Last Updated: January 2025
This Privacy Policy describes how Finwiser ("we", "us", "our") collects, uses, stores, shares, and protects personal data when you access or use the Finwiser Platform (website/mobile application and related services).
This Policy applies to:
For the purposes of the Digital Personal Data Protection Act, 2023 ("DPDP Act"):
This Policy should be read together with:
Important: Use of the Platform (including viewing projections or generic insights) does not create an investment advisory relationship. A regulated advisory relationship arises only if you execute a valid Investment Advisory Agreement.
Depending on how you use the Platform, Finwiser may process the following categories of personal data:
Where you provide explicit consent through the Account Aggregator framework, Finwiser may access and process Financial Information made available by Financial Information Providers (such as banks, AMCs, and other regulated entities) through your chosen Account Aggregator. This may include, depending on consent scope:
Finwiser is not a Financial Information Provider (FIP) and does not act as the system of record for such information.
Finwiser operates on a Transient Data Model for raw Financial Information. We do not act as a secondary storage provider for bank statements or transaction records.
Finwiser may generate derived data from inputs and permitted data sources, such as:
Derived outputs are dependent on inputs, assumptions, and data availability.
The Platform is intended for use by individuals aged 18 years and above. Finwiser does not knowingly collect personal data from minors. If we become aware that personal data of a minor has been collected without appropriate legal authorisation, such data will be deleted in accordance with Applicable Law.
Finwiser processes personal data only for specific, explicit, and lawful purposes consistent with the DPDP Act and Applicable Law. The purposes below are grouped by context.
Finwiser processes personal data to:
This processing is required to operate the Platform and cannot be disabled without affecting account access.
Finwiser processes personal data and user-provided inputs to:
These outputs are Generic Outputs and do not constitute personalised investment advice.
Generic Outputs are provided for informational and educational purposes only and do not constitute a recommendation to buy, sell, hold, or allocate to any financial product or security.
No fiduciary, advisory, or suitability obligation arises from Generic Outputs. Personalised investment advice is provided only after execution of a valid Investment Advisory Agreement and completion of mandatory risk profiling.
Where you provide explicit consent through the Account Aggregator framework, Finwiser processes Financial Information to:
This processing is:
Upon expiry or revocation of consent, Finwiser ceases fetching any new Financial Information.
Limited historical derived summaries and security or audit logs (excluding raw Financial Information payloads) may be retained solely for security monitoring, dispute resolution, and regulatory compliance, as permitted under Applicable Law.
This section applies only if you execute a valid Investment Advisory Agreement with Finwiser.
Where you become a Client, Finwiser may additionally process personal data to:
Such processing does not occur for users who have not entered into an Investment Advisory Agreement.
Finwiser may process personal data to:
This may continue after account closure to the extent required by law.
Back to TopFinwiser processes personal data on the basis of:
Consent, where required, is obtained in a free, informed, specific, and unambiguous manner and is limited to the stated purpose.
Certain personal data processing is essential to operate the Platform, including:
Withdrawal of consent for such mandatory processing may result in:
Access to Financial Information through the Account Aggregator framework is entirely consent-driven.
Where you choose to provide consent:
You may review, modify, or revoke Account Aggregator consent at any time using your Account Aggregator's interface.
Upon expiry or revocation of Account Aggregator consent:
Revocation of consent does not affect:
Processing of personal data for investment advisory purposes occurs only after you execute a valid Investment Advisory Agreement.
Such processing is governed by:
If you withdraw consent or terminate the Investment Advisory Agreement:
You may withdraw consent for any consent-based processing by:
Withdrawal of consent:
Finwiser will inform you of any material consequences before acting on a withdrawal request, where practicable.
Certain core financial aggregation, analytics, and diagnostic features of the Platform require processing of personal data and Financial Information that is integral to the nature of those features.
Where such processing is necessary, Finwiser may be unable to provide access to those features in the absence of the required consent.
Account creation, authentication, and basic Platform access may remain available; however, refusal or withdrawal of consent may result in restricted or no access to features that depend on such processing.
Back to TopFinwiser does not sell your personal data.
We share personal data only where necessary to:
Where feasible, Finwiser shares data in a minimised form (limited to what is necessary for the specific purpose).
Finwiser may share personal data with the following categories of recipients:
We may share personal data with vendors who process data on our behalf to operate the Platform, such as:
These recipients act as Data Processors and are contractually required to:
Where you provide consent through the Account Aggregator framework, Finwiser will exchange the minimum required technical and consent-related information with:
strictly as required to fulfil the consent artefact (such as initiating a data request and receiving Financial Information responses).
Finwiser does not disclose raw Financial Information or consent-linked responses to any third party outside the Account Aggregator ecosystem, except where required under Applicable Law.
Notwithstanding the above, Finwiser may use derived, aggregated, or irreversibly anonymised data (which does not identify you and does not constitute Financial Information) for:
Such anonymised or de-identified data is subject to technical and organisational safeguards, is used only for internal analytics, research, or model improvement, and is not used for re-identification or third-party profiling.
