Privacy
The most honest privacy stance we could design.
Aumsetu is architected so that your clients’ personal or financial information never leaves your browser. Not because we promise not to look — because there is nothing on our servers to look at.
Where your data actually lives
| What | Where it lives |
|---|---|
| Your firm branding (name, ARN, mobile, logo, address you enter at /setup) |
Your own browser’s localStorage. Never uploaded. |
| Calculator inputs (client name, amounts, ages, etc.) |
Your own browser’s memory during the session. Not stored anywhere. |
| Client CAS PDFs (uploaded to the CAS Analyzer) |
Parsed in-browser by pdf.js. Never uploaded to any server. |
| Generated PDFs (SIP reports, proposals, legal docs) |
Built by your browser using jsPDF. Downloaded directly to your device. |
| MFD Circle applications (only the MFD’s own name, ARN, mobile, email) |
Stored in our Supabase database. Required to verify against AMFI. |
| Your firm branding, if you switch Sync on (firm name, your name, tagline, website, address, logo) |
Stored in our Supabase database, so the same branding appears on your other devices. Off by default. Switch Sync off at /setup and the stored copy is erased. This is your firm’s information, never a client’s. |
| Tool-usage counters (which gated tool was opened, by which MFD Key, and the member’s state) |
Stored in our Supabase database and aggregated for the analytics dashboard — for example, how many members used a tool and which states they are in. These are tied to your MFD Key, so they are not anonymous; they never include anything you type into a tool about a client. |
What we collect from Circle members
If you apply for the Aumsetu MFD Circle, we collect exactly what the application form shows:
- Your real name — matched against AMFI records
- Your ARN — matched against AMFI records
- Your mobile number — to send you the MFD Key on WhatsApp
- Your email address — for future MFD Circle communication (optional)
- Your legal firm name, state, city, years of practice — for the public directory (only if you opt in)
- Your directory and newsletter opt-in choices
We store this in Supabase (hosted in AWS Asia-Pacific). We do not sell it, do not share it with third parties, and do not use it for advertising. If you want your record removed, WhatsApp us and we will delete it within 7 working days.
How long we keep it
The DPDP Act does not let anyone hold personal data indefinitely just because it is convenient. So:
| What | How long |
|---|---|
| An active Circle member’s record | For as long as you are a member. Ask us to delete it and we do, within 7 working days. |
| An application we could not verify, or a key never activated | 24 months from the date you applied, then deleted. We keep it that long only so we can tell you what happened if you ask, and so a re-application is not treated as a stranger. |
| Synced firm branding | Until you switch Sync off, or your membership record is deleted — whichever comes first. |
| Usage counters | Kept in aggregate. The link between a counter and a key is removed when the member record is deleted. |
| Vercel and Supabase infrastructure logs | Held by those providers on their own schedules. We do not control them and we do not read them. |
Cookies and trackers
Aumsetu does not use analytics cookies, marketing pixels, or ad-tech. There is no Google Analytics and no Facebook pixel. The site does use Vercel Web Analytics — a cookieless measure of page views, served from Aumsetu’s own domain, that does not set cookies or build a cross-site profile of you. The one exception to “nothing third-party loads” is Google Fonts: the Inter typeface is fetched from Google’s font CDN, which means Google’s servers see your IP address when a page loads. Both are listed below.
Your browser stores an Aumsetu localStorage entry only if you use the /setup page to save firm branding. That data stays in your browser and is never sent anywhere — you can delete it any time by clearing your browser storage or using the “Reset” button on the setup page.
Third-party services we use
- Vercel — hosts the static site. Sees standard access logs (IP, user-agent) retained per Vercel’s own policy.
- Vercel Web Analytics — cookieless page-view and event counts, served from Aumsetu’s own domain. It records the page visited and coarse, aggregated signals; it sets no cookies and does not identify you or track you across other sites.
- Google Fonts — serves the Inter typeface. Because the font is fetched from Google’s CDN, Google sees your IP address and browser when a page loads. No cookie is set by the font request.
- Supabase — hosts the MFD Circle database. Sees only what is in the tables above.
- Cloudflare — DNS provider for aumsetu.com. Sees domain lookups only.
- AMFI public portal — we manually cross-check each Circle applicant’s ARN there.
Your rights under the DPDP Act, 2023
If you are a Circle member (the only category of user whose personal data we hold), you have the right to:
- Access the personal data we hold about you
- Correct any inaccurate details
- Request deletion of your record
- Withdraw consent for future communications, or withdraw consent altogether
- Nominate someone to exercise these rights on your behalf if you die or become unable to act
- Raise a grievance with us, and escalate it if our answer does not satisfy you
To exercise any of these rights, write to info@aumsetu.com or WhatsApp +91 95412 23377. We aim to respond within 7 working days.
Withdrawing consent does not undo anything already done while it was in force, and it may mean we can no longer keep your directory listing or your MFD Key working — there would be nothing left to match you against.
Grievance Officer
Under section 13 of the DPDP Act, 2023, every Data Fiduciary must publish a contact who answers complaints about how personal data is handled. For Aumsetu that is:
Deepak Singla — Grievance Officer
Email: info@aumsetu.com
WhatsApp: +91 95412 23377
Near Indusind Bank, Aastha Hospital Street, Chotala Road,
Mandi Dabwali – 125104, Haryana, India
Aumsetu is run by one person, so that person is the Grievance Officer. Write with “Grievance” in the subject line and you will get an acknowledgement within 3 working days and an answer within 30 days.
If our answer does not satisfy you, you may complain to the Data Protection Board of India under section 27 of the Act. Exhausting the route above first is a requirement of the Act, not a courtesy.
Data breach
If we discover any unauthorised access to Circle member data, we will notify affected members within 72 hours via the mobile and email they submitted, and post a public notice on this page.
Data Fiduciary
The Data Fiduciary under the DPDP Act, 2023 is:
Deepak Singla
ARN-76535 · Unique Securities
Near Indusind Bank, Aastha Hospital Street, Chotala Road,
Mandi Dabwali – 125104, Haryana, India
WhatsApp: +91 95412 23377
Changes to this policy
Material changes will be noted here with a revised effective date. Circle members will be notified by email of any change that expands what we collect.