How VestBook handles your information
Who we are
VestBook is a product of Glotech Innovations, India. In this policy, "we" means Glotech Innovations.
What we collect
- Your account: your email address, your name, and how you sign in (email and password, or Google). Passwords are held by our sign-in provider in hashed form; we never see them.
- What you add: family members you list, and the fixed deposits, bonds and other holdings you enter or upload.
- Statements you upload: the holdings read from the file (names, ISINs, quantities, costs and values), its date, the account name you give it, and its file name with any PAN or long number masked. The file itself is not kept.
- Records we must keep: when you accepted these terms, and a log of changes to your account, so that we can show who did what.
- Visitor statistics, on this public website only: Cloudflare Web Analytics counts visits to vestbook.in: the page visited, the page you came from, your browser and device type, your country, and how fast the page loaded. It uses no cookies and does not identify you, and we see only totals. It is not used inside your account at app.vestbook.in, so nothing you do there is counted.
What we never collect or keep
- VestBook is read-only. It cannot place orders, move money or change anything at your bank or broker.
- PAN, folio, demat and account numbers are never stored in full. Only the last four characters are kept.
- Statement passwords are never stored or logged.
- Statement files are read in memory and discarded as soon as they are read. They are never written to disk or kept.
- When a file has a layout we have not seen, AI is shown only its column titles and the kind of each cell. Names, amounts and account numbers are not sent.
- No advertising or tracking cookies, and we do not sell your information. Visitor statistics on the public website use no cookies at all.
Why we use it
Only to run VestBook for you: to sign you in, to show your family's investments and maturities, to keep your account secure, and to contact you about your account. You agree to this when you create an account. Anything else, such as product news by email, will be asked for separately, and you can say no.
Where it is kept
Your account and investment information is stored in India, in a database hosted by Supabase in Mumbai. Statements you upload are read by our statement reader, which runs on Google Cloud in Mumbai and keeps nothing once it has read the file. The website is served by Cloudflare, which also counts visits to the public website as described above. Fonts are loaded from Google Fonts, which receives your browser's address when a page loads. Signing in with Google shares your name and email with us, as Google shows you at the time.
Who can see it
Only you, and family members or advisers you choose to give access to. Our staff cannot read your investment information through the app; administrators manage accounts, not wealth. Each family's information is kept apart by rules in the database itself.
How long we keep it
For as long as you have an account. You can delete your account yourself at any time, from Your data in the account menu. That erases at once your login, profile, family members, statements, holdings, deposits, bonds and consent records.
Our activity log is cut down at the same moment to a bare record of what happened and when, with every name, file name and figure removed. That bare record is kept for one year, as India's data protection rules expect logs to be kept, and is then erased. Our database is backed up daily and each backup is kept for 7 days, so deleted information can remain in a backup for up to 7 days before that backup is erased.
Your rights
You can ask to see, correct or delete your information, withdraw your consent, or nominate someone to act for you, as the Digital Personal Data Protection Act, 2023 allows. You can download a copy of everything we keep about you, and delete your account, yourself from Your data in the account menu. For anything else, write to the contact below.
Companies and grievances
When a company applies through our form, we keep the company's name and the contact's name, email, phone and registration number, only to reply and assess the application.
When you write to our grievance officer through the form below, we keep your name, email and message, only to answer you and to keep a record that we did.
Changes and contact
If this policy changes, we will ask you to accept the new version when you next sign in.
Our grievance officer is Jordan Dias, for Glotech Innovations. To ask about your information, use your rights or raise a grievance, write using the form below. We will reply to your email within 30 days. If you are not satisfied with our reply, you may complain to the Data Protection Board of India.