Privacy
The most honest privacy stance we could design.
Aumsetu is architected so that your clients’ personal or financial information never leaves your browser. Not because we promise not to look — because there is nothing on our servers to look at.
Where your data actually lives
| What | Where it lives |
|---|---|
| Your firm branding (name, ARN, mobile, logo, address you enter at /setup) |
Your own browser’s localStorage, plus one first-party cookie, aumsetu_v1 (12 months), that copies your MFD Key, verified name, ARN, mobile, email, firm, city, state, tagline, website and address so you are still recognised if browser storage is cleared. A cookie travels to aumsetu.com with every page request; our server does not read or keep it. Uploaded to our database only if you switch Sync on (below). The Reset button at /setup removes both. |
| Calculator inputs (client name, amounts, ages, etc.) |
Never sent to our servers. Most tools forget them when you close the page. A few keep a copy on your own device until you clear it: the Family Plan (member names, ages, incomes), the Child Future Planner (children’s names, ages, goals and any schemes the MFD picks), plans you save by name in a planner, the Desk scratchpad and ARN reminders, the CAS holdings you pass to the Screener, and saved screener views. Do not use these tools on a shared computer. |
| Client CAS PDFs (uploaded to the CAS Analyzer) |
Parsed in-browser by pdf.js. Never uploaded to any server. |
| Generated PDFs (SIP reports, proposals, letters) |
Built by your browser using jsPDF. Before it is saved, a preview of the same file is drawn by your browser with pdf.js (served from aumsetu.com). Nothing is uploaded; the file is saved directly to your device. |
| MFD Circle applications (only the MFD’s own name, ARN, mobile, email) |
Stored in our Supabase database. Required to verify against AMFI. |
| Your firm branding, if you switch Sync on (firm name, your name, tagline, website, address, logo) |
Stored in our Supabase database, so the same branding appears on your other devices. Off by default. Switch Sync off at /setup and the stored copy is erased. This is your firm’s information, never a client’s. |
| Tool-usage counters (which gated tool was opened, by which MFD Key, and the member’s state) |
Stored in our Supabase database and aggregated for the analytics dashboard — for example, how many members used a tool and which states they are in. These are tied to your MFD Key, so they are not anonymous; they never include anything you type into a tool about a client. The order of listings in the public directory changes from time to time and takes recent activity on Aumsetu into account; no activity figures are ever shown publicly. |
| Directory reports (a visitor reporting a listing: the ARN, the reason, and an optional email) |
Stored in our Supabase database so we can look into the report and, if you gave an email, reply to you. Ask and we delete it. |
| Special Thanks entries (name, photo, ARN of people thanked on /thanks) |
Stored in our Supabase database and shown publicly, only with that person’s consent. Ask and we remove it. |
| Circle waiting list (after registration closes: the MFD’s own name, ARN, mobile, city and state) |
Stored in our Supabase database only to offer a place, in the order of joining, when one opens — we contact you on that mobile number about the Circle and nothing else. Ask and we remove it. |
What we collect from Circle members
If you apply for the Aumsetu MFD Circle, we collect exactly what the application form shows:
- Your real name — matched against AMFI records
- Your ARN — matched against AMFI records
- Your mobile number — to send you the MFD Key on WhatsApp
- Your email address — for future MFD Circle communication (optional)
- Your legal firm name, state, city, years of practice — for the public directory (only if you opt in)
- Your directory and newsletter opt-in choices
We store this in Supabase (hosted in AWS Asia-Pacific). We do not sell it, do not share it with third parties, and do not use it for advertising. If you want your record removed, WhatsApp us and we will delete it within 7 working days.
What we keep when you send feedback
The feedback page is open to anyone. What it keeps:
- Your message, what it is about, which tool, and the page you came from
- Your name and a mobile number or email — only if you choose to give them, so that we can reply
- A random number stored in your browser and a one-way scrambled form of your network address — only to stop one sender flooding the inbox. The scrambled address is wiped after 24 hours.
Only the Aumsetu team reads feedback. Nothing you write is shown publicly: the “You said, we did” list carries a line we write ourselves, with your first name only if you ticked the box. A message that looks like it holds a client’s PAN, mobile number, email, Aadhaar, folio or account number is refused and not stored.
How long we keep it
The DPDP Act does not let anyone hold personal data indefinitely just because it is convenient. So:
| What | How long |
|---|---|
| An active Circle member’s record | For as long as you are a member. Ask us to delete it and we do, within 7 working days. |
| An application we could not verify, or a key never activated | 24 months from the date you applied, then deleted. We keep it that long only so we can tell you what happened if you ask, and so a re-application is not treated as a stranger. |
| Synced firm branding | Until you switch Sync off, or your membership record is deleted — whichever comes first. |
| Feedback | Your name and contact: 12 months, then removed. The message itself: 24 months, then deleted. The scrambled network address: 24 hours. Ask us and we delete your feedback sooner. |
| Usage counters | Kept in aggregate. The link between a counter and a key is removed when the member record is deleted. |
| Vercel and Supabase infrastructure logs | Held by those providers on their own schedules. We do not control them and we do not read them. |
Cookies and trackers
Aumsetu does not use analytics cookies, marketing pixels, or ad-tech. There is no Google Analytics and no Facebook pixel, and no third-party analytics of any kind. The site counts page views itself: when a page loads it sends the address of that page and nothing else to Aumsetu’s own database, which keeps one row per page per day with a number on it. For the counter: No cookie is set, no identifier is created, and your IP address, browser and referrer are not recorded in our table (Vercel’s and Supabase’s own request logs do see the IP; see below). That row cannot describe you even in principle, because one row covers everybody who opened that page that day. Typefaces are served from aumsetu.com itself, so a page load fetches nothing from any third party. The counter is listed below.
