Privacy policy

Scope of this policy

This policy covers the NiveshSuchak website and the NiveshSuchak mobile apps, and applies to everyone who uses either. We follow the Digital Personal Data Protection Act, 2023, which is India's current data protection law, and the Information Technology Act, 2000 wherever that still applies. Using the service means you accept this policy. If you do not accept it, please do not use the service.

What we collect

We collect only what the service needs for its one job: looking up IPO allotment results for the PANs you choose to save.

• Your mobile number, which identifies you at sign-in and receives your one-time code.
• The PANs you add, along with any nickname you give them, so that you need not retype them for every IPO.
• The allotment results we fetch for those PANs, and the IPOs you asked about.
• A push notification token, only if you switch notifications on.
• Ordinary server logs covering request time, path and error detail, which we keep briefly for debugging and to prevent abuse.

What we never collect

We are a read-only lookup tool. We never ask for, and cannot accept, the credentials that would let anyone move money or place an order.

• No bank account numbers, UPI IDs, card details or payment information.
• No demat, broker or trading-account passwords, PINs or OTPs.
• No email address, precise location, contacts or photos.
• No advertising identifiers, and no third-party analytics or tracking SDKs.

Why we collect it

We use each item above only for the purpose we collected it for. Your mobile number authenticates you. We send your PAN to the registrar handling a given IPO so that we can read back that PAN's allotment status. We do not profile you, we do not build advertising audiences, and we have never sold personal data, nor will we ever do so.

The basis we rely on

We process your data with your consent, which you give when you sign in and when you add each PAN, as the Digital Personal Data Protection Act, 2023 provides. You may withdraw that consent at any time by deleting a PAN or your entire account. Withdrawing consent is as easy as giving it.

How your PAN is protected

A PAN is a government identifier, so we treat it as one. We encrypt every saved PAN at rest with AES-256-GCM, using a key that only our server holds and that we never store alongside the data. The app and the website display it only in masked form. We send it over TLS, and it leaves our servers only to reach the registrar's own portal for a lookup you asked for.

Technical and non-personal data

Our servers keep ordinary request logs covering time, path, response code and error detail, which we use for debugging and to stop abuse. These logs can include an IP address, so we treat them as personal data and delete them within 30 days rather than keeping them indefinitely. We run no third-party analytics, no advertising SDK and no cross-site tracker, so we share nothing about your visit with an analytics or ad network. We do not use cookies for tracking. The only cookie we set is the httpOnly session cookie that keeps you signed in on the website, and it does nothing else.

Who else sees your data

We share your data with four categories of processor. Each one receives only the minimum it needs to do its part:

• Registrars. KFin Technologies, MUFG Intime, Maashitla Securities and Skyline Financial Services receive a PAN and an IPO reference when you run a check, because they publish the allotment result.
• MSG91 receives your mobile number so that it can deliver your sign-in SMS.
• Expo receives a device push token so that it can deliver notifications, if you switch them on.
• Amazon Web Services hosts the servers and database, in the Mumbai region.

How long we keep it

We keep your data only while your account exists. Deleting a PAN removes it and its allotment results immediately. Deleting your account erases your PANs, saved applications, allotment results, watchlist and devices outright. This is a hard delete rather than a flag, and your existing session stops working on its very next request. We also release your mobile number, so signing up again later gives you a genuinely empty account rather than the old one back. We delete server logs within 30 days.

Your rights

As a Data Principal under the DPDP Act, 2023, you may ask for access to the data we hold about you, have it corrected or completed, have it erased, withdraw your consent, and nominate someone to exercise these rights on your behalf. You can access, correct and erase your data yourself, both in the app and on the website: use the account screen for the whole account and the PANs screen for individual entries. We answer anything you send to the address below within 30 days.

Children

NiveshSuchak is not intended for anyone under 18, and we do not knowingly hold data belonging to a child. If you believe we do, write to us and we will erase it.

Not affiliated, not advice

NiveshSuchak is an informational tool. It is not a broker, investment adviser, registrar, exchange or SEBI-registered intermediary, and it has no affiliation with any of them. Nothing here is investment advice. We report allotment data exactly as the registrar publishes it, so please confirm anything that matters with the registrar directly.

Changes to this policy

We may revise this policy as the service changes or as the law changes. The date at the bottom always reflects the current version. If a change materially affects you, such as a new recipient of your data or a new purpose, we will tell you in the app or on the site before it takes effect, rather than expecting you to re-read this page.

Contact and grievances

For any question about this policy, a data request, or a grievance, write to support@centricwave.com. We reply within 30 days, as the DPDP Act requires.