Privacy Policy

IndAsset ("we", "our", "us") is a private wealth & estate readiness platform for Indian individuals and families. Data controller contact: privacy@assetsafety.in.

Account data: Name, email address, profile picture URL (from Google OAuth).

Financial data: Asset names, types, estimated values, ownership type, liquidity classification, nominee names, and document metadata you voluntarily enter.

Identity data (optional): PAN number and Aadhaar last 4 digits. Stored encrypted at the application layer — never in plain text.

Documents: Files you upload to the document vault. Stored in encrypted object storage (AWS S3).

Usage data: Browser type, IP address, pages visited — collected for product improvement and security monitoring.

Session data: Authentication tokens, device fingerprint, IP address — retained for 90 days.

We use your data solely to:

• Provide, operate, and improve the IndAsset platform
• Calculate and display your Safety Score and estate readiness metrics
• Generate personalised action items and insights
• Send product notifications with your consent
• Detect and prevent fraud or unauthorised access
• Comply with applicable Indian laws

We do not use your data to target advertising, build credit profiles, or sell to third parties.

• Service providers: AWS (cloud hosting, S3 storage), Google (OAuth). Bound by data processing agreements.
• Legal requirements: If required by a court order or applicable Indian law.
• Family access: Only what you explicitly grant.

We never sell, rent, or broker your personal or financial data.

Your data is retained while your account is active. On account deletion:

• Asset and nominee data deleted within 30 days
• Uploaded documents deleted within 30 days
• Session/audit logs retained for 90 days, then purged
• Backups purged within 60 days

• TLS 1.3 for all data in transit
• AES-256 encryption for documents at rest
• Application-layer encryption for PAN and Aadhaar fields
• Redis-backed JWT sessions with revocation support
• IP and device logging for anomaly detection

• Access: Request a copy of all data we hold about you
• Correction: Correct inaccurate personal data
• Erasure: Delete your account and all associated data
• Grievance redressal: Contact privacy@assetsafety.in

We respond to valid requests within 30 days.

IndAsset is not intended for users under 18. Contact privacy@assetsafety.in if you believe a minor has created an account.

Material changes will be communicated by email or in-app notice at least 14 days before they take effect.

Questions: privacy@assetsafety.in