Privacy Policy

1. Data We Collect

We collect data necessary to provide and improve the Service. The categories of data we collect include:

We do not collect your Aadhaar number, PAN card details, bank account numbers, demat account information, or trading credentials.

2. How We Use Your Data

We process your personal data for the following specific, lawful purposes:

• Service Delivery: To provide personalised screening results, portfolio tracking, watchlist management, and compliance monitoring.
• Account Management: To create, maintain, and secure your account, and to communicate important account-related updates.
• Analytics and Improvement: To understand usage patterns, identify bugs, improve the screening algorithm, and enhance user experience.
• Legal Compliance: To comply with applicable laws, respond to lawful requests from government authorities, and enforce our Terms of Service.
• Communication: To send transactional emails (account alerts, compliance notifications) and, with your consent, product updates and educational content related to Shariah-compliant investing.

We do not sell your personal data to third parties. We do not use your data for automated decision-making that produces legal effects concerning you.

3. Third-Party Services

We rely on the following third-party service providers to operate the platform. Each provider receives only the minimum data necessary to perform its function:

Each third-party provider is bound by their own privacy policies and applicable data protection regulations. We encourage you to review the privacy policies of Clerk, PostHog, and Google for details on how they handle your data.

4. Data Storage and Security

We take the security of your data seriously and implement industry-standard measures to protect it:

• Encryption at Rest: All personal data and portfolio information stored in our databases is encrypted using AES-256 encryption.
• Encryption in Transit: All communications between your browser and our servers are protected using TLS 1.2 or higher (HTTPS).
• Access Controls: Database access is restricted to authorised personnel with role-based access controls. Production data access is logged and audited.
• Infrastructure: Our servers are hosted on secure, SOC 2-compliant cloud infrastructure with automated backups and disaster recovery procedures.
• Incident Response: We maintain an incident response plan and will notify affected users within 72 hours of discovering a data breach, in accordance with the DPDPA 2023.

While we employ robust security practices, no method of transmission over the internet or method of electronic storage is 100% secure. We cannot guarantee absolute security of your data.

5. Your Rights (DPDPA 2023 Compliance)

Under India's Digital Personal Data Protection Act, 2023 (DPDPA), you have the following rights as a Data Principal:

• Right to Access: You may request a summary of the personal data we hold about you, including how it is being processed and with whom it has been shared.
• Right to Correction: You may request correction of inaccurate or incomplete personal data. You can update most information directly through your account settings.
• Right to Erasure: You may request deletion of your personal data. Upon verification of your identity, we will delete your data within 30 days, subject to legal retention obligations.
• Right to Data Portability: You may request an export of your personal data in a commonly used, machine-readable format (JSON or CSV).
• Right to Withdraw Consent: Where processing is based on consent, you may withdraw consent at any time. This will not affect the lawfulness of processing carried out before withdrawal.
• Right to Grievance Redressal: You have the right to file a grievance with us. If not resolved to your satisfaction within 30 days, you may approach the Data Protection Board of India.

To exercise any of these rights, please contact our Data Protection Officer at privacy@barakfi.in. We will respond to verified requests within 30 days.

6. Cookie Policy

We use cookies and similar technologies for the following purposes:

• Essential Cookies: Required for authentication, session management, and security. These cannot be disabled without affecting the Service.
• Preference Cookies: Store your theme preference (light/dark mode), language settings, and screening filter defaults.
• Analytics Cookies: Used by PostHog to collect anonymised usage data. You can opt out of analytics tracking through your account settings.

• Advertising Cookies:Google AdSense and AdMob may set cookies and use device identifiers to serve personalised ads based on your browsing activity and interests. Google's ad partners may use cookies for ad targeting in accordance with Google's Privacy Policy.

You can opt out of personalised advertising by visiting Google Ads Settingsor by adjusting your device's ad tracking preferences. You may also use the NAI opt-out tool to manage third-party ad network cookies.

7. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes described in this policy:

• Active Accounts: Data is retained for the duration of your account and for 90 days after account deletion to allow for recovery requests.
• Analytics Data: Anonymised usage data is retained for up to 24 months and then automatically purged.
• Support Records: Communications related to support requests are retained for 3 years after resolution.

8. Children's Privacy

Barakfi is not intended for individuals under the age of 18. We do not knowingly collect personal data from children. If we become aware that a user is under 18, we will promptly delete their account and associated data. If you believe a minor has registered on our platform, please contact us immediately at privacy@barakfi.in.

9. International Data Transfers

Some of our third-party service providers (Clerk, PostHog) may process data outside of India. Where such transfers occur, we ensure that appropriate safeguards are in place, including contractual clauses that require the recipient to provide a level of data protection consistent with the DPDPA 2023. By using the Service, you consent to the transfer of your data to jurisdictions outside India where our service providers operate, subject to these safeguards.

10. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. Material changes will be communicated via email and/or a prominent notice on the platform at least 15 days before taking effect. The "Effective Date" at the top of this page indicates when the policy was last revised.

11. Contact Us

For privacy-related enquiries, data access requests, or to exercise any of your rights under the DPDPA 2023:

We will acknowledge receipt of your request within 48 hours and provide a substantive response within 30 days.