Legal
Privacy notice
What we collect, why, who it goes to, how long we keep it, and what you can do about it.
Who we are
Sahi Hai is offered by a mutual fund distributor registered with AMFI (ARN-371239) and a member of BSE StAR MF (member code 714077). We decide why and how your personal data is used, under India's Digital Personal Data Protection Act.
What we collect and why
| What | Why |
|---|---|
| Your email and name | To sign you in and contact you about your account. |
| Your answers about goals, income range and risk | To show funds that suit you. We never use them for anything else. |
| Investor details, when you open an investor account: name as on PAN, PAN, date of birth, gender, occupation, income range, place of birth, address, mobile, email, bank account and nominees | BSE StAR MF needs these to open your account and process your investments, and the law requires us to keep them. |
| Your investments: orders, SIPs, mandates, payments and holdings | To run them and show you your portfolio and statements. |
| Funds you hold elsewhere, if you import your CAS: fund, units, value, fund house and the last 4 characters of each folio. The PDF and its password are read once and never stored | To show those funds next to the ones you bought through us. We keep only folios under your own PAN, never the PAN itself, and you can remove them any time. |
| Chats with Ask | To answer you and check Ask's quality. We remove personal details like PAN and phone numbers before storing a chat or sending it to the AI model. |
| Device and usage: push token, app version, and IP address at sign-in and when you give consent | To keep your account secure and send the notifications you've allowed. |
We ask for your consent before collecting anything, and record when you gave it.
Who we share it with
Only the services below, only for the purpose listed. We never sell your data and never share it for marketing.
| Who | For | What they get | Where |
|---|---|---|---|
| Supabase | Database and private file storage | Everything above | India (Mumbai) |
| DigitalOcean | Servers for our API | Data in transit and server logs | India (Bengaluru) |
| BSE StAR MF | Investor accounts, orders, SIPs, mandates, payments | Investor details and orders | India |
| Brevo | Email (sign-in codes, statements, reminders) | Email address, first name, the email itself (no PAN or account numbers) | EU (France) |
| Anthropic | The AI model behind Ask | Chat text with personal details removed, your risk profile, shortlists | US |
| Expo, Apple, Google | Push notifications; sign in with Apple or Google | Push token and notification text (never amounts); your sign-in name and email if you choose it | US |
| Razorpay IFSC | Bank name from an IFSC code | The IFSC code only | India |
How we protect it
PAN, bank account numbers, contact details and nominee details are encrypted before they reach our database. More on our security page.
How long we keep it
- Your app data (profile, goals, saved funds, imported CAS holdings, lesson progress, Ask chats) until you delete your account. Deletion happens 7 days after you ask, so you can change your mind.
- Investor, KYC and transaction records for as long as the law requires, even after you delete your account. The Prevention of Money Laundering Act requires at least 5 years after each transaction, and 5 years after your account closes for your identity records.
- Consent records and complaint records, as proof of what was agreed and how we handled it.
- Notifications in your in-app inbox for 1 year.
Your rights
- See your data and download a copy: Settings, then Your data, in the app.
- Correct it: edit your profile, or ask us for investor details.
- Withdraw optional consents at any time.
- Delete your account: here's how. Deletion waits until you've withdrawn your money, and keeps what the law requires.
- Nominate someone to use these rights for you if you can't.
If something goes wrong
If your data is breached, we'll tell you and the Data Protection Board of India without delay.
Questions or complaints
Write to our Grievance Officer at sahihaimf.ai@gmail.com with "Privacy" in the subject. We reply within 24 hours and resolve it within 21 days. If you're not happy with our answer, you can complain to the Data Protection Board of India.
Changes to this page
- 0.2 (30 Oct 2026): Added funds imported from your CAS.
- 0.1 (29 Oct 2026): First version.