Privacy Policy

1. Introduction

Welcome to Proftly("Proftly," "we," "us," or "our"). Proftly operates the Proftly mobile application for Android, the website at https://proftly.in, and related services accessible through our backend API at https://api.proftly.in.

Proftly is a financial advisory platform that connects users with independent SEBI-registered financial advisors. Through Proftly, you may subscribe to advisors, book consultations, chat with advisors, use financial planning tools, and manage your investment goals. Proftly itself does not provide financial advice.

This Privacy Policy describes how we collect, use, disclose, store, and protect your personal information when you use the Proftly mobile application, website, and related services (collectively, the "Platform"). It applies to users located in India and is designed to comply with applicable Indian laws, including the Digital Personal Data Protection Act, 2023 (DPDPA), the Information Technology Act, 2000, and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, as well as Google Play Store privacy and data safety requirements.

By creating an account, downloading our application, or otherwise using the Platform, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with this policy, please do not use the Platform.

2. Information We Collect

We collect information that you provide directly, information generated through your use of the Platform, and limited technical information from your device. The categories of information we collect include the following:

2.1 Account and Profile Information

• Full Name — to create and identify your account and display your profile to advisors you engage with.
• Email Address — for account registration, communication, receipts, and support correspondence.
• Mobile Number — for account verification, authentication, booking confirmations, and important service notifications.
• City and State — to personalise your experience and assist advisors in understanding your location context for consultations.
• Profile Photo — if you choose to upload one, to personalise your account and help advisors identify you during consultations.

2.2 Authentication and Security Information

• MPIN — a mobile personal identification number you set for convenient access. Your MPIN is never stored in plain text; it is securely hashed using industry-standard cryptographic methods before storage.
• Authentication Token — session tokens (such as JWT-based tokens) issued upon successful login to authenticate your requests to our Platform and API.

2.3 Financial Planning and Advisory Information

• Financial Goals — investment objectives, time horizons, and target amounts you enter into our planning tools.
• SIP Details — systematic investment plan information you provide for planning and advisory purposes.
• Income & Expense Information — financial data you voluntarily enter to support budgeting, planning, and advisor consultations.
• Consultation Questionnaires — responses you submit before or during advisor consultations to help advisors prepare for your session.

2.4 Communication and Engagement Information

• Chat Messages — messages exchanged between you and advisors through the in-app chat feature.
• Booking Information — consultation dates, times, advisor selections, session status, and related scheduling details.
• Subscription Details — records of advisor subscriptions, plan types, and subscription status.
• Reviews & Ratings — feedback you submit about advisors or consultations on the Platform.
• Support Tickets — information you provide when contacting our support team, including issue descriptions and correspondence.

2.5 Transaction and Payment Information

• Transaction History — records of payments made through the Platform, including transaction identifiers, amounts, dates, and payment status. We do not store your debit card, credit card, or banking credentials (see Section 6).

2.6 Device and Technical Information

• Push Notification Token — a device token used to deliver push notifications regarding bookings, messages, subscriptions, and platform updates.
• Device Information — device model, operating system version, application version, and similar technical identifiers necessary for compatibility, security, and troubleshooting.
• App Session Information — login timestamps, session duration, IP address, and activity logs related to your use of the Platform for security, fraud prevention, and service improvement.

We collect only the information necessary to provide, maintain, and improve the Platform. Where certain information is optional, we will indicate this at the point of collection.

3. Information We Do NOT Collect

Proftly is designed with privacy in mind. Unless explicitly stated otherwise in this policy or at the point of collection, the Proftly application and website do not collect the following categories of data:

• Precise GPS Location — we do not track or collect your real-time or precise geographic location.
• Contacts— we do not access or upload your phone's contact list.
• SMS — we do not read, collect, or monitor your text messages.
• Call Logs — we do not access your call history or telephony records.
• Payment Card Details — we do not store debit card numbers, credit card numbers, CVV codes, or full banking credentials.
• UPI PIN — we never collect or store your UPI PIN or similar payment authentication credentials.
• Aadhaar — we do not collect Aadhaar numbers or Aadhaar-related biometric data.
• PAN — we do not collect Permanent Account Number (PAN) unless you are explicitly asked to provide it for a specific, disclosed purpose (such as regulatory requirements for a particular advisory service) and you choose to do so.
• Biometric Information — we do not collect fingerprints, facial recognition data, or other biometric identifiers.

