1. Introduction

Equitree Capital Advisors Private Limited ("Equitree", "we", "us" or "our") is a portfolio manager registered with the Securities and Exchange Board of India (SEBI Registration No. INP000005777). We are committed to protecting the privacy and security of the personal information you share with us.

This Privacy Policy explains what information we collect, how we use and protect it, and the rights you have over it. It applies to our website at equitreecapital.com and to the Equitree Capital mobile application (together, our "Services"). Please read it alongside the disclosures and the client agreement governing your portfolio management relationship with us.

2. Information we collect

Information you provide to us:

• Contact details you submit through our website forms (name, email address, phone number) when you enquire about our services or subscribe to our updates.
• Identity, KYC and financial information you provide when you become or are onboarded as a portfolio management client, as required under SEBI and KYC regulations.
• Communications you send us by email, phone, messaging or in-app.

Information generated through the Equitree Capital app:

• Portfolio information relating to your own account(s), such as holdings, transactions, valuations, returns and statements, sourced from your portfolio management account with us and our custodian.
• Authentication data: a one-time passcode (OTP) sent to your registered email or phone, and, if you enable it, a time-based one-time passcode (TOTP). If you turn on biometric unlock (Face ID / fingerprint), the biometric match is performed by your device and never leaves it; we do not collect or store biometric data.
• Device and usage information needed to operate the app securely, such as device type, app version, push-notification tokens, low-cardinality screen or feature interactions, crash diagnostics, and access logs.
• Questions or feedback you submit through interactive app features and the responses or reports generated for you. These features are intended for information and reporting, not personalised investment advice.

Information collected automatically on our website:

• Standard analytics and usage data (such as pages viewed and approximate location derived from your IP address) collected through cookies and similar technologies. See "Cookies and analytics" below.

3. How we use your information

We use your information to:

• Provide, operate and secure our Services, including authenticating you and showing you information scoped to your own account.
• Respond to your enquiries and communicate with you about your portfolio, our services and regulatory matters.
• Meet our legal, regulatory and reporting obligations as a SEBI-registered portfolio manager (including KYC, periodic client reporting and audit trails).
• Maintain and improve the reliability, performance and security of our Services.
• Send you updates or marketing communications where you have asked to receive them; you can opt out at any time.

The mobile application does not use advertising identifiers, precise location, contacts, photos, health information or cross-app advertising trackers.

4. Legal basis and consent

We process your information to perform our contract with you, to comply with applicable laws and regulations, for our legitimate business interests in operating and securing our Services, and, where required, on the basis of your consent. Where we rely on consent (for example, for marketing communications), you may withdraw it at any time without affecting processing already carried out.

5. How we share your information

We do not sell your personal information. We share it only as needed to provide our Services and meet our obligations, including with:

• Custodians, brokers and fund administrators (such as our PMS custodian) that hold or service your account.
• Service providers who process information on our behalf under contract (for example, cloud hosting, email delivery, analytics and customer-communication providers) and who are permitted to use it only to provide services to us.
• Regulators, auditors, and law-enforcement or government authorities where required by law or to protect our legal rights.
• Professional advisers (such as legal, accounting and compliance advisers) where reasonably necessary.

6. How we protect your information

We apply technical and organisational measures designed to protect your information. These include encryption of data in transit (TLS) and at rest, hashing of credentials, strong authentication (OTP and optional TOTP), session controls and the ability to revoke sessions, role- and scope-based access controls so each client sees only their own data, rate limiting, and immutable access and audit logs. No method of transmission or storage is completely secure, but we work to protect your information using measures appropriate to its sensitivity.

7. Where your information is stored

Core portfolio-account records and the Equitree Capital investor API are hosted on cloud infrastructure located in India (Mumbai region). Certain contracted app, website and communication service providers may process limited information outside India, such as crash diagnostics, analytics, email delivery, or content submitted to an interactive feature. Where they do, we take steps intended to keep your information protected and to keep our regulatory records accessible from within India in line with applicable requirements.

8. Data retention

We keep your information only for as long as needed for the purposes set out in this policy and to meet legal, regulatory, security and dispute-resolution obligations. Investor-generated PDF files remain available in the app for 7 days and are then removed from download storage; you may generate them again. ICT and security logs are retained in India for at least the rolling period required by CERT-In directions where applicable. Portfolio, transaction, consent, audit, grievance and other regulated records are retained for the periods required under SEBI and other applicable laws. Other information is deleted or anonymised when it is no longer necessary.

9. Your rights

Subject to applicable law, you may:

• Request access to the personal information we hold about you.
• Ask us to correct or update inaccurate or incomplete information.
• Request erasure of your information where it is no longer needed and we are not required to retain it.
• Withdraw consent for processing that relies on consent (such as marketing).
• Raise a grievance about how your information is handled (see "Grievance redressal and contact").

To exercise any of these rights, contact us using the details below. Equitree Capital app users can also use our account deletion request page. We may need to verify your identity before acting on a request, and some information may be retained where the law requires it.

10. Cookies and analytics

Our website uses cookies and similar technologies, including privacy-respecting analytics, to understand how the site is used and to improve it. You can control or block cookies through your browser settings; blocking some cookies may affect how parts of the site work. The Equitree Capital app does not use advertising trackers.

11. Children’s privacy

Our Services are intended for adults (18 years and older) and are offered only to existing or prospective portfolio management clients. We do not knowingly collect personal information from children.

12. Third-party links

Our Services may link to third-party websites or services (for example, our custodian’s investor-reporting portal or regulatory portals). This policy does not apply to those third parties, and we encourage you to read their privacy policies.

13. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices or in the law. We will post the updated policy here with a revised effective date, and where appropriate we will notify you.

14. Grievance redressal and contact

If you have any questions, requests or concerns about this policy or your information, please contact us at [email protected] or by phone at +91 22 4972 6816. Our operations and compliance contact is Sakshi Tatkare at [email protected]. Equitree Capital Advisors Private Limited is a SEBI-registered portfolio manager (Registration No. INP000005777).

If you are a client and your concern is not resolved to your satisfaction, you may escalate it through SEBI’s SCORES platform at scores.sebi.gov.in or through the SEBI online dispute resolution portal at smartodr.in. Details of our grievance-redressal mechanism are also available in the regulatory disclosures on our website.