Privacy policy
This policy explains what personal data Vitta-Kosh ("we") collects when you use vittakosh.in and the Vitta-Kosh dashboard, and what we do with it. We follow the principles of India's Digital Personal Data Protection Act, 2023: collect only what we need, use it only for the stated purpose, and delete it when it is no longer needed.
1. What we collect
| Data | Why |
|---|---|
| Your Google account name, email address and a unique user ID (via Google sign-in) | To create your account, sign you in, and send service emails such as your approval notice |
| Holdings you import: instrument, quantity, average price, broker name, and optional purchase date and sector | To show your portfolio, calculate returns and generate reports |
| Buy and sell records you enter, and a daily net-worth snapshot | Realised P&L, history charts and performance |
| The email address where you receive CAS statements (if you set one) | Not used at present |
| Sign-in and activity timestamps, and usage counters for AI features | Security, abuse prevention and fair-use limits |
We do not collect or store your broker password, OTP, broker access tokens, CAS PDF passwords, bank account details or payment card details.
2. Files and statements you import
- Uploaded statements and screenshots are processed in memory to extract holdings and are not stored. If a file cannot be read, we keep the text we could read from it - the text of a CSV or spreadsheet, of a PDF that opened with the password you gave, or the words recognised in a screenshot - with PAN, Aadhaar, email and phone numbers, demat, client and bank account numbers, folio numbers and name, address and nominee lines removed, together with technical metadata (file type and the reason it failed). We use it only to improve our file reader and never keep your PDF password. We keep the original file only if you choose to send it when an upload fails. Both are stored privately in Google Cloud Storage and deleted after 90 days.
- AI parsing (beta). When our built-in parsers cannot read a file, its contents may be sent to Google's Gemini API to extract holdings. For text files we remove PAN, Aadhaar, email and phone numbers first. Screenshots are sent as images.
- API tokens. If you create a token to use the Vitta-Kosh API, we store its name, access level (read or read-write), creation, expiry and last-used dates, and a one-way fingerprint of it (a SHA-256 hash). The token itself is shown to you once and never stored. You can revoke tokens at any time; they are deleted when you close your account.
3. Who processes your data
We do not sell your personal data or share it for others' marketing. We use these service providers to run Vitta-Kosh:
- Google Cloud and Firebase - hosting, sign-in, database and storage of failed-parse samples
- Google Gemini API - AI parsing, only when used (see above)
- Google Analytics - aggregate usage statistics
- Google AdSense - advertising on public guide pages only, never in the dashboard
- Titan (email hosting) - sending service emails
- Market data providers (AMFI, Yahoo Finance and exchanges) - public prices only; your holdings are not sent to them
Some of these providers may process data outside India. We may disclose data if required by law.
4. Cookies and similar technologies
- Essential - Firebase stores sign-in state in your browser so you stay logged in. The site remembers your theme and whether you dismissed the cookie notice using local storage.
- Analytics - Google Analytics sets cookies to count visits and understand which features are used.
- Advertising - on public guide pages, Google and its partners may use cookies to serve ads based on your previous visits to this and other websites. You can opt out of personalised advertising at Google Ads Settings, and learn more at how Google uses cookies in advertising. Visitors from regions that require consent are asked before personalised ads are shown.
You can block or delete cookies in your browser settings; the dashboard needs essential storage to keep you signed in.
5. How long we keep data
- Account: until you close it. Holdings, transactions and history: until you reset your portfolio or close your account.
- Failed-parse samples (scrubbed text, and any original file you chose to send): 90 days.
- Server logs: as retained by Google Cloud, typically 30 days.
6. Your rights and choices
- Access and export - download all your holdings any time from the dashboard (Excel, CSV or PDF).
- Correction - edit any holding in the dashboard.
- Deletion - use "Reset Portfolio" in the dashboard to delete your holdings, transactions, history and undo backup and start again with the same account, or "Close Account" to delete your profile as well. Both take effect immediately.
- Grievances - email hello@vittakosh.in with the subject "Privacy request". We aim to respond within 30 days.
7. Security
Data is encrypted in transit (HTTPS) and at rest on Google Cloud. Browser clients cannot write to the database directly; every change goes through our server, which checks who you are. No system is perfectly secure, and we will notify affected users and authorities of a breach as the law requires.
8. Children
Vitta-Kosh is not intended for anyone under 18.
9. Changes
If we change this policy, we will update the date above, and tell signed-in users about material changes in the dashboard or by email.