About this policy

1. This policy explains how Finspring Innovations Private Limited (CIN U62099KA2024PTC195770) (“Finspring”, “we”, “us”) collects and uses your personal data when you use our mobile app and website (the “Platform”). We are the “Data Fiduciary” for this data under the Digital Personal Data Protection Act, 2023 (“DPDP Act”). Our registered office is at WeWork Embassy Tech Village, Block L, Outer Ring Road, Bengaluru – 560103, Karnataka, India.
2. It is published under the DPDP Act and the Information Technology Act, 2000 and rules under it. It does not cover a Product Partner’s own platform; its privacy policy applies there. If you reached a Product through another company’s app that uses Finspring’s technology, that company’s privacy policy governs your data in its app, and we process data for it as its service provider.
3. You must be 18 or older to use the Platform. If you do not agree with this policy, please do not use the Platform.
4. “Products” and “Product Partners” have the meanings given in our Terms and Conditions: Products are the financial products offered on the Platform, and Product Partners are the banks, NBFCs, asset management companies, online bond platform providers, bullion providers and similar entities that issue or provide them.

What we collect

5. We collect the following personal data:

   Type	Examples
   Identity and contact	Name, mobile number, email, date of birth, address
   Account and KYC	PAN, photograph, identity and address proof, and KYC verification status and details that we receive from our Product Partners, KYC registration agencies or verification providers. For bonds and fixed deposits, KYC documents are submitted on the Product Partner’s own flow, not to us. For mutual funds, KYC is handled through our transaction-infrastructure partner. For digital gold, KYC is completed on the Bullion Partner’s platform. Where Aadhaar is used, it is used only as the law permits, and we do not store your full Aadhaar number unless the law allows.
   Financial and transaction	Bank account details needed for a transaction, and your investments and transaction history through the Platform
   Device and usage	Device identifiers, IP address, operating system, app version, crash and diagnostic logs, and how you use the Platform
   Support	Your messages and calls with our support team
   Permissions	Location, notifications or similar device permissions, only if you grant them

6. We collect this from you directly, automatically through your use of the Platform, and from Product Partners and verification providers in connection with your transactions.

Why we use it

7. We use your personal data to:
   1. create and manage your account, and verify your identity;
   2. enable you to discover, buy and track Products with Product Partners;
   3. provide customer support and handle grievances;
   4. prevent, detect and investigate fraud, money laundering and other unlawful activity;
   5. comply with law, including reporting obligations;
   6. operate, secure, analyse and improve the Platform, including personalising what we show you; and
   7. tell you about other Products and features from Finspring that may interest you, which you may switch off at any time (see clause 9).
8. We do not sell your personal data. We do not use your name, mobile number, email address, PAN, KYC documents, bank details or other information that directly identifies you to train AI or machine-learning models. We may use information that has been de-identified or aggregated so that it does not identify you (for example age group, approximate location, transaction timing and app-usage patterns) to analyse, improve and train our models, features and recommendations.

Basis for processing

9. We rely on your consent, which you give by accepting this policy and the Terms at sign-up and, where asked, at specific points in the app. When you choose a Product, we will ask you to confirm that we may share your details with the relevant Product Partner.
10. You may withdraw consent at any time (clause 8). Withdrawal does not affect what we did before you withdrew, and may limit what you can use on the Platform.
11. We may also process data without consent where the DPDP Act permits it, for example to comply with a legal obligation, to respond to a medical or safety emergency, or to prevent fraud.

Who we share it with

12. We share your personal data with:
    1. Product Partners: the banks, NBFCs, asset management companies, bond platforms and bullion providers for the Product you choose, for the purpose of that transaction. They may share it onward with exchanges, depositories, clearing corporations, KYC agencies, regulators and their own service providers as needed to process your transaction, under their own privacy policies. They may also contact you directly about your account.
    2. Service providers: cloud hosting, payment gateway, messaging, analytics, verification and support providers acting on our behalf under confidentiality obligations.
    3. Regulators and authorities: SEBI, RBI, AMFI, KYC registration agencies, tax and law-enforcement authorities, and courts, where required by law.
    4. Business transfer: a successor, in a merger, acquisition or sale, on terms that protect your data.

Where data is stored

13. Your personal data is stored on servers in India. We do not transfer it outside India except where the law permits and our agreements with Product Partners allow.

How long we keep it

14. We keep your data while your account is active.
15. After that, we keep it for the periods required by law, including anti-money-laundering and SEBI, RBI and AMFI record-keeping rules, which can be several years depending on the Product.
16. Data we receive from a Product Partner is kept only for the purpose and period that Partner’s rules allow, and we delete it when the Partner or you ask us to, subject to legal retention.
17. Once those periods end and the purpose is served, or after about one year of account inactivity where no legal retention applies, we delete or anonymise your data. You can ask for earlier deletion (clause 8).

Your rights

18. You can ask us to:
    1. tell you what personal data we hold and how it is used;
    2. correct or complete your data;
    3. erase your data, subject to our legal retention duties and any active investment;
    4. withdraw your consent, which may limit what you can use on the Platform;
    5. address a grievance; and
    6. nominate another person to exercise these rights if you die or become unable to.
19. Write to us at [email protected]. We will respond within a reasonable time and in any event within the periods set by law. Deleting your account does not cancel investments with a Product Partner, and we may be unable to delete data we must keep by law.
20. Please give us accurate information and do not impersonate another person or make false or frivolous complaints.

Messages and marketing

21. We send service and transactional messages that you need (OTPs, confirmations, alerts). Promotional messages can be turned off in the Platform settings or by following the opt-out instructions in the message.

Security

22. We use reasonable security safeguards, such as encryption and access controls, to protect your data. No system is completely secure. If a personal data breach affects you, we will notify you and the relevant authorities as required by law. Please protect your login details and report any suspected misuse to us promptly.

Cookies and similar technologies

23. We use cookies and SDKs to keep the Platform working, remember settings and understand usage, including through analytics providers. You can manage cookies in your browser and app permissions in your device settings. Some features may not work if you disable them.

Children

24. The Platform is for adults only. We do not knowingly collect personal data of anyone under 18. If we learn we have, we will delete it and may close the account.

Grievance Officer and complaints

25. • Grievance Officer: Krishna Gopal Goswami (Director)
    • Email: [email protected]
    • Address: WeWork Embassy Tech Village, Block L, Outer Ring Road, Bengaluru – 560103, Karnataka, India.
    We will acknowledge your complaint within 24 hours and respond within the period set by law (generally 15 days).
26. If you are not satisfied, you may complain to the Data Protection Board of India under the DPDP Act, after first raising it with us.

Changes to this policy

27. We may update this policy. We will post the new version on the Platform with its updated date and, for material changes, notify you through the Platform, email or SMS. Continuing to use the Platform after the change means you accept it.