Privacy Policy

01Who we are and what this covers

Equitree Capital Advisors Private Limited (“Equitree”, “we”, “us”) is a SEBI-Registered Portfolio Manager (INP000005777). We are the Data Fiduciary under the Digital Personal Data Protection Act, 2023 for the personal data described here.

This policy covers equitreecapital.com and the Equitree Capital app for iOS, Android and the web. It sits alongside your portfolio management agreement and our Disclosure Document, which govern the investment relationship itself.

02What we collect

Contact details

Name, email and phone number you give us through a form, by email or by phone, or that we hold as your registered contact details.

KYC and account records

Identity, KYC, bank and investment details collected when you become a client, as SEBI and KYC rules require.

Portfolio data (app)

Holdings, transactions, valuations, returns, fees and statements for the accounts you are allowed to see, from our records and our custodian, Nuvama Custodial Services Limited.

Sign-in and security (app)

One-time codes sent to your registered email or phone, an optional authenticator (TOTP) secret, trusted-device records, and login and access logs. Face ID or fingerprint is checked by your device; we never receive biometric data.

Device and diagnostics (app)

Device type, app version, a push notification token if you turn notifications on, and crash reports with personal data removed.

Bodhi AI conversations (app)

The questions you ask Bodhi AI and its answers, if you choose to use it.

Website usage

Pages viewed, referring site, device and approximate location from your IP address, through cookies and similar technology. Questions typed into the website’s “Ask us anything” chat.

The app does not collect your precise location, contacts, photos or health data, does not use advertising identifiers and does not track you across other companies’ apps or websites.

03How we use it, and on what basis

Run your account

Sign you in, show you your own portfolio, prepare the reports you ask for and send the notifications you choose.

Meet the law

KYC, client reporting, record keeping, audits and requests from SEBI and other authorities.

Answer you

Reply to enquiries, service requests and complaints.

Keep it secure

Detect misuse, fix faults and keep the website and app reliable.

Our quarterly letter

Sent when you ask for it or enquire through our website. Every email has an unsubscribe link.

We process personal data either with your consent or for a legitimate use the Act allows, such as data you give us voluntarily for a stated purpose, or processing that SEBI rules and other laws require. Where we rely on consent, for example Bodhi AI or our quarterly letter, you can withdraw it at any time as easily as you gave it. Withdrawal does not affect processing already done.

04Bodhi AI in the app

Bodhi AI answers questions about your own portfolio. It is off until you agree to the notice shown before your first question.

• Your question and the portfolio details needed to answer it are processed by an AI model on Amazon Bedrock, in AWS’s Mumbai region. They stay in India.
• Amazon Bedrock uses them only to produce the answer. It does not use them to train models, does not share them with the model’s maker and does not keep them after answering.
• We keep your conversations in our own records in India for 8 years, then delete them.
• Answers are generated by AI and are for information only. They are not investment advice and may be wrong, so check them against your statements. Bodhi AI cannot place trades.
• You can withdraw at any time in the app under Profile, then Bodhi AI.

05Who we share it with

We do not sell personal data. Your holdings and fee terms are never shown to other clients. We share data only with:

People you have authorised

Relationship contacts recorded on your account, including the distributor through whom you invested, if any.

Our custodian

Nuvama Custodial Services Limited, which holds and reports on your portfolio.

Service providers

Amazon Web Services (hosting in Mumbai and Bodhi AI), Brevo (sign-in codes and email), Sentry (crash reports), Expo, Apple and Google (push notifications), Vercel (website hosting and analytics), Google (website analytics and enquiry records), Cloudflare (bot checks on forms), n8n (routing website enquiries) and Anthropic (the website chat).

Authorities and advisers

SEBI, KYC registration agencies, auditors, courts and other authorities where the law requires, and our legal and compliance advisers.

Each service provider processes data only on our instructions, under contract, and must protect it at least as well as this policy does.

06Where your data is stored

Client records, the app’s servers and Bodhi AI run on AWS in Mumbai. Some providers process limited data outside India: crash reports (Sentry, United States), email and push delivery, website hosting and analytics, and questions typed into the website chat (Anthropic, United States). We transfer data abroad only as the DPDP Act permits, and our regulatory records stay available in India.

07How long we keep it

Regulated records

Portfolio, transaction, KYC, consent, grievance and audit records: for the periods SEBI and other laws require.

Bodhi AI conversations

8 years, then deleted.

Security logs

Login, access and security logs: at least the period CERT-In directions and the DPDP Rules require.

Reports you generate

Available to download in the app for 7 days, then removed. You can generate them again.

Everything else

Deleted or anonymised once we no longer need it for the purpose it was collected for.

08How we protect it

Data is encrypted in transit and at rest. Sign-in uses one-time codes, with an optional authenticator app and biometric unlock. Each client sees only their own accounts, staff access is limited to need and every access to client data is logged. No system is perfectly secure, so if a personal data breach affects you, we will tell you and the Data Protection Board of India as the law requires.

09Your rights and how to use them

Under the DPDP Act you can:

• get a summary of the personal data we hold about you and who we have shared it with;
• have inaccurate or incomplete data corrected or updated;
• have data erased once we no longer need it and the law does not require us to keep it;
• withdraw any consent you have given;
• nominate someone to use these rights if you die or become unable to; and
• raise a grievance with us, and if we do not resolve it, complain to the Data Protection Board of India.

Write to [email protected] from your registered email address. We verify every request before acting on it and aim to respond within 30 days.

10Deleting your app account

Request deletion in the app (Profile, then Delete account) or on our account deletion page.

• As a SEBI-Registered Portfolio Manager, we delete your app account once you have fully redeemed and your PMS account is closed. Until then we record your request and your access continues. A partial redemption does not change this.
• An account that was never funded is deleted once we have verified your identity.
• On deletion we remove your app profile, contact details held for the app, device records and notification preferences.
• We keep regulated records, Bodhi AI conversations and security logs for the periods in “How long we keep it”, and use them only for those purposes.
• Deleting your app account does not close your PMS account, and unsubscribing from our emails is a separate step.

11Cookies and website analytics

Our website uses Google Analytics and Vercel Web Analytics to understand how pages are used, and a short-lived security cookie for the website chat. We do not use advertising cookies. You can block or delete cookies in your browser settings; the site will still work, though the chat may not. The app does not use cookies for analytics or advertising.

12Children

The website and app are not meant for anyone under 18, and we do not knowingly collect a child’s data through them. Where a portfolio is held for a minor, we deal with the parent or lawful guardian and process the minor’s data only to service that account and meet the law.

13Changes to this policy

We will post any change here with a new effective date. If a change affects how we use data you have consented to, we will tell you in the app or by email and, where the law requires, ask for your consent again.

14Contact and grievances

Privacy requests

Requests: [email protected]. Grievance Officer (privacy): Sparsh Kabra, [email protected]

Complaints

[email protected] or +91 22 4972 6816. We aim to resolve complaints within 21 calendar days, as set out in our grievance redressal process.

If not resolved

About our services: SEBI SCORES, then SMART ODR. About your personal data: the Data Protection Board of India.

Registered office

301, Tree Building 28, Senapati Bapat Road, Raghuvanshi Mills, Lower Parel, Mumbai 400013