If our data collection practices change in the future, we will update this Privacy Policy and, where required, obtain your consent before collecting any new categories of personal information.

4. How We Use Your Information

We use the information we collect for the following purposes:

• Account Creation and Management — to register your account, maintain your profile, and provide access to Platform features.
• Authentication — to verify your identity, secure your account through MPIN and token-based authentication, and prevent unauthorised access.
• Financial Planning — to enable financial planning tools, goal tracking, SIP calculations, and income and expense management features you choose to use.
• Consultation Booking — to schedule, confirm, reschedule, and manage consultations between you and independent SEBI-registered advisors.
• Video Consultations — to facilitate secure live video sessions between you and your advisor.
• Chat — to enable messaging between you and advisors you have engaged with on the Platform.
• Notifications — to send booking reminders, subscription updates, chat alerts, and other service-related communications via push notifications, email, or SMS where applicable.
• Payments — to process subscription fees, consultation charges, and other transactions through our authorised payment partner.
• Customer Support — to respond to your enquiries, resolve issues, and manage support tickets.
• Fraud Prevention — to detect, investigate, and prevent fraudulent, abusive, or unauthorised activity on the Platform.
• Security — to monitor for security threats, enforce our terms of use, and protect the integrity of the Platform and its users.
• Platform Improvements — to analyse usage patterns, fix bugs, develop new features, and enhance the overall user experience.
• Legal Compliance — to comply with applicable laws, regulations, court orders, and lawful requests from government authorities.

We process your personal information only for legitimate purposes consistent with this Privacy Policy and applicable law. We do not use your information for purposes incompatible with those described here without notifying you and, where required, obtaining your consent.

5. Third-Party Services

To deliver a secure and reliable Platform, we work with trusted third-party service providers who process data on our behalf. These providers are contractually obligated to protect your information and use it only for the purposes we specify.

We do not sell your personal information to any third party.

5.1 Payment Processing — Razorpay

Online payments are processed by Razorpay Software Private Limited ("Razorpay"). When you make a payment, Razorpay collects and processes payment information in accordance with its own privacy policy. Proftly receives only transaction confirmations and limited payment metadata necessary to record your transaction history.

5.2 Video Consultations — Agora

Live video consultations are facilitated through Agora.io ("Agora"). During a video session, audio and video streams are transmitted through Agora's infrastructure to enable real-time communication between you and your advisor. Agora processes this data solely to deliver the video consultation service.

5.3 Push Notifications — Firebase Cloud Messaging / Expo Push Notifications

We use Firebase Cloud Messaging and Expo Push Notifications to deliver push notifications to your device. These services process your device push token to route notifications to your device. You may disable push notifications through your device settings at any time.

5.4 File Storage — AWS S3

Profile photos, documents, and other files you upload are stored securely on Amazon Web Services Simple Storage Service (AWS S3) infrastructure with appropriate access controls and encryption.

5.5 Real-Time Communication — Socket.IO

In-app chat and real-time features use Socket.IO to enable instant message delivery and live updates. Message content is transmitted through our secure servers and stored to maintain your conversation history.

5.6 WebRTC Connectivity — Google STUN and Metered TURN Servers

Video consultations may use Google STUN servers and Metered TURN servers to establish peer-to-peer connectivity for video calls. These services facilitate network traversal and do not access the content of your consultations beyond what is technically necessary for connection establishment.

5.7 Embedded Content — YouTube

Certain educational or informational content on the Platform may include embedded YouTube videos. When you interact with embedded YouTube content, Google may collect information in accordance with Google's Privacy Policy. We recommend reviewing Google's privacy practices if you interact with embedded video content.

5.8 Independent Financial Advisors

When you book a consultation, subscribe to an advisor, or chat with an advisor, we share relevant information (such as your name, contact details, questionnaire responses, and booking details) with that independent SEBI-registered advisor solely to enable the advisory service you requested. Advisors are independent professionals and are responsible for handling your information in compliance with applicable laws and their own professional obligations.

6. Payments

All online payments on the Proftly Platform are securely processed through Razorpay, a PCI-DSS compliant payment gateway. When you initiate a payment, you are redirected to or interact with Razorpay's secure payment interface.

The Proftly application and website never store your debit card details, credit card details, CVV, net banking credentials, UPI PIN, or other sensitive payment authentication information. Payment card and banking data is entered directly on Razorpay's secure platform and is subject to Razorpay's privacy and security practices.

