Diversifi — Privacy Policy

Effective Date: 1 March 2026 Last Updated: 1 July 2026

This Privacy Policy explains how Diversifi Investment Advisory Private Limited (formerly Diversifi Labs Private Limited) (CIN: U63111KA2025PTC200024), a company incorporated under the Companies Act, 2013, with its registered office at 24, 2nd Cross, BDA Layout, Sy No. 52, Tavarekere, Bangalore, Karnataka 560029, India ("Diversifi", "we", "our" or "us"), collects, uses, stores, shares and protects your personal information when you access or use the Diversifi website (https://diversifi.in), mobile application(s) (on the Apple App Store and Google Play Store) and related online services (collectively, the "Platform").

Diversifi (or its relevant entity, as disclosed on the Platform) is registered with the Securities and Exchange Board of India ("SEBI") as a Non-Individual Investment Adviser (SEBI Registration No. INA000021711).

This Policy is published in compliance with applicable Indian law, including the Digital Personal Data Protection Act, 2023 and the rules made thereunder (the "DPDP Act"), and, during the transition period, the Information Technology Act, 2000 (including Section 43A and Section 72A), the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 ("SPDI Rules"), and the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 ("IT Rules, 2021").

This Policy forms part of, and should be read with, our Terms of Service. By using the Platform, you acknowledge that you have read and understood this Policy. Where required by law, we obtain your consent for specific processing activities.

1. Definitions

"Personal Data" / "Personal Information" means any data about an individual who is identifiable by or in relation to such data. It includes "sensitive personal data or information" under the SPDI Rules (such as financial information) during the transition period.
"Data Principal" means the individual to whom the Personal Data relates (you).
"Data Fiduciary" means the person who determines the purpose and means of processing Personal Data (Diversifi).
"Data Processor" means any person who processes Personal Data on our behalf.
"Processing" means any operation performed on Personal Data, such as collection, storage, use, sharing, or erasure.

2. Consent and Acknowledgment

By providing your Personal Data to us, or by accessing or using the Platform, you consent to the collection, use, storage, sharing and processing of your Personal Data as described in this Policy and in accordance with Applicable Law. Your consent is sought for specified purposes and may be withdrawn at any time (see Section 9). You may also be asked to provide specific, itemised consent for certain processing activities (for example, connecting your portfolio data or receiving advisory Services). Withdrawing consent may limit or prevent your use of certain features or the Services.

3. Information We Collect

We collect only the information needed to provide and improve the Services. The categories include:

a) Identity and contact information. Your name, mobile number (the primary identifier for your Account), email address, and date of birth.

b) Profile and financial-suitability information. Information you provide to build your investor profile and to enable suitability assessment, such as your annual income band/range, investment style and experience, investment goals/challenges, and risk profile. (We collect income as a band/range, not exact figures.)

c) Portfolio and holdings information. Details of your investment holdings and portfolio — such as securities held, quantities, average buy prices, current values, holding periods, gains/losses, portfolio value, net worth view, and related analytics — obtained when you upload a holdings file, upload a screenshot, enter data manually, or connect a brokerage account.

d) Brokerage connection information. Where you connect an external account, the access tokens and account identifiers needed to retrieve your holdings on a read-only basis (for example, through the smallcase gateway or a broker's authorised connection).

e) Usage, device and technical information. Information about how you interact with the Platform, including activity logs, device identifiers and push-notification tokens, IP address, browser/operating system, app version, and dates and times of access. We may use cookies and similar technologies (see Section 8).

f) Communications. Records of your communications and feedback with us, including support queries.

g) AI chat content and stated preferences. The messages, questions and context you enter into our AI chat / conversational assistant, and any preferences you choose to share through it or your profile (for example, your risk appetite, investment goals and investing style). We may retain this to provide and personalise the Services. Please do not enter passwords, OTPs, or other people's personal data into the chat.

What we currently do NOT collect / store. As of the date of this Policy, we do not collect or store your PAN, Aadhaar, bank account number, demat account number, or signature. Where a document or upload happens to contain identifiers such as a PAN, we redact or filter them before processing.

Future KYC, payments and bank-linking. When we launch our investment advisory service, we will be required to collect and process KYC information (which may include your PAN, identity and address proof, bank and demat details, income details, and information for risk profiling and anti-money-laundering compliance), including through a SEBI-registered KYC Registration Agency (KRA). We may also introduce payment features (handled by third-party payment providers) and bank/financial-account linking (for example, via the RBI Account Aggregator framework). We will collect such data only with the necessary consents and notices, and will update this Policy accordingly before doing so.

4. How We Collect Information

Directly from you — when you register, build your profile, upload or enter portfolio data, communicate with us, or use Platform features.
Automatically — through your use of the Platform, via logs, cookies and similar technologies.
From third parties you authorise — such as brokers and connection gateways (for example, smallcase or a broker API) from which we retrieve your holdings with your authorisation.

