A China-based loan app exposed millions of Indians’ data in an unsecured server