The one cookie we do set is aumsetu_v1, described in the table above: first-party, 12 months, only after you set up branding or verify your ARN, and removed by the Reset button at /setup.
Browser storage (localStorage) on your device. Pages keep small entries there: your branding (aumsetu_branding_v1), recently used tools (aumsetu_recent_v1), language choices, NISM mock-test progress and the name you type for a score card (nism_certname), ARN reminders (arn_reminders), and the client data some tools save on purpose: Desk notes (aumsetu_desk_notes_v1), the Family Plan (aumsetu_family_plan_v1), the Child Future Planner (aumsetu_child_plan_v1), plans you save by name in a planner (aumsetu_saved_plans_v1 — a PAN is never kept there; “Backup to a file” writes them to a file on your own device, which only you hold), CAS holdings passed to the Screener (aumsetu_client_holdings_v1) and saved screens (aumsetu_screens_v1). None of it is sent to us. Clear your browser storage, or use the Reset button at /setup, to remove it.
Third-party services we use
- Vercel — hosts the static site. Sees standard access logs (IP, user-agent) retained per Vercel’s own policy.
- Aumsetu’s own page counter — not a third party at all, listed here so the count is not a surprise. Each page load adds one to a daily total for that page, stored in Aumsetu’s Supabase database. The stored row is the date, the page address and a number. Nothing else is sent and nothing else is kept.
- Supabase — hosts the MFD Circle database. Sees only what is in the tables above.
- Cloudflare — DNS provider for aumsetu.com. Sees domain lookups only.
- AMFI public portal — we manually cross-check each Circle applicant’s ARN there.
- FinAPI (finapi.upvaly.com) — the data source for scheme facts in the Fund Explorer, the Screener and the planners’ scheme search. Aumsetu’s own server asks it for a scheme code or the search words typed; it never receives your IP address, who you are, or anything about a client.
- Google Maps — only when you click to show an office location on a directory listing or an MFD’s page. The map then loads from Google, which sees your IP address as any website you visit would. Nothing is sent to Google until you click.
Your rights under the DPDP Act, 2023
If we hold personal data about you — as a Circle member, a directory reporter who left an email, a person on the Special Thanks page or the Circle waiting list, or someone who sent feedback and left a name or contact — you have the right to:
- Access the personal data we hold about you
- Correct any inaccurate details
- Request deletion of your record
- Withdraw consent for future communications, or withdraw consent altogether
- Nominate someone to exercise these rights on your behalf if you die or become unable to act
- Raise a grievance with us, and escalate it if our answer does not satisfy you
To exercise any of these rights, write to info@aumsetu.com or WhatsApp +91 95412 23377. We aim to respond within 7 working days.
Withdrawing consent does not undo anything already done while it was in force, and it may mean we can no longer keep your directory listing or your MFD Key working — there would be nothing left to match you against.
Grievance Officer
Under section 13 of the DPDP Act, 2023, every Data Fiduciary must publish a contact who answers complaints about how personal data is handled. For Aumsetu that is:
Deepak Singla — Grievance Officer
Email: info@aumsetu.com
WhatsApp: +91 95412 23377
Near Indusind Bank, Aastha Hospital Street, Chotala Road,
Mandi Dabwali – 125104, Haryana, India
Aumsetu is run by one person, so that person is the Grievance Officer. Write with “Grievance” in the subject line and you will get an acknowledgement within 3 working days and an answer within 30 days.
If our answer does not satisfy you, you may complain to the Data Protection Board of India under section 27 of the Act. Exhausting the route above first is a requirement of the Act, not a courtesy.
Data breach
If we discover any unauthorised access to Circle member data, we will notify affected members within 72 hours via the mobile and email they submitted, and post a public notice on this page.
Data Fiduciary
Aumsetu is a non-commercial personal community initiative by Deepak Singla, an AMFI-registered Mutual Fund Distributor (ARN-76535). It is not a company and is not operated by one. The Data Fiduciary under the DPDP Act, 2023 is therefore:
Deepak Singla
AMFI-registered Mutual Fund Distributor · ARN-76535
Near Indusind Bank, Aastha Hospital Street, Chotala Road,
Mandi Dabwali – 125104, Haryana, India
WhatsApp: +91 95412 23377
Changes to this policy
Material changes will be noted here with a revised effective date. Circle members will be notified by email of any change that expands what we collect.