5. How We Use Your Information

We use your Personal Data to:

create and manage your Account and verify your identity (including via OTP);
provide the Services — including portfolio display and analytics, diversification and risk insights, and general, AI-assisted Insights & Alerts (and, if and when we launch our advisory subscription, personalised advisory Services);
build your investor profile and, if and when you opt in to our advisory subscription, assess suitability of advice against your risk profile, as required by the SEBI IA Regulations;
operate, maintain, secure, troubleshoot and improve the Platform, and conduct internal research and analytics;
communicate with you about your Account, transactions, security, service updates and grievances, and (where you have not opted out) marketing;
detect, prevent and address fraud, security incidents, abuse and prohibited activity;
comply with our legal and regulatory obligations, including SEBI requirements (such as suitability, record-keeping and grievance redressal) and tax, anti-money-laundering and other laws, and to respond to lawful requests from regulators, courts and authorities; and
for measurement of, and reporting on, our advertising and marketing (see Section 7).

We process your Personal Data on the basis of your consent and, where applicable, to perform our contract with you, to comply with legal obligations, and for other lawful purposes permitted under Applicable Law.

6. AI and Automated Processing

The Platform uses artificial intelligence / large language models and quantitative models to generate general Insights & Alerts, research summaries, narratives and chat responses (and, if and when we launch our advisory subscription, personalised Recommendations), and to assist with tasks such as mapping uploaded files and extracting holdings from screenshots. To do this, relevant portfolio data (such as holdings, tickers, weights and sector information), your investment-style and stated preferences, and the text you enter in chat are processed by our internal AI systems and, where applicable, by third-party AI/model providers engaged by us (see Section 7). We design these flows to minimise the personal identifiers shared with AI components (for example, by not passing your name, email or phone number to the model where it is not required).

Personalisation and profiling. Our AI systems may analyse your interactions, queries, stated preferences and portfolio data to tailor the research, insights and responses shown to you and to improve the Services, and — if and when you opt in to our advisory subscription — to assess suitability against your risk profile.

Limitations and accountability. AI outputs have inherent limitations and may be inaccurate or incomplete. The Platform does not use AI to execute trades or take custody of your assets. Our Insights & Alerts are general in nature and are informational only; they do not constitute personalised Investment Advice unless expressly identified as such. To the extent any output is nonetheless determined to constitute Investment Advice under Applicable Law, we remain accountable for it as a SEBI-registered Investment Adviser. You may contact us to request information about the logic involved in the automated processing that affects you.

7. How We Share Information and Our Sub-Processors

We do not sell or rent your Personal Data. We share it only as described below:

a) Service providers and sub-processors. We share Personal Data with trusted third-party service providers who process it on our behalf to provide and support the Services, under contractual confidentiality and data-protection obligations and only for the purposes for which it is shared. These include providers for:

cloud hosting, storage and infrastructure (primarily in India);
artificial intelligence and large language model processing (which, as described in Section 6 and Section 13, may include providers located outside India);
communications (such as SMS/OTP, push notifications and email);
market, securities and news data;
brokerage and portfolio-connection gateways (to retrieve your holdings);
marketing, advertising and analytics (to which we share only hashed/pseudonymised identifiers and event data — see (b)); and
performance monitoring, diagnostics and security.

We share with each such provider only the data needed for its function. Our service providers and their locations may change from time to time.

b) Marketing and advertising. We may share hashed (pseudonymised) identifiers (such as a hashed email or phone number) and conversion events with advertising platforms to measure and improve our marketing. You may opt out of such use as described in Section 9 and via your device/platform settings.

c) Regulators and legal compliance. We may share information with SEBI, BASL, KYC Registration Agencies, stock exchanges, tax and law-enforcement authorities, courts, and other competent bodies, where required by Applicable Law, to comply with our obligations as a registered Investment Adviser, or to protect our or others' rights, safety and property and to prevent fraud or unlawful activity.

d) Corporate transactions. If we undergo a merger, acquisition, reorganisation or sale of assets, your Personal Data may be transferred to the successor entity, subject to this Policy and Applicable Law.

e) Anonymised / aggregated data. We may create and use anonymised and aggregated data (which does not identify you) for analytics, research, benchmarking and other lawful business purposes, and may share it with third parties.

8. Cookies and Similar Technologies

We and our service providers may use cookies, SDKs, device identifiers, beacons and similar technologies to operate the Platform, remember your preferences, maintain sessions, analyse usage, and support security and marketing. You can control cookies through your browser or device settings; disabling some may affect functionality.

9. Your Rights and Choices

Subject to Applicable Law, you have the right to:

Access the Personal Data we hold about you and obtain a summary of it;
Correct, complete or update inaccurate or incomplete Personal Data;
Erase your Personal Data, subject to legal and regulatory retention requirements (see Section 11);
Withdraw consent for processing (which will not affect prior lawful processing), and opt out of promotional communications at any time;
Nominate another individual to exercise your rights in the event of death or incapacity, as provided under the DPDP Act; and
Grievance redressal — raise concerns about our handling of your Personal Data (see Section 16).

