Privacy Policy

At Fin 100X.AI, yourr privacy is our priority. We are committed to protecting your personal and financial information in line with Indian data protection regulations (DPDP Act, RBI/SEBI/IRDAI standards).

Fin 100X.AI – Privacy Policy (DPDP Act 2023, RBI, SEBI, IRDAI, CERT-IN Compliant)

  1. Preamble & Introduction This Privacy Policy (“Policy”) governs the manner in which Fin 100X.AI Technologies Private Limited (“Fin 100X.AI”, “we”, “our”, “us”) collects, uses, stores, shares, and protects the personal data of its users (“you”, “your”, “Data Principals”). Fin 100X.AI is India’s first protocol-governed AI-powered financial operating system, designed to empower Youth, Gen Z, Gen Alpha, and first-time earners across Bharat with financial dignity, security, and freedom. We are not an NBFC, insurer, or mutual fund distributor. Instead, we operate as a protocol-governed AI platform that integrates licensed financial entities (banks, insurers, mutual fund houses, credit bureaus, retirement providers, etc.) via secure APIs and SDKs. By using our app, website, WhatsApp onboarding, or any services offered through our modules (Fin AI, Fin Advisor, Fin Literacy, Fin Score, Credit Booster, Investment Planner, Insurance Analyzer, Retirement Planner, Tax Estimator, Fraud Shield), you consent to the practices described in this Privacy Policy. This Policy has been drafted in compliance with: Digital Personal Data Protection Act, 2023 (DPDP Act) Reserve Bank of India (RBI) circulars and Master Directions Insurance Regulatory and Development Authority of India (IRDAI) guidelines Securities and Exchange Board of India (SEBI) cybersecurity & data protection norms CERT-IN Cybersecurity Directions, April 2022 Judicial precedents including Justice K.S. Puttaswamy v. Union of India (2017)
  1. Scope & Applicability This Privacy Policy applies to: All users of the Fin 100X.AI mobile app, website, and WhatsApp channels All categories of personal and financial data processed by us All interactions between users and our AI modules, APIs, and partner services

It does not apply to: Services provided directly by licensed banks, insurers, or AMCs accessed via our platform (such services are governed by the provider’s policies) Third-party websites or apps that may be linked within our platform

Important Clarification: Fin 100X.AI acts as a Data Fiduciary under DPDP. Licensed entities we integrate with may act as Joint Fiduciaries or Independent Fiduciaries depending on the nature of service.

  1. Definitions Unless otherwise specified, the following terms have the meanings set forth under the DPDP Act 2023 and applicable RBI/IRDAI/SEBI regulations: “Personal Data” means any data about an individual who is identifiable by or in relation to such data. (DPDP Sec. 2(t)) “Sensitive Personal Data” includes financial information, Aadhaar, PAN, biometric identifiers, and KYC details. “Processing” means collection, storage, retrieval, use, sharing, or erasure of personal data. “Data Fiduciary” means Fin 100X.AI, which determines the purpose and means of processing. “Data Principal” means the individual user to whom the personal data relates. “Consent Manager” means an entity registered under DPDP to manage user consent requests. “Financial Data” means information relating to a user’s creditworthiness, loans, investments, insurance, or retirement funds (aligned with Credit Information Companies Regulation Act, 2005). “Nominee” means a person designated by the Data Principal to exercise rights posthumously (DPDP Sec. 13).
  1. Data We Collect Fin 100X.AI collects and processes the following categories of data:
  2. Identity Data – Name, age, gender, contact information, Aadhaar/PAN (for KYC where required).
  3. Financial Data – Salary details, credit history, SIP contributions, insurance premiums, NPS/retirement savings, tax filings.
  4. Device & Technical Data – IP address, device identifiers, browser type, app logs, cookies.
  5. Behavioural Data – Spending patterns, savings behaviour, SIP preferences, repayment behaviour.
  6. Communication Data – Chats with Fin AI, interactions with Fin Advisor, WhatsApp onboarding messages, grievance tickets.

We collect only such data that is necessary and proportionate to provide our services.

