MyNiveshIQ ("we", "us", "our") is committed to protecting your privacy. This Privacy Policy explains what data we collect, how we use it, and your rights regarding your personal information when you use myniveshiq.in.

1. Information We Collect

1.1 Account Information

• Name and Email address — provided at registration
• Password — stored as a one-way bcrypt hash; never in plaintext
• Two-factor authentication (2FA) secret — stored encrypted if you enable TOTP 2FA

1.2 Broker Credentials

When you connect a broker account, we collect and store your broker API credentials (such as API keys, access tokens, client IDs). These credentials are:

• Encrypted using Fernet symmetric encryption (AES-128-CBC + HMAC-SHA256) before being stored
• Never stored in plaintext anywhere — not in the database, logs, or backups
• Used solely to fetch your holdings data from the broker
• Never used to place trades or orders on your behalf

1.3 Portfolio and Holdings Data

We store your portfolio holdings fetched from your broker, including stock symbols, quantities, average prices, and current values. This data is used to generate AI analysis reports.

1.4 Analysis Data

AI-generated analysis reports (SELL/HOLD recommendations, confidence scores, reasoning) are stored linked to your account and the holdings data at the time of analysis.

1.5 Payment Data

We store wallet transaction records (amount, type, timestamp, Razorpay order IDs) for billing purposes. We do not store your card numbers, UPI IDs, or bank account details — all payment processing is handled by Razorpay, which is PCI-DSS compliant.

1.6 Usage and Technical Data

• IP address and browser/device type (for security and fraud prevention)
• Pages visited and features used (to improve the Service)
• Error logs (to diagnose technical issues — credentials are never included in logs)

2. How We Use Your Information

Purpose	Data Used
Account creation and authentication	Email, hashed password, 2FA secret
Connecting broker accounts	Encrypted broker credentials
Fetching and displaying portfolio holdings	Broker credentials (decrypted in-memory only)
Generating AI analysis reports	Holdings data, sent to AI model API
Delivering Telegram reports	Telegram chat ID, analysis output
Processing wallet payments	User ID, amount — via Razorpay
Customer support	Email, account info, issue details
Service improvement and analytics	Aggregated, anonymised usage data
Security and fraud prevention	IP address, login activity

3. Data Sharing with Third Parties

We do not sell, rent, or trade your personal information. We share data only with the following service providers, strictly to deliver our Service:

Third Party	Purpose	Data Shared
Anthropic (Claude AI)	AI portfolio analysis	Stock symbols, prices, holdings (no PII)
Razorpay	Payment processing	User ID, amount, order reference
Telegram	Report delivery notifications	Chat ID, analysis summary
Broker APIs (Angel One, Zerodha, etc.)	Fetching holdings data	Your broker API credentials (encrypted in transit via HTTPS)

All third-party data sharing is done over HTTPS/TLS encrypted connections.

4. Data Security

• HTTPS/TLS encryption for all data in transit
• Fernet (AES-128-CBC + HMAC-SHA256) encryption for broker credentials at rest
• bcrypt hashing for passwords — never recoverable
• JWT tokens for session authentication with expiry
• Credentials are never written to application logs
• Database not directly accessible from the internet

5. Data Retention

• Account data: Retained until you delete your account
• Broker credentials: Deleted immediately when you disconnect a broker or delete your account
• Holdings data: Retained until broker disconnected or account deleted
• Analysis reports: Retained for 12 months or until account deletion
• Payment/wallet records: Retained for 7 years as required by Indian tax law
• Logs: Retained for 30 days, then automatically purged

6. Your Rights

You have the right to:

• Access — Request a copy of your personal data
• Correction — Update inaccurate or incomplete data from your profile settings
• Deletion — Delete your account and all associated data from the platform settings. This action is irreversible.
• Data portability — Request your analysis history in a machine-readable format
• Disconnect brokers — Remove any broker connection and all its data at any time

To exercise these rights, contact us at myniveshiq@gmail.com.

7. Cookies

We use only essential session cookies (JWT authentication tokens stored in browser localStorage) necessary for the Service to function. We do not use tracking cookies, advertising cookies, or third-party analytics cookies.

8. Children's Privacy

The Service is not directed to individuals under 18 years of age. We do not knowingly collect personal information from minors. If you believe a minor has provided us with personal information, please contact us.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify registered users via email of any material changes. Continued use of the Service after changes constitutes acceptance of the updated policy.

10. Contact Us

For privacy-related requests, questions, or concerns, contact us at:

• Email: myniveshiq@gmail.com
• Website: myniveshiq.in