How to exercise your rights / delete your Account. You can review and update much of your information within the Platform, and you can request Account deletion through the Platform or by contacting us at developer@diversifi.in. On a deletion request, we will delete or anonymise your Personal Data, except information we are required or permitted to retain under Applicable Law — including SEBI record-keeping requirements (see Section 11) — and limited identifiers we may retain for fraud-prevention, security, account-recovery and legal-compliance purposes. We will inform you where retention applies.

10. Data Security

We implement reasonable administrative, technical and physical security measures appropriate to the nature of the data we hold, consistent with industry practice and Applicable Law, including access controls, encryption in transit (HTTPS/TLS), and restricted, need-to-know access by our personnel. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your credentials (including OTPs) confidential and your device secure. If you suspect your Account has been compromised, contact us immediately.

11. Data Retention

We retain your Personal Data only for as long as is necessary for the purposes set out in this Policy, unless a longer retention period is required or permitted by law. How long we retain data depends on factors such as the type of data, the purpose for which it was collected and processed, and our legal, regulatory and operational requirements. In particular:

as a SEBI-registered Investment Adviser, we are required to retain advisory and related records (including KYC, risk-profiling, suitability and advice records) for the period prescribed under Applicable Law (currently at least five (5) years), and such records will be retained even after Account closure to meet this obligation; and
on Account deletion, and once any applicable retention period has expired, we will delete or anonymise your Personal Data, except for data we are required or permitted to retain under Applicable Law (including the SEBI retention above) and limited identifiers retained for fraud-prevention, security and legal-compliance purposes.

Upon expiry of the applicable retention period, your Personal Data is securely deleted or irreversibly anonymised.

12. Children's Data

The Platform is intended only for individuals aged 18 and above. We do not knowingly collect Personal Data from anyone under 18. If we become aware that we have inadvertently collected Personal Data of a minor without verifiable parental/guardian consent as required by law, we will take steps to delete it. We do not undertake behavioural tracking or targeted advertising directed at children.

13. Data Storage and Cross-Border Transfers

Your Personal Data is stored and processed primarily within India, on cloud infrastructure located in India (currently Google Cloud Platform). As a result, your data is, as a general matter, subject to Indian data protection law, including the DPDP Act.

The principal exceptions are certain AI / large language model processing and certain performance-monitoring and diagnostics providers: some AI features may, from time to time, be served by model providers whose processing occurs outside India (for example, in the United States), and limited technical and usage telemetry (such as request performance data) may be processed by monitoring and diagnostics providers located outside India. In such cases, only the data needed for that feature or function is processed (and, for AI features, we seek to minimise personal identifiers, as described in Section 6). Where we transfer or allow processing of Personal Data outside India, we do so in accordance with Applicable Law — including any restrictions notified by the Government under the DPDP Act — and subject to appropriate contractual and security safeguards. We will update this Policy if our storage or processing locations materially change.

14. Data Breach Notification

In the event of a personal data breach, we will take prompt remedial action and will notify affected individuals and the relevant authority (including the Data Protection Board of India and/or CERT-In) within the timelines and in the manner required by Applicable Law.

15. Third-Party Websites and Services

The Platform may link to or integrate with third-party websites and services that operate under their own privacy policies. We are not responsible for the privacy practices or content of such third parties. We encourage you to review their policies before sharing your information with them.

16. Grievance Officer and Contact

If you have any questions, concerns or complaints about this Policy or our handling of your Personal Data, or wish to exercise your rights, please contact our Grievance Officer:

Grievance Officer: Rishabh KhannaEmail: developer@diversifi.inPhone: 8882291490Address: 24, 2nd Cross, BDA Layout, Sy No. 52, Tavarekere, Bangalore, Karnataka 560029, India

We will acknowledge and respond within the timelines required by Applicable Law (generally acknowledgment within 24 hours and resolution within 15 days under the IT Rules, 2021, and within the timelines under the DPDP Act and SEBI norms, as applicable). If you are not satisfied, you may escalate to the Data Protection Board of India (for data-protection matters) or, for securities-market matters, through SEBI's SCORES portal (https://scores.sebi.gov.in) and the SMART ODR portal (https://smartodr.in).

17. Governing Law

This Policy is governed by the laws of India. Any disputes are subject to the exclusive jurisdiction of the courts at Bengaluru, Karnataka, and to the dispute-resolution and grievance mechanisms set out in our Terms of Service.

18. Changes to this Policy

We may update this Policy from time to time to reflect changes in our practices, technology or Applicable Law. We will revise the "Last Updated" date and, where required, notify you. Your continued use of the Platform after changes take effect constitutes acceptance of the revised Policy. Please review this page periodically.

19. Contact Us

Diversifi Investment Advisory Private Limited (formerly Diversifi Labs Private Limited) Registered Office: 24, 2nd Cross, BDA Layout, Sy No. 52, Tavarekere, Bangalore, Karnataka 560029, India CIN: U63111KA2025PTC200024 · SEBI RIA Reg. No.: INA000021711 Email: developer@diversifi.in Website: https://diversifi.in (also available as the Diversifi mobile app on the Apple App Store and Google Play Store)