  1. Purpose of Collection & Lawful Basis We collect personal data strictly for lawful purposes as defined under DPDP Sec. 4. These include: Delivering financial advisory and literacy services (Fin AI, Fin Advisor, Fin Literacy) Facilitating API-based integrations with licensed partners Assessing creditworthiness & boosting credit scores (via CRIF, CIBIL, Experian, Equifax) Fraud detection & cybersecurity (CERT-IN directive compliance) Compliance with RBI, SEBI, IRDAI, PFRDA obligations Improving AI recommendations through anonymized, aggregated data analytics

We do not collect data for unlawful, unauthorized, or discriminatory purposes.

  1. Consent Framework As mandated under DPDP Act, Sec. 6: Consent must be free, informed, specific, and unambiguous. Consent is taken via app checkboxes, OTP-based confirmations, WhatsApp opt-ins, or digital signatures. Consent may be withdrawn anytime by contacting us. Withdrawal shall not affect the legality of prior processing.

Children’s Data: For users below 18 years, verifiable parental consent is mandatory. We do not profile or market financial products to minors.

  1. Data Sharing & Processing We may share data with: Banks, NBFCs, MFIs – for credit evaluation & loan APIs Insurers – for insurance planning modules (IRDAI PoSP framework) Mutual Fund Houses (AMCs) – for SIP and investment modules Retirement Providers (PFRDA, NPS APIs) – for pension planning Credit Information Companies (CRIF, CIBIL, Experian, Equifax) – for credit score retrieval Regulatory Authorities – RBI, SEBI, IRDAI, PFRDA, Income Tax Dept., on lawful request CERT-IN – in case of cyber incidents

Data is never sold or shared with advertisers.

  1. Storage & Security Data is stored in India-only servers (DPDP Sec. 16 compliance). Encryption: AES-256 at rest and TLS 1.3 in transit. Zero-trust security model with multi-factor authentication. Logs retained for minimum 180 days per CERT-IN directive. Regular security audits & penetration testing by CERT-IN empanelled auditors.
  1. User Rights As per DPDP Act, Sec. 12–14, you have the following rights: Right to Access: Obtain copy of your personal data. Right to Correction: Correct or update your data. Right to Erasure: Request deletion, subject to RBI/SEBI/IRDAI retention obligations. Right to Portability: Transfer your data via DigiLocker/API frameworks. Right to Nominate: Designate a nominee to manage data in case of death.
  1. Data Retention Credit Data – retained 5 years (RBI CICRA norms). Insurance Data – retained 7 years (IRDAI retention). Tax Data – retained 8 years (Income Tax Act Sec. 149). After expiry, data is securely deleted unless legally required. Deletion requests processed within 30 days.
  1. Cross-Border Data Transfers Permitted only to “Trusted Jurisdictions” notified by the Central Government. Subject to binding contractual clauses and DPDP Sec. 16 safeguards. Sensitive data is not transferred to non-trusted jurisdictions.
  1. Grievance Redressal Data Protection Officer (DPO): [Name, Email, Phone to be inserted] Complaints may be filed via app, email, or website. Resolution timeline: 7–30 days. If unresolved, escalation may be made to the Data Protection Board of India (DPB).
  1. Children’s Data Strict compliance with Sec. 9, DPDP Act. Parental consent mandatory for minors. No profiling, targeted ads, or behavioural analytics for children.
  1. Cookies & Identifiers Cookies used for functionality, analytics, and security. No behavioural advertising cookies. Users may opt-out anytime via browser/app settings.
  1. Third-Party SDKs & APIs Firebase, Google Analytics (minimal scope). Licensed financial partners (CRIF, BSE StAR MF, IRDAI PoSP). Each partner is bound by DPDP, RBI, IRDAI, SEBI compliance contracts.
  1. Updates to Policy Updated versions will be published on our website/app. Users will be notified 15 days in advance of material changes. Continued use post-update implies consent.
  1. Dispute Resolution Governed by laws of India. Any disputes will be resolved by arbitration under the Arbitration and Conciliation Act, 1996. Jurisdiction: Mumbai, Maharashtra.
  1. Annexures Annexure A: RBI/SEBI/IRDAI/CERT-IN circulars and references Annexure B: Case law precedents (Puttaswamy, Aadhaar rulings, Bombay HC on DP obligations) Annexure C: Data Flow Diagram (Collection → Processing → Secure Storage → Deletion) Annexure D: Consent templates (WhatsApp, App, Web)

DPDP Act 2023 alignment, RBI/SEBI/IRDAI/CERT-IN references, arbitration clauses, annexures, and compliance notes.