Privacy Policy

1. Who we are

This website is run by Shital Shukla and Jija Roy, who work together under the trade name Finpotters. Both are AMFI-registered Mutual Fund Distributors (ARN-87539 and ARN-152830). Together we decide how your personal data is used, and we are responsible for it. Our office: 1107/B Synergy Tower, Corporate Road, Prahladnagar, Ahmedabad 380015, India.

2. What this policy covers

This policy covers this website and its two enquiry forms (on the home page and the contact page). It also covers what happens to your data when you contact us by phone, email or WhatsApp, and when you become a client.

This policy is in English. A Gujarati and a Hindi version will be added. [to be added: links to the Gujarati and Hindi versions]

3. What we collect, and why

Nothing beyond what your enquiry, or the product you choose, needs.

4. When we contact you

When you tick the first box on a form, we use your details only to reply to that enquiry. We send investment education and updates only if you also tick the second box. That box is optional, and your enquiry is sent either way.

Every update message tells you how to stop it in one step: reply STOP, or tap unsubscribe. [owner to confirm this process exists: a stop / unsubscribe step in every update message]

5. Who receives your data

• Shital Shukla and Jija Roy only, inside Finpotters.
• When you decide to invest or apply: the fund house (AMC) and its registrar and transfer agent; KYC registration agencies and the Central KYC Registry; the SEBI-registered portfolio manager; the AIF or GIFT City fund manager; the bond platform or broker; the SEBI-registered stock-advisory partner you choose; the insurer; the bank or NBFC lender. Each uses your data under its own regulator's rules.
• Service providers that help us run Finpotters and must protect your data: [to be added: list, for example email provider, WhatsApp Business, website host, client platform, CRM].
• Regulators, courts or authorities where the law requires it.

We do not sell or rent your personal data, and we do not share it with any other company for its own marketing, including companies related to us.

Some service providers, such as email and WhatsApp, may store data outside India. We use only providers that protect it. [owner to confirm this process exists: written data-protection terms with each service provider]

6. How long we keep it

• Enquiries: if you do not become a client, we delete your enquiry details [to be confirmed: 12] months after our last contact with you, or sooner if you ask.
• Updates: if you stop updates, we stop sending them straight away and keep only a record that you opted out, so that we do not message you again. [owner to confirm this process exists: an opt-out register]
• Client records: KYC and transaction records are kept for the periods that SEBI, AMFI, IRDAI, the Prevention of Money-laundering Act and other applicable rules require, which can be several years after you stop investing.
• Records of processing: a record of what we did with your data (for example, when it was received, used or deleted) is kept for at least one year, even after the data itself is deleted, because the Digital Personal Data Protection Rules, 2025 require it from 13 May 2027. [owner to confirm this process exists: a processing log; this duty applies from 13 May 2027]

7. How we keep it safe

We limit who can see your data and ask every service provider we use to protect it in the same way. [owner to confirm this process exists: written data-protection terms with each service provider] We will never ask for your password, OTP or PIN by phone, email or WhatsApp. If anyone does so in our name, please do not share it, and tell us.

[to be confirmed by the owner before it is published: two-step verification on email and WhatsApp accounts; client documents stored only in (system); access limited to Shital Shukla and Jija Roy]

If your data is ever exposed through a security incident, we will tell you without delay, and inform the authorities as the law requires. [owner to confirm this process exists: a written plan for handling a data breach]

8. Cookies and this website

When you first visit, we ask for your cookie choice. We keep that choice in one small item of essential browser storage (not a tracking cookie) for up to 180 days, so we do not ask again on every page. Today the website uses no analytics, advertising or tracking tools, and it loads nothing from other companies' servers. If you use the WhatsApp or Client login links, you leave our website, and those services' own privacy policies apply.

If we ever add analytics or advertising tools, we will ask for your permission first. They will stay off unless you choose Accept, and you will be able to change your choice at any time from "Cookie settings" at the bottom of every page.

9. Children

This website is not meant for children under 18, and we do not knowingly collect their personal data or track them. If you invest for a child, we collect only what the product requires, with your consent as the parent or guardian.

10. Your rights

1. See what we holdAsk for a summary of the personal data we have about you and how we use it.
2. Correct or update itTell us if anything is wrong or out of date.
3. Withdraw consentStop updates at any time, as easily as you agreed to them.
4. Ask us to delete itWe delete what the law does not require us to keep, and tell you what we must keep and why.
5. ComplainWrite to our Grievance Officer first. If you are not satisfied, you may complain to the Data Protection Board of India once this right starts on 13 May 2027.
6. Nominate someoneYou can name a person to use these rights for you if you die or become unable to act.

How to ask: write to [to be added: privacy email], call or WhatsApp [to be added: phone], and say "privacy request". Please give your full name and the mobile number you used with us, so we can find your data. We may ask you to confirm who you are before we share or change anything.

11. Privacy contact and Grievance Officer

For complaints about a product or our service, see Complaints & Grievances.

12. Laws this policy is written for

This policy is written to meet the Information Technology Act, 2000 and its Reasonable Security Practices Rules, 2011. It also covers the Digital Personal Data Protection Act, 2023 and the Digital Personal Data Protection Rules, 2025, whose main duties apply from 13 May 2027.

13. Changes to this policy

When we change this policy, we update the "Last updated" date below. For important changes, we also tell our clients directly.

Last updated: 29 September 2026 (draft). To be reviewed by Finpotters' legal adviser before the site goes live.