Privacy Policy

1. Who we are (Data Fiduciary)

Aumsetu.com is a Software-as-a-Service (SaaS) platform operated by DigiMutual Goals Pvt. Ltd. ("we", "us", "the Company"). The Company is the Data Fiduciary under the DPDP Act. Registered office: SCO-01, Near IndusInd Bank, Aastha Hospital Street, Chotala Road, Mandi Dabwali – 125104, District Sirsa, Haryana, India.

Aumsetu.com itself does not distribute mutual funds, does not act as an Investment Adviser, and does not solicit investments from end-users of the platform.

Grievance Officer / Data Protection Officer: info@aumsetu.com, +91 95412 23377 (WhatsApp preferred).

2. What data we collect

2.1 From Customers (paying MFDs/advisors)

2.2 From visitors of branded suites (your clients)

When end-clients use your branded calculator at aumsetu.com/c/yourfirm, we may temporarily process:

• Input values entered (SIP amount, tenure, etc.) — stored only in browser memory unless explicitly saved by user
• Generated PDF/Word files — created in browser, downloaded directly, NOT stored on our servers
• Access timestamps + PIN-unlock events (for audit log of MFD's suite)

3. Why we collect (Purpose & Legal Basis)

Under DPDP Act, processing of personal data requires a lawful purpose. Our purposes:

1. Provide the Service — generate branded suites, host them, enable login
2. Process payments and manage subscriptions
3. Authenticate users — verify password/PIN to prevent unauthorised access
4. Security & fraud prevention — rate limiting, audit logs, anomaly detection
5. Communication — renewal reminders, support responses, important Service updates
6. Compliance — comply with applicable laws (AMFI, IT Act, DPDP Act), respond to lawful requests
7. Service improvement — aggregate, anonymised analytics

Legal basis: Contractual necessity (Sec 7 DPDP Act) for items 1-4; Legitimate interest (within limits) for items 5-7; Your explicit consent for any marketing communications.

4. How we use cookies and similar tech

We use minimal cookies and browser storage:

• Essential (no consent needed): session tokens for login (sessionStorage); PIN unlock tokens (localStorage, 24h)
• Preference (consent banner): cookie consent record, language/theme preferences
• Analytics: We currently do NOT use third-party analytics (Google Analytics etc.). If we add in future, we will request explicit opt-in.
• Marketing: We do NOT use marketing cookies. We do NOT sell or share your data with advertisers.

5. Who we share data with

We share minimal data only with the following Data Processors, under strict confidentiality:

We do NOT share customer or visitor data with marketing platforms, ad networks, or unrelated third parties. We do NOT sell your data.

6. Data retention

• Active customers: Data retained for the duration of your subscription
• Cancelled/expired customers: Retained for 12 months for renewal facilitation, then deleted (except invoices and audit log entries retained 8 years for IT Act / Income Tax compliance)
• Visitor data (your clients): NOT stored on servers — all in-browser only
• Audit logs: Retained 24 months for security investigations
• Login attempts log: Auto-purged after 90 days

7. Your rights under DPDP Act

You have the following rights regarding your personal data:

1. Right to information: Know what data we hold about you (request via portal or email)
2. Right to correction / update: Update your details via Customer Portal anytime
3. Right to erasure ("Right to be Forgotten"): Request full deletion (subject to legal retention requirements above)
4. Right to grievance redressal: Contact our Data Protection Officer (Sec 13 DPDP Act)
5. Right to nominate: You may nominate another person to exercise these rights on your behalf in case of incapacity / death

To exercise any right, email info@aumsetu.com with subject "DPDP Request — [your request]". We will respond within 30 days as required by law.

8. Security measures

• All connections encrypted via HTTPS (TLS 1.3)
• HSTS (Strict-Transport-Security) header enforced across all endpoints
• Passwords hashed with PBKDF2 (100k+ iterations, per-user salt) — plaintext passwords never stored, never logged
• PIN gate for client-facing suites with server-side rate limiting (5 wrong attempts → 15-minute lockout)
• Supabase Row-Level Security (RLS) policies restrict data access — customers can only see their own data
• SECURITY DEFINER database functions ensure sensitive hashes never leave the database via API
• Cross-user data isolation with 4-layer defence: session watermarking, ownership checks on cached logos, explicit cache clearing on logout, and defensive checks on portal boot
• Security headers: CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy
• Login attempts logged with server-side rate limiting; audit trail for all portal actions
• Automated daily backups stored offsite in Supabase's managed infrastructure
• Vendor security: Supabase is SOC 2 Type II certified; Vercel is SOC 2 Type II + GDPR compliant; Cloudflare provides DDoS protection

9. Children's privacy

Our Service is intended for licensed financial professionals only. We do not knowingly collect data from anyone under 18. If we learn we have collected data from a minor, we will delete it immediately.

10. International transfers

While our primary operations are India-based, our Data Processors (Supabase AWS Singapore, Vercel multi-region) may store data outside India. All such transfers are subject to standard contractual clauses and equivalent data-protection safeguards per DPDP Act Sec 16.

11. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be notified via email and shown on this page with a new effective date. Continued use after changes constitutes acceptance.

12. Grievance & complaints

If you believe your personal data has been mishandled or your rights violated:

1. Email our Grievance Officer at info@aumsetu.com
2. We will respond within 7 days and resolve within 30 days
3. If unsatisfied, you may approach the Data Protection Board of India once established under Sec 18 DPDP Act
4. Consumer disputes may be filed at the appropriate Consumer Forum under Consumer Protection Act, 2019