This applies only if you execute an Investment Advisory Agreement.
In connection with regulated advisory services, Finwiser may share limited personal data:
Finwiser will not share client data with product manufacturers, distributors, brokers, or intermediaries for marketing or referral purposes.
If Finwiser undergoes a merger, acquisition, restructuring, or sale of assets, personal data may be shared with relevant counterparties and advisers as part of such transaction, subject to:
Finwiser may disclose personal data where required to comply with:
We may also disclose data where necessary to:
Finwiser does not:
If Finwiser uses service providers that store or process data outside India, such transfers will be undertaken only:
Finwiser retains personal data only for as long as necessary to:
Where feasible, Finwiser minimises retention by:
Finwiser typically retains the following categories of data:
Retained while your Account remains active and for a reasonable period thereafter to:
Retained for a reasonable period to:
Raw Financial Information fetched via the Account Aggregator framework is processed on a transient basis and purged from Finwiser's active systems within a limited period, in accordance with the requirements of the Account Aggregator ecosystem, applicable consent artefacts, and Applicable Law.
Such purging timelines may vary based on the nature of the data, technical processing requirements, and obligations imposed by the relevant Account Aggregator or Financial Information Provider.
Finwiser does not retain raw Financial Information as a long-term record store. Only derived summaries, analytical outputs, and regulatory or suitability logs (which do not contain raw FI payloads) may be retained for longer periods where required for Platform functionality or compliance.
Derived data (such as summaries, ratios, trends, categorisations, and projections) may be retained to:
Where you request deletion or close your account, derived data will be deleted or irreversibly anonymised unless retention is required under Applicable Law.
You may request account deletion or closure through the Platform or support channels. Upon closure:
Finwiser may retain limited information after closure where necessary for:
Finwiser may provide access to, or export of, basic profile information, user-provided data, and derived summaries where technically feasible and permitted under Applicable Law.
Finwiser does not provide exports of raw Financial Information payloads, bank statements, or original records. Re-use or transfer of original financial records should be undertaken through the Account Aggregator framework or by approaching the relevant Financial Information Provider.
Where feasible and lawful, Finwiser may retain anonymised and aggregated data that cannot reasonably identify you, for:
Finwiser implements reasonable security safeguards, appropriate to the nature of personal data processed, in accordance with the Digital Personal Data Protection Act, 2023 and Applicable Law.
Security measures are designed to:
Finwiser maintains organisational measures including:
Finwiser uses appropriate technical safeguards, which may include:
Specific technical implementations may change over time to respond to evolving security threats.
Access to personal data is restricted to authorised personnel only and granted strictly on a need-to-know basis.
Access rights are reviewed periodically and revoked promptly where no longer required.
In the event of a personal data breach, Finwiser will:
Users are responsible for:
Finwiser recognises and facilitates the rights available to Users as Data Principals under the DPDP Act, subject to Applicable Law.
You may request access to information about:
The Right to Access includes the ability to view Financial Information fetched via the Account Aggregator framework as displayed on the Platform during the active consent period.
This right does not extend to providing certified statements, official records, or raw data files. For original records or certified copies, Users should approach their respective Financial Information Providers or Account Aggregator.
The Right to Access does not extend to Finwiser's proprietary algorithms, internal models, scoring logic, or trade secrets used to generate Generic Outputs, as permitted under Applicable Law.
Derived summaries and analytical outputs may remain accessible after consent expiry or revocation, subject to retention policies. Viewing of raw Financial Information requires an active Account Aggregator consent.
You may request correction or updating of personal data that is:
Where correction is not feasible (for example, historical records required for compliance), Finwiser may retain such data with appropriate annotation.
You may request erasure of personal data that is:
Erasure requests are subject to:
You may raise grievances regarding:
Grievances will be addressed in accordance with Section 9 of this Privacy Policy.
You may nominate another individual to exercise your rights under the DPDP Act in the event of death or incapacity, in accordance with Applicable Law.
The exercise of rights under this section may be limited where:
In accordance with the Digital Personal Data Protection Act, 2023 and Applicable Law, Finwiser has appointed a Grievance Redressal Officer to address concerns relating to the processing of personal data and the exercise of Data Principal rights.
You may raise a grievance relating to:
Grievances may be submitted via:
Finwiser shall:
Where additional time is required due to the nature of the grievance, you will be informed accordingly.
If a grievance is not resolved to your satisfaction, you may exercise your statutory right to escalate the matter before the appropriate authority under Applicable Law.
Nothing in this Privacy Policy restricts your right to approach a competent regulatory or judicial authority.
Back to TopFinwiser may update this Privacy Policy from time to time to reflect:
Where material changes are made, Finwiser will take reasonable steps to notify Users through:
The updated Privacy Policy will be made available on the Platform with the revised effective date.
Your continued use of the Platform after the effective date of an updated Privacy Policy constitutes acceptance of such updated Privacy Policy, to the extent permitted under Applicable Law.
If you do not agree with the updated Privacy Policy, you may discontinue use of the Platform and request account closure.
Back to Top