This Privacy Policy applies to the website https://inve.money and the Drishti Android mobile application (package money.drishti.app) distributed via Google Play (collectively, the "App"). This policy explains how information is collected, used, disclosed, and safeguarded when you use the App.

1. Information We Collect

a) Personal Information

When you register or use the App, we may collect:

Phone number in E.164 format (e.g. +91XXXXXXXXXX). This is the primary sign-in identifier; a one-time SMS verification code is sent via Google Firebase Authentication and only the verified number is stored. The SMS content itself is never received or stored.
Name and email address (if provided in your profile)
Date of birth (if provided)
PAN card number (if provided for portfolio verification)

b) Financial Information

To provide portfolio analysis, we may collect:

Stock holdings data (ticker symbols, quantities, average buy prices) imported via CSV upload
Portfolio risk profile and preferences

No broker login credentials are collected or stored.

c) Usage Data

Pages visited, features used, and interaction patterns
Device information, browser type, and IP address
API usage logs for rate limiting and service improvement

d) Mobile App Data

App version, Android OS version, and device model
Crash and stability logs (no personally identifiable content)
Play Integrity tokens — short-lived attestations issued by Google Play Services that verify the app installation is genuine. Used only to prevent fraud and abuse; not linked to user identity.

2. How We Use Your Information

Collected information is used to:

Provide, maintain, and improve portfolio analysis features
Generate risk analysis reports, red flag detection, and earnings call summaries
Process subscription payments and manage your account
Send service-related communications (account alerts, updates)
Monitor and enforce usage limits based on your subscription plan
Ensure security and prevent fraud or abuse

3. Data Sharing and Disclosure

Your personal or financial data is never sold. Information is shared only with the following sub-processors acting under standard data-processing agreements:

Google Firebase Authentication: Sends the SMS one-time password and issues a verified identity token used to create your account. Receives only the phone number entered during sign-in.
Google Play Integrity API: Verifies that the Android app install is genuine, to prevent fraud and account takeover. Does not receive personal data.
Razorpay: Processes subscription payments. Card and bank details are entered into Razorpay's hosted checkout and never reach the App's servers.
AI service providers (Anthropic, Google Vertex AI): Anonymized or aggregated portfolio data is sent to generate analysis. Phone numbers, email addresses, and PAN are never included in these requests.
Hosting providers: The website is served by Vercel and the backend API runs on Railway. Both providers process data on behalf of the App only.
Legal requirements: When required by law, regulation, or valid legal process.

4. Data Security

Industry-standard security measures are implemented, including:

HTTPS encryption for all data in transit
Encrypted storage for sensitive tokens
Content Security Policy (CSP) headers and XSS protection
Token-based authentication with automatic session invalidation

No method of electronic transmission or storage is 100% secure, and absolute security cannot be guaranteed.

5. Data Retention and Account Deletion

Personal data is retained for as long as your account is active or as needed to provide the App's features. To request deletion of your account and all associated data (phone number, holdings, risk profile, and usage logs):

Email info@inve.money from the phone number or email address registered on your account, with the subject line "Account Deletion Request".
Receipt is acknowledged within 2 business days and deletion is completed within 7 business days.

Anonymized aggregate analytics (no personally identifiable content) may be retained for service-improvement purposes.

6. Cookies and Tracking

Essential cookies and local storage are used for authentication (auth tokens) and user preferences. No third-party advertising or tracking cookies are used.

7. Third-Party Links

The App may contain links to third-party websites (e.g., stock exchanges, broker platforms). No responsibility is assumed for the privacy practices of these external sites.

8. Children's Privacy

The App is not intended for users under the age of 18. Personal information from minors is not knowingly collected. If you believe such information has been collected, please contact us immediately.

9. Your Rights

You have the right to:

Access and review the personal data held about you
Request correction of inaccurate data
Request deletion of your account and associated data
Opt out of non-essential communications

To exercise any of these rights, contact: info@inve.money.

10. Changes to This Policy

This Privacy Policy may be updated from time to time. Changes will be posted on this page with an updated "Last updated" date. Continued use of the App after changes constitutes acceptance of the revised policy.

11. Contact

For questions about this Privacy Policy:

Email: info@inve.money
Website: https://inve.money