Privacy Policy

This Policy applies to (a) visitors and clients of qodeinvest.com, (b) users of the QodePulse mobile application distributed through the Apple App Store and Google Play Store, and (c) prospects who use our Portfolio Snapshot service to share read-only financial information via an RBI-licensed Account Aggregator.

Under the Digital Personal Data Protection Act, 2023 (the "DPDP Act"), Qode Advisors LLP is the Data Fiduciary for personal data collected through the Services.

Registered office: Qode Advisors LLP, Mumbai, Maharashtra, India.

Grievance / Data Protection Officer

• Name: Komal Trivedi, Compliance Officer
• Email: compliance@qodeinvest.com
• Response SLA: 7 working days for data-principal requests (access, correction, erasure, withdrawal of consent).
• Escalation: if unresolved, you may approach the Data Protection Board of India.

We collect only what is needed to deliver the Services. Categories are:

a. Identity & contact

Name, date of birth, email, mobile number, postal address, occupation, PAN, Aadhaar (KYC only), and signature.

b. KYC & financial profile

Income range, risk profile, nominee details, bank account details, investment objectives.

c. Account Aggregator (AA) financial information

When you use the Portfolio Snapshot service or link an account in the QodePulse app, we receive — via the RBI-licensed Account Aggregator Finvu (operated by Cookiejar Financial Services Pvt. Ltd.) — read-only financial information held by Financial Information Providers ("FIPs") such as depository participants, asset management companies, registrar & transfer agents (CAMS, KFin), and banks. The data fields include:

• Demat holdings (equities, ETFs) — ISIN, units, average cost, last traded price.
• Mutual fund holdings and SIP arrangements — folio, scheme, units, NAV, transactions.
• Bank deposit accounts — masked account number, current balance, type.

d. Authentication data

Mobile-OTP delivered through 2Factor.in. Session tokens are stored in iOS Keychain / Android Keystore via Expo SecureStore.

e. Device & technical (mobile app)

Device model, OS version, app version, anonymised crash logs, and a randomly generated install identifier. The app does not read your contacts, photos, precise location, SMS, call logs, or installed-app list. We do not collect the Apple Identifier-for-Advertisers (IDFA) or the Google Advertising ID.

f. Website analytics & cookies

Truncated IP, browser type, referring URL, pages visited, and Google Analytics 4 identifiers as described in §8.

We process personal data on the following lawful bases:

We do not use your data for automated decision-making, advertising profiling, or sale to third parties.

Qode is registered with Sahamati as a Financial Information User ("FIU"). The Account Aggregator is Finvu (operated by Cookiejar Financial Services Pvt. Ltd.), licensed by the Reserve Bank of India under the NBFC-AA Master Directions.

Every time you choose to share data:

• Finvu shows you a hosted consent screen disclosing the FI types (DEPOSIT, EQUITIES, ETF, MUTUAL_FUNDS, SIP), the purpose, fetch window, fetch frequency, and consent expiry.
• You approve or reject the consent on the Finvu screen. We never see your bank or depository credentials — those stay with the FIPs and your Account Aggregator.
• Finvu issues a tamper-evident consent artefact that we store alongside the fetched data so we can prove the lawful basis for every fetch.
• You may revoke any active consent at any time by writing to compliance@qodeinvest.com or from the Finvu app. Revocation stops further fetches immediately; data already fetched is deleted within 30 days unless retention is legally required.

We use AA-fetched data only for the purposes stated in the consent (portfolio display and analytics). We never resell it, share it with brokers, or use it for advertising.

We share personal data only with the following categories of recipients, under contractual data-processing agreements:

We do not sell, rent, or trade your personal data with anyone for advertising or marketing purposes.

The QodePulse mobile app requests only the permissions required for the feature being used. Each permission is requested at runtime and can be revoked from device settings.

iOS (Apple)

• Notifications — to alert you when a portfolio sync completes or when a consent is about to expire. Optional.
• Keychain access — to store your authenticated session securely.

Android (Google)

• INTERNET — to talk to our servers and the Finvu consent flow.
• POST_NOTIFICATIONS (Android 13+) — for the same notifications as above. Optional.

The app does not request access to your contacts, photos, camera, microphone, precise location, SMS, call logs, or installed-app list.

The website uses first-party cookies for session continuity and Google Analytics 4 with IP anonymisation for aggregate usage statistics. We do not run advertising networks, retargeting pixels, or cross-site trackers. You may disable cookies in your browser without losing core functionality.

The QodePulse mobile app does not use the Apple Identifier-for-Advertisers (IDFA) or the Google Advertising ID. Apple's App Tracking Transparency prompt does not appear because we do not track you across other apps or websites.

• KYC and PMS records: retained for 8 years from account closure, as required by SEBI and PMLA.
• Account Aggregator financial information: retained for the duration of your active client relationship, and deleted within 30 days of consent revocation unless retention is legally required.
• Portfolio Snapshot lead data (no onboarding): deleted after 180 days of inactivity.
• Server logs: 90 days. Crash reports: 180 days.
• Marketing consent records: until consent is withdrawn.

We apply technical and organisational measures appropriate to the risk:

• In transit — TLS 1.2+ on every external connection, including AA fetches.
• At rest — AES-256 disk-level encryption on the primary database and object storage. AA payloads are persisted on a database not exposed to the public internet.
• Access control — role-based access, MFA on all admin consoles, immutable audit logs.
• Secrets — API keys live in a managed secret store, never in source control.
• Mobile — session tokens are stored in iOS Keychain / Android Keystore via Expo SecureStore.

No system is perfectly secure. If a personal-data breach affects you, we will notify the Data Protection Board of India and you, in accordance with DPDP §8(6).

Our primary infrastructure (compute, database, AA data) is hosted in Delhi, India. A small set of processors (Resend, Google, Upstash, Apple, Google Play) operate outside India; such transfers are governed by contractual safeguards and are made only to the extent necessary to deliver the Services. AA financial information is not transferred outside India.

You have the following rights as a Data Principal:

• Access — a summary of personal data we hold about you.
• Correction — fix inaccurate or out-of-date information.
• Erasure — deletion where there is no continuing legal obligation to retain.
• Withdrawal of consent — withdraw any consent previously given; as easy as giving it.
• Portability — receive your data in a structured, commonly used format.
• Grievance — escalate concerns to the Grievance Officer; further escalation to the Data Protection Board of India.

Write to compliance@qodeinvest.com from your registered email. We verify identity and respond within 7 working days.

You can delete your QodePulse account at any time:

• In the app: Profile → Settings → Delete my account.
• By email: send "Delete my account" from your registered email to compliance@qodeinvest.com.
• Direct URL: qodeinvest.com/account-deletion.

On request we permanently delete your account, all AA-fetched financial information, and associated logs within 30 days. KYC records we are required to keep under SEBI / PMLA for 8 years are archived offline and accessed only on lawful demand.

The Services are intended for adult investors (18 years and above). We do not knowingly process personal data of children. Under the DPDP Act, processing of a child's data requires verifiable parental consent; we will delete any such data brought to our notice.

We update this Policy from time to time to reflect changes in law, services, or processors. Material changes are notified to registered users by email and via an in-app banner at least 30 days before they take effect. The "Last updated" date at the top of this page always reflects the current version.

This Policy is governed by the laws of India. Any dispute arising under it is subject to the exclusive jurisdiction of the courts at Mumbai.

General queries: investor.relations@qodeinvest.com
Privacy & data-protection queries: compliance@qodeinvest.com

Qode Advisors LLP · SEBI PMS Registration No. INP000008914