Privacy & Data Protection Policy

NexusMind Technologies serves as a Data Fiduciary in compliance with the Digital Personal Data Protection Act, 2023 (DPDP Act) and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.

We process digital personal data only on the lawful basis of your explicit, informed, and affirmative consent for lawful purposes directly connected with delivering quantitative market analytics, portfolio diagnostics, and simulated trading.

We adhere to strict data minimization principles, collecting only essential parameters:

• Account Identity: Full Name, Email Address, and 10-Digit Indian Mobile Phone Number. Used exclusively for authentication, password recovery, and optional alerts.
• KYC Verification: Permanent Account Number (PAN) used solely for ensuring singular account integrity and anti-fraud verification in Indian capital markets.
• Portfolio Holdings (Voluntarily Uploaded): Stock symbols, mutual fund scheme names, invested capital, and purchase prices. Uploaded statements are analyzed in-memory and stored with strict user-level isolation to compute real-time P&L and fee drag diagnostics.
• Technical Telemetry: Log timestamps, IP address, and browser session headers used strictly for DDoS prevention, rate limiting, and server uptime diagnostics.

In compliance with Section 43A of the Information Technology Act, 2000, we maintain comprehensive physical, electronic, and procedural safeguards:

• One-Way Password Hashing: Passwords are never stored in plain-text. Passwords undergo salted PBKDF2-HMAC-SHA256 cryptographic hashing with high iteration counts.
• End-to-End Encryption in Transit: All communications between your client device and our AWS EC2 cloud infrastructure are secured via 256-Bit TLS / SSL encryption.
• Zero Storage of Broker Credentials: We never store your broker passwords, trading MPINs, or two-factor authentication (TOTP) keys. Broker deeplinking utilizes official client-side redirection or broker token authorization.

Your financial privacy is non-negotiable. NexusMind Technologies has never sold and will never sell, lease, rent, trade, or monetize your personal details, portfolio holdings, or financial habits to third-party telemarketers, credit card issuers, or advertisers.

Data is only shared when explicitly required by law enforcement authorities upon receipt of a lawful order issued by a competent Indian court or regulatory authority having jurisdiction.

Under Chapter III of the DPDP Act, 2023, you enjoy statutory rights regarding your personal information:

• Right to Access & Summary: You may inspect all personal information and portfolio holdings stored across your profile console.
• Right to Correction & Updating: You may update your profile, contact credentials, or risk preferences at any time.
• Right to Complete Erasure (Account Deletion): You may permanently delete your account directly through the Profile Settings tab. Account deletion instantly and irrevocably purges your credentials, holdings, and portfolio history from our database.
• Right to Grievance Redressal: You may submit privacy grievances to our appointed Data Protection Officer.

Our core server infrastructure is provisioned in the AWS Asia Pacific (Mumbai) region (ap-south-1) within the sovereign territory of the Republic of India. User data resides securely within Indian legal boundaries in compliance with Indian regulatory guidance.