Privacy Policy

This Privacy Policy explains what personal data IntelliWealthPro handles, why, who it is shared with, and the choices you have. IntelliWealthPro is software for mutual fund distributors (MFDs) in India and their clients. It is built and operated by Devstree (Devstree IT Services Private Limited, "we", "us").

It is written for the Digital Personal Data Protection Act, 2023 (DPDP Act), the Information Technology Act, 2000, and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 (SPDI Rules).

Who is responsible for your data

IntelliWealthPro is used in two different ways, and the responsibility differs between them.

• Your distributor's records about you. A distribution firm (the MFD) uses IntelliWealthPro to keep its book of clients: names, PAN, contact details, folios, transactions and reports. For this data the MFD firm is the data fiduciary — it decides why the data is collected and how it is used. We are a data processor: we store and process it on the firm's behalf and on its instructions, under our agreement with the firm. If you are an investor, the firm that services your investments is your first point of contact for access, correction or erasure of this data.
• Our own records. For the accounts of people who sign in to IntelliWealthPro (distributor staff and investors), billing and support with the firms that subscribe, visitors to our public website, and the security of the service, we are the data fiduciary.

What we collect

Data a distributor firm keeps about its clients

Depending on what the firm records or imports, this can include:

• identity and contact details: name, PAN, date of birth, gender, email address, mobile and WhatsApp numbers, postal addresses, family relationships and guardian details for minors;
• KYC and investor profile: KYC status, tax status, investor category, occupation, risk profile, and an Aadhaar number or its seeding status where the firm records one;
• bank and demat details: bank account numbers, IFSC, mandate details, depository participant and beneficiary account details, and nominee details;
• investments: folios, scheme holdings, transactions, SIPs, dividends, capital gains and related reports;
• documents the firm or the investor uploads (for example PAN or address proof copies), notes, tasks, calendar entries and messages;
• Consolidated Account Statements (CAS) uploaded as PDF files.

CAS passwords. A CAS file is opened with the password you or the firm type at upload. The password is used once to read the file and is not stored or logged.

Registrar feeds. Firms can connect the mailbox that receives CAMS and KFintech mailback files, and save the passwords of those files. Mailbox and file passwords are kept in encrypted form and used only to fetch and open the firm's own files.

Data about people who sign in

Name, email address, mobile number, role, the firm you belong to, and your password (stored only as a one-way hash). For security we record sign-in events and an audit trail of important actions, including the IP address and browser or device details.

Data about visitors to the public website

If, and only if, analytics is switched on for the public website, we use Google Analytics 4 and Microsoft Clarity to understand how visitors use the public pages. See the Cookie Policy.

How we use it

• To provide the service to the firm: build portfolios and reports, reconcile registrar feeds, track SIPs, prepare capital gains statements, and run the client portal.
• To send the messages the firm sets up, such as birthday greetings, SIP reminders and reports by email.
• To create and secure accounts, sign you in, and keep an audit trail.
• To give support, fix faults, and keep the service running and secure.
• To meet legal obligations and respond to lawful requests from authorities.

We do not sell personal data, and we do not use a firm's client data for our own marketing.

Ivy, the AI assistant

IntelliWealthPro includes Ivy, an assistant for distributor staff that answers questions about the firm's book. Ivy uses a large language model from Google (Gemini API). Before a question is sent to the model, client names are replaced with references, and PANs, email addresses, phone numbers, folio and account numbers typed into a question are replaced with placeholders. Figures needed to answer the question, such as holdings or returns, may be sent. Client data is sent only when the firm's AI account is on a paid service tier, whose terms do not allow the provider to train on it. Conversations are stored in the firm's account so staff can see their history.

Who we share it with

We share personal data only as needed to run the service, with these service providers acting on our instructions:

The firm itself sees and controls its own clients' data. Registrars (CAMS, KFintech) send data to the firm; we receive it on the firm's behalf. We may also disclose data where the law requires it.

Where data is stored

Data is stored on cloud servers operated by our hosting providers. Some providers listed above may process data outside India; where they do, we rely on their contractual safeguards and transfer only what the service needs.

How long we keep it

We keep a firm's data for as long as the firm uses IntelliWealthPro, and then as long as needed to close the account, resolve disputes and meet legal record-keeping duties. Many records, such as a deleted client, are first marked as deleted and hidden from everyday use rather than erased at once, so that a mistake can be undone and the audit trail stays complete. Registrar files are cleaned up on a schedule once they have been processed. When a firm asks us to erase its data, or the law requires it, we erase or anonymise it, except where we must keep it by law.

How we protect it

We follow reasonable security practices as required by the SPDI Rules, including: encrypted connections (HTTPS) to the service; passwords stored only as one-way hashes; stored mailbox and file passwords kept in encrypted form; uploaded files kept in private storage and served through short-lived links; role-based access so each user sees only what their role allows; separation of each firm's data; and an audit trail of important actions. No system is completely secure; if a personal data breach occurs, we will inform the affected firm and, where the law requires, the Data Protection Board of India and the people affected.

Your rights

Under the DPDP Act you can ask to access a summary of your personal data, correct or complete it, have it erased, withdraw consent where processing rests on consent, nominate a person to exercise your rights, and raise a grievance.

• If you are a client of a distributor, contact that firm first; it is the data fiduciary for your records. We will help the firm respond.
• For data we hold as data fiduciary, write to support@intelliwealthpro.com.

We may need to verify your identity before acting on a request.

Children

IntelliWealthPro is meant for adults. A firm may hold records of minor investors (for example folios held with a guardian); the firm is responsible for obtaining the guardian's consent where the law requires it.

Changes to this policy

We may update this policy as the service or the law changes. The date at the top shows when it last changed. Material changes will be notified to subscribing firms.

Grievance Officer

In line with the IT Act, 2000 and the rules under it, including the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, and the DPDP Act, 2023, you can contact our Grievance Officer:

• Name: Devstree IT Services Private Limited
• Designation: Grievance Officer
• Email: support@intelliwealthpro.com
• Address: Devstree IT Services Private Limited, Ahmedabad, Gujarat, India

We will acknowledge a complaint within 24 hours and resolve it within 15 days of receiving it. If you are not satisfied with our response, you may approach the Data Protection Board of India once it is functional.