We retain only transaction records necessary for billing, accounting, dispute resolution, and legal compliance, including transaction identifiers, amounts, dates, and payment status.

7. Video Consultations

Proftly uses Agora solely to facilitate secure live video consultations between you and your chosen independent financial advisor. Video sessions are initiated only when you or your advisor start a scheduled consultation through the Platform.

During a video consultation, audio and video data is transmitted in real time through Agora's encrypted communication infrastructure. Proftly does not record video consultations unless explicitly disclosed to you at the time of the session and you provide consent where required.

WebRTC connectivity for video calls may rely on Google STUN servers and Metered TURN servers to establish and maintain the connection. These network services facilitate call quality and connectivity but are not used to store consultation content.

You are responsible for ensuring you are in a private environment during video consultations, as you would be during any professional advisory meeting.

8. Data Storage & Security

We take the security of your personal and financial information seriously and implement appropriate technical and organisational measures to protect it against unauthorised access, alteration, disclosure, or destruction.

Our security practices include, but are not limited to:

• HTTPS Encryption — all data transmitted between your device, our website, and our API at https://api.proftly.in is encrypted using Transport Layer Security (TLS/HTTPS).
• JWT Authentication — API requests are authenticated using JSON Web Tokens (JWT) to ensure that only authorised sessions can access your account data.
• Hashed MPIN — your MPIN is stored only as a cryptographic hash and cannot be retrieved or viewed by Proftly personnel.
• Secure Cloud Infrastructure — application data and uploaded files are hosted on secure cloud infrastructure, including AWS S3, with industry-standard physical and network security controls.
• Access Controls — access to user data is restricted to authorised personnel on a need-to-know basis, and administrative access is logged and monitored.
• Session Management — authentication tokens are issued with defined validity periods, and sessions can be invalidated upon logout or detected security events.

While we strive to protect your information, no method of electronic transmission or storage is completely secure. We cannot guarantee absolute security, but we continuously review and improve our security measures. If you believe your account has been compromised, please contact us immediately at support@profitly.in.

9. Data Retention

We retain your personal information only for as long as necessary to fulfil the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law.

Specifically, we retain data for the following purposes:

• Service Delivery — for as long as your account is active and you use the Platform, including maintaining your profile, consultation history, chat records, and subscription information.
• Legal Compliance — as required under applicable Indian laws and regulations, including tax, accounting, and data protection obligations.
• Financial Regulations — transaction and advisory engagement records may be retained for periods required by financial regulatory frameworks and professional standards applicable to SEBI-registered advisors.
• Dispute Resolution — information relevant to disputes, complaints, or legal claims may be retained until the matter is resolved and any applicable limitation periods have expired.

When your information is no longer required for these purposes, we will securely delete or anonymise it in accordance with our data retention schedule and applicable law. Anonymised data that cannot reasonably be used to identify you may be retained for analytics and platform improvement.

10. User Rights

Subject to applicable Indian law, including the Digital Personal Data Protection Act, 2023, you have the following rights regarding your personal information:

• Access Your Profile — you can view your account information and profile details within the Proftly application.
• Edit Your Profile — you can update your name, email, mobile number, city, state, profile photo, and other editable profile fields directly in the app.
• Request Corrections — if any information we hold about you is inaccurate or incomplete, you may request correction by updating your profile or contacting our support team.
• Request Account Deletion — you may request deletion of your account and associated personal data as described in Section 11.
• Contact Support — you may raise privacy-related enquiries or complaints by emailing support@profitly.in.
• Manage Notifications — you can enable or disable push notifications through your device settings or, where available, within the application notification preferences.

We will respond to legitimate requests within the timeframes required by applicable law. We may need to verify your identity before processing certain requests. In some cases, we may be unable to fulfil a request if we are required to retain certain information for legal, regulatory, or legitimate business purposes.

If you are dissatisfied with our response, you may have the right to lodge a complaint with the Data Protection Board of India or other relevant authority once operational under applicable law.

11. Account Deletion

You have the right to request deletion of your Proftly account and the personal information associated with it, subject to legal and regulatory retention requirements.

11.1 In-App Account Deletion

If your version of the Proftly application includes an account deletion option, you may initiate deletion directly from your account settings. Follow the in-app instructions to submit your deletion request.

11.2 Requesting Deletion