods and Services Tax registration status, legal name, and registration state against GST Network or authorized data sources.

2.1.3. Sector-Specific Licences

• FSSAI licence validation — for restaurant and food partners, verification of Food Safety and Standards Authority of India licence number and status;
• Drug licence validation — for pharmacy partners, verification of Form 20 (sale licence) and/or Form 21 (wholesale licence) or equivalent state drug licences against authorized regulatory sources.

2.1.4. Financial Verification

• Bank account verification — confirmation of account holder name, account number, and IFSC through banking partners, Razorpay, or account validation services;
• UPI ID validation — where UPI is used for payouts, verification of UPI handle ownership where supported.

2.1.5. Transport and Delivery Verification (Where Applicable)

• Driving licence verification;
• Vehicle registration certificate (RC) verification;
• Insurance and permit validation for ride and delivery partners.

2.1.6. Additional Checks

• Politically exposed person ("PEP") and sanctions screening where required;
• Device fingerprinting, IP geolocation, and behavioural fraud signals;
• Photograph, selfie, or liveness check if enabled in the app;
• Re-verification upon licence renewal, bank change, or risk triggers.

2.2. You understand that verification outcomes (pass, fail, partial match, or manual review) are determined by third-party data sources and CraNau's risk policies.

2.3. You consent to CraNau performing these checks at onboarding and periodically thereafter during your partner relationship.

3. Personal Data Processed for Verification

3.1. Depending on your partner category and onboarding stage, we may collect and process the following personal data for verification:

3.2. Sensitive personal data, including financial and government-issued identity information, is processed with heightened security controls as described in Section 7.

3.3. We collect only data reasonably necessary for verification. Optional fields are marked in the app.

4. Purposes of Processing

4.1. Verification data is processed only for the following lawful purposes:

• Partner onboarding and account activation;
• Regulatory KYC, anti-money laundering ("AML"), and counter-terrorism financing ("CTF") compliance;
• Payout account setup, settlement, and payout fraud controls;
• Sector-specific licence compliance (food, pharmacy, transport);
• Detection, prevention, and investigation of fraud, impersonation, and identity theft;
• Dispute resolution, chargeback support, and lawful requests from authorities;
• Re-verification upon material account changes.

4.2. We do not use KYC data for unrelated marketing without separate consent.

5. Data Sharing with Licensed Partners

5.1. You consent to sharing verification data with the following categories of recipients, strictly on a need-to-know basis:

• Licensed KYC / Aadhaar Authentication User Agencies — for OTP-based identity verification;
• PAN, GSTIN, FSSAI, and drug licence validation service providers — for business and licence checks;
• Banking and payment partners (including Razorpay and partner banks) — for account verification and payouts;
• Cloud infrastructure providers (including Microsoft Azure) — for secure storage and processing under contractual safeguards;
• Law enforcement, regulators, and courts — when required by applicable law or valid legal process.

5.2. CraNau does not sell KYC data to data brokers, advertisers, or unrelated third parties.

5.3. Cross-border processing, if any, will comply with DPDP Act requirements and applicable government notifications on international transfers.

5.4. Verification partners are contractually required to process data only for authorized purposes and maintain appropriate security standards.

6. Retention and Deletion

6.1. CraNau retains verification records, consent logs, and audit metadata for durations required by:

• Payment and settlement regulations;
• AML/CTF and KYC record-keeping norms;
• Income Tax and GST laws;
• Food safety and pharmacy regulatory requirements;
• Limitation periods for disputes and legal claims;
• Fraud prevention and platform integrity.

6.2. Illustratively, KYC and financial verification records may be retained for five (5) to eight (8) years after account closure, or longer if mandated by a specific law or ongoing investigation.

6.3. Upon expiry of retention periods, data is securely deleted or anonymized unless further retention is required by law.

6.4. You may request erasure under the DPDP Act where permitted. Erasure requests may be declined where retention is legally required or necessary for pending payouts, disputes, or investigations.

7. Security Controls

7.1. CraNau applies reasonable security practices for verification data, including:

• Encryption in transit (TLS 1.2 or higher);
• Encryption at rest for sensitive payout and identity fields;
• Role-based access control with least-privilege principles;
• Audit logging of KYC access and modifications;
• Key management and periodic credential rotation;
• Vendor security assessments for verification partners.

7.2. You are responsible for securing your device, OTP messages, and login credentials during verification.

7.3. Report suspected unauthorized KYC activity to support@cranau.com immediately.

8. Your Declarations

8.1. By providing consent, you confirm and declare that:

8.1.1. All information and documents submitted are true, accurate, complete, and not misleading;

8.1.2. Documents belong to you or the business entity you are authorized to represent;

8.1.3. You have legal authority to provide business registrations, licences, bank account details, and signatory information;

8.1.4. You will not submit forged, altered, expired, or third-party documents without proper authorization;

8.1.5. For pharmacy partners, your Form 20/21 drug licences are valid and cover the medicines you intend to list;

8.1.6. For food partners, your FSSAI licence is valid and covers your operating location and business activity;

8.1.7. Bank account and UPI details provided are your own or your authorized business account, not a third-party personal account used to circumvent verification;

8.1.8. You will promptly update CraNau if any verification data changes, including licence renewals, change of bank account, or change of business ownership;

8.1.9. You understand that CraNau relies on your declarations and third-party data sources to make onboarding decisions.

9. Consequences of Failed, Incomplete, or False Verification

9.1. CraNau may pause, reject, suspend, or terminate onboarding or your partner account if:

• Verification checks fail or return inconsistent results;
• Information appears forged, tampered, or belonging to another person or entity;
• Licences are expired, revoked, or do not match your stated business category;
• Bank account name does not reasonably match your verified identity or business name;
• You refuse to complete required verification steps;
• Re-verification is not completed within requested timelines;
• Fraud signals or regulatory flags are triggered.

9.2. Consequences may include:

• Onboarding fee forfeiture where permitted by Terms of Service and law;
• Payout holds or permanent payout disablement;
• Order assignment suspension;
• Delisting from the marketplace;
• Forfeiture or adjustment of delivery partner security deposit for proven misconduct;
• Reporting to law enforcement, FSSAI, drug control authorities, tax authorities, or payment regulators where required by law;
• Civil or criminal liability under applicable Indian law for false declarations or document forgery.

9.3. CraNau is not obligated to disclose internal fraud detection methodologies that could compromise platform security.

10. Withdrawal of Consent

10.1. You may withdraw this Consent at any time by emailing support@cranau.com or through in-app account settings where available.

10.2. Withdrawal of KYC Consent will prevent new verification and may result in immediate suspension of payouts and partner services because CraNau cannot lawfully operate your account without completed verification.

10.3. Withdrawal does not affect the lawfulness of processing performed before withdrawal or retention of records required by law.

11. Your Rights

11.1. Under the DPDP Act, you have the right to access, correct, and request erasure of your personal data subject to legal exceptions.

11.2. To exercise rights, contact support@cranau.com with your registered mobile number and partner ID.

11.3. For grievances, contact our Grievance Officer at support@cranau.com. We will acknowledge within forty-eight (48) hours where required and endeavour to resolve within fifteen (15) days. Unresolved complaints may be escalated to the Data Protection Board of India under the DPDP Act framework.

12. Updates to This Consent

12.1. CraNau may update this Consent to reflect legal, regulatory, or product changes (including a change from Aadhaar OTP to another UIDAI-authorized method such as DigiLocker, if enabled in a later app version).

12.2. Material changes will be notified through the Partner App or email. Continued onboarding or use after the effective date may require re-acceptance.

13. Contact

For verification, consent, or privacy questions:

CraNau India Private Limited Email: support@cranau.com Registered office: M.M. Choubey Ward, Behind Chaturvedi Complex, Katni, Madhya Pradesh 483501, India Website: https://cranau.com

14. Acknowledgement

By selecting "I agree", submitting verification documents, or completing Aadhaar OTP verification in the CraNau Partner App, you confirm that:

• You have read and understood this KYC & Verification Consent in full;
• You voluntarily provide consent for all verification checks and data processing described herein that apply to your partner category;
• Your declarations in Section 8 are true and binding;
• You accept the consequences described in Section 9 for false or failed verification.

CraNau Partner App — KYC & Verification Consent · Version 27 August 2026