MyNiveshIQ ("we", "us", "our") is committed to protecting your privacy. This Privacy Policy explains what data we collect, how we use it, and your rights regarding your personal information when you use myniveshiq.in.

1. Information We Collect

1.1 Account Information

• Name and Email address — provided at registration
• Password — stored as a one-way bcrypt hash; never in plaintext
• Two-factor authentication (2FA) secret — stored encrypted if you enable TOTP 2FA

1.2 Broker Credentials

When you connect a broker account, we collect and store your broker API credentials (such as API keys, access tokens, client IDs). These credentials are:

• Encrypted using Fernet symmetric encryption (AES-128-CBC + HMAC-SHA256) before being stored
• Never stored in plaintext anywhere — not in the database, logs, or backups
• Used solely to fetch your holdings data from the broker
• Never used to place trades or orders on your behalf

1.3 Portfolio and Holdings Data

We store your portfolio holdings fetched from your broker, including stock symbols, quantities, average prices, and current values. This data is used to generate AI analysis reports.

1.4 Analysis Data

AI-generated analysis reports (SELL/HOLD recommendations, confidence scores, reasoning) are stored linked to your account and the holdings data at the time of analysis.

1.5 Payment Data

We store wallet transaction records (amount, type, timestamp, Cashfree order IDs) for billing purposes. We do not store your card numbers, UPI IDs, or bank account details — all payment processing is handled by Cashfree, which is PCI-DSS compliant.

1.6 Usage and Technical Data

• IP address and browser/device type (for security and fraud prevention)
• Pages visited and features used (to improve the Service)
• How you reached us: the campaign parameters in the link you followed (utm_source, utm_medium, utm_campaign) or the referring website
• Error logs (to diagnose technical issues — credentials are never included in logs)

2. How We Use Your Information

Purpose	Data Used
Account creation and authentication	Email, hashed password, 2FA secret
Connecting broker accounts	Encrypted broker credentials
Fetching and displaying portfolio holdings	Broker credentials (decrypted in-memory only)
Generating AI analysis reports	Holdings data, sent to AI model API
Delivering Telegram reports	Telegram chat ID, analysis output
Processing wallet payments	User ID, amount — via Cashfree
Customer support	Email, account info, issue details
Service improvement and analytics	Aggregated, anonymised usage data
Security and fraud prevention	IP address, login activity

3. Data Sharing with Third Parties

We do not sell, rent, or trade your personal information. We share data only with the following service providers, strictly to deliver our Service:

Third Party	Purpose	Data Shared
Anthropic (Claude AI)	AI portfolio analysis	Stock symbols, prices, holdings (no PII)
Cashfree	Payment processing	User ID, amount, order reference
Telegram	Report delivery notifications	Chat ID, analysis summary
Broker APIs (Angel One, Zerodha, etc.)	Fetching holdings data	Your broker API credentials (encrypted in transit via HTTPS)

All third-party data sharing is done over HTTPS/TLS encrypted connections.

4. Data Security

• HTTPS/TLS encryption for all data in transit
• Fernet (AES-128-CBC + HMAC-SHA256) encryption for broker credentials at rest
• bcrypt hashing for passwords — never recoverable
• JWT tokens for session authentication with expiry
• Credentials are never written to application logs
• Database not directly accessible from the internet

5. Data Retention

• Account data: Retained until you delete your account
• Broker credentials: Deleted immediately when you disconnect a broker or delete your account
• Holdings data: Retained until broker disconnected or account deleted
• Analysis reports: Retained for 12 months or until account deletion
• Payment/wallet records: Retained for 7 years as required by Indian tax law
• Logs: Retained for 30 days, then automatically purged

6. Your Rights

You have the right to:

• Access — Request a copy of your personal data
• Correction — Update inaccurate or incomplete data from your profile settings
• Deletion — Delete your account and all associated data from the platform settings. This action is irreversible.
• Data portability — Request your analysis history in a machine-readable format
• Disconnect brokers — Remove any broker connection and all its data at any time

To exercise these rights, contact us at support@myniveshiq.in.

7. Cookies and Similar Technologies

Essential storage. We store your sign-in tokens in your browser's localStorage. These are required for the Service to work and are cleared when you sign out.

Advertising. Our public pages include the Google Ads conversion tag (AW-18004249323). If you reach us from a Google advertisement, Google may set cookies to record that a sign-up followed. This tells us that an advertisement worked; it does not tell us who you are. You can opt out at Google Ads Settings, and browser controls that block third-party cookies will block it too.

How you found us. When you first arrive we record the campaign parameters in the link you followed (utm_source, utm_medium, utm_campaign) or the website that referred you, keep it in your browser, and attach it to your account if you register. It tells us which channels bring people to MyNiveshIQ. It contains no personal information beyond the referring address.

Product usage. While signed in we record which pages of the app you open, so we can see where the Service is confusing or unused. This is stored against your account, is not shared with anyone, and is deleted after 90 days.

We do not use third-party analytics such as Google Analytics, and we do not sell or share any of this with advertisers or data brokers.

8. Children's Privacy

The Service is not directed to individuals under 18 years of age. We do not knowingly collect personal information from minors. If you believe a minor has provided us with personal information, please contact us.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify registered users via email of any material changes. Continued use of the Service after changes constitutes acceptance of the updated policy.

10. Contact Us

For privacy-related requests, questions, or concerns, contact us at:

• Email: support@myniveshiq.in
• Website: myniveshiq.in