Privacy Policy

1. Who we are

CompoundX is operated by [Legal entity name] ("CompoundX", "we", "us"), registered at [Registered office]. For the personal data described in this policy, we decide why and how it is processed — under India's data protection law, we are the Data Fiduciary.

This policy explains what personal data we collect when you use the CompoundX website, tools, account and services; why we use it; who we share it with; how long we keep it; and the rights you have. It is written to meet the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the Digital Personal Data Protection Rules, 2025, which come into force in phases between November 2025 and May 2027, together with other applicable laws. [Legal to confirm which obligations apply at publication.]

Questions about this policy: [privacy@…].

2. The personal data we collect

What we don't collect on our website. We don't ask you to upload identity documents or to enter your PAN, Aadhaar, bank account or card numbers on CompoundX. KYC and bank details for investing are collected by our regulated partner on its own platform. If you send such details to us anyway — for example in an email — we will use them only to help with your request and will not store them in our customer systems longer than necessary.

Information about others. If you enter information about family members, for example in Wealth Lab or family goals, please make sure they are aware of it, and that you are their parent or lawful guardian where they are children.

3. Why we use it

We process personal data on the basis of your consent, given through a clear notice when you provide it, or where the law otherwise permits processing for certain legitimate uses — for example, to comply with a legal obligation.

We use personal data to:

• Provide the services you ask for — run calculations, save plans and reports, maintain your account, book meetings and respond to messages.
• Connect you with a relationship manager — assign your enquiry and keep a record of the conversation so you don't have to repeat yourself.
• Facilitate investing — when you choose to invest, share what's needed with our investment platform partner and record the status of your journey.
• Communicate with you — service messages about your account and bookings, and, with your consent, educational and marketing messages.
• Understand and improve the site — aggregate analytics for everyone; visitor-level analytics only with your analytics consent.
• Link your browsing to your enquiry — only if you allowed analytics cookies: when you later contact us or book a meeting, the tools and pages you used before (for example, a calculator you completed) are added to your enquiry so our team can follow up helpfully without asking you to repeat yourself. Withdraw analytics consent to stop this from then on.
• Prioritise follow-ups — we score engagement (for example, completing a tool or booking a meeting) to decide how quickly our team should reach out. This score reflects interest only; it is never an assessment of your financial suitability.
• Keep the service secure — detect misuse, prevent fraud and protect accounts.
• Meet legal and regulatory obligations, and establish or defend legal claims.

We do not sell your personal data. [To be confirmed by Legal.]

4. Consent and how to withdraw it

Where we rely on consent, we ask for it separately for each purpose — for example, being contacted by phone, receiving marketing emails, SMS or WhatsApp messages, and analytics or marketing cookies. We record when and where you gave each consent.

You can withdraw consent as easily as you gave it: from Account → Privacy (manage your privacy), from the cookie settings link in the site footer, by using the unsubscribe option in any marketing message, or by writing to [privacy@…]. Withdrawal doesn't affect processing that happened before it. If you withdraw consent needed for a service, we may no longer be able to provide that service.

Where the law provides for registered Consent Managers, you may also give, manage or withdraw consent through one, once we support that route.

5. Cookies and analytics

Essential cookies keep the site working and secure. Analytics and marketing cookies are used only if you allow them in the cookie banner, and you can change your choice at any time. Third-party analytics or advertising tags load only when they are configured and you have consented. See our Cookie Policy.

6. Communication preferences

• Service messages — booking confirmations, account security, report delivery and responses to your requests — are part of providing the service.
• Marketing and educational messages by email, SMS, WhatsApp or phone are sent only with your consent for that channel. Opt out any time using the link in the message, from Account → Privacy, or by writing to us.

We follow applicable rules on commercial communications, including telecom regulations on unsolicited calls and messages.

7. Who we share it with

[List of service providers by category — to be supplied.] Our partners process the data they collect on their own platforms under their own privacy policies. Within CompoundX, staff access is limited by role — for example, a relationship manager sees the enquiries assigned to them.

8. Where your data is stored

Our systems are hosted in [Hosting location(s)]. Some service providers may process data outside India; where they do, we transfer data only as permitted under Indian law and with contractual safeguards.

9. How long we keep it

We keep personal data only as long as needed for the purpose it was collected for, or as required by law. [Retention periods — to be confirmed.]

When a retention period ends, we delete the data or anonymise it so it can no longer identify you.

10. Your rights

Under the DPDP Act you have the right to:

• Access — a summary of the personal data we process about you, the processing we carry out, and the parties we have shared it with.
• Correction, completion and updating — fix inaccurate or incomplete data.
• Erasure — ask us to delete data we no longer need or that you no longer consent to us processing, subject to legal retention requirements.
• Grievance redressal — have a complaint about our handling of your data addressed by our Grievance Officer.
• Nomination — nominate someone to exercise your rights if you die or become incapable.

You also have a duty to provide accurate information and not to file false or frivolous complaints.

11. Data export and deletion requests

You can request an export of your data, a correction, or deletion of your account from Account → Privacy, or by writing to [privacy@…]. We may need to verify your identity before acting. We acknowledge requests promptly and respond within the period required by law. Some records may need to be retained after deletion where the law requires it, and data held by our partners on their platforms is subject to their own policies and legal obligations — we will tell you if that applies.

12. Security

We use safeguards appropriate to financial information, including encryption in transit, hashed passwords and session tokens, encryption of stored secrets, role-based access for staff, audit logs of staff actions, private storage for uploaded files with short-lived access links, file-type checks and, where enabled, malware scanning of uploads, and logging practices that exclude passwords, OTPs and similar secrets. No system is perfectly secure; if a personal data breach occurs, we will inform the Data Protection Board of India and affected users as the law requires.

13. Children

CompoundX is meant for adults. We don't knowingly collect personal data directly from anyone under 18. Information about children entered by a parent or guardian for planning — for example, an education goal — is processed on the parent's or guardian's behalf. We don't track children's behaviour or target advertising at them.

14. Links and partner platforms

Our site links to other websites and, when you choose to invest, to our partner's platform. Their privacy practices are governed by their own policies.

15. Changes to this policy

We will update this policy when our practices or the law change, show the effective date at the top, and tell you about significant changes by email or on the site before they take effect.

16. Contact and Grievance Officer

For questions or to exercise your rights, write to [privacy@…]. For complaints about how we handle personal data, contact our Grievance Officer:

• Name: [Grievance Officer name]
• Email: [grievance@…]
• Phone: [Phone]
• Address: [Registered office]

If you are not satisfied with our response, you may complain to the Data Protection Board of India in the manner provided under the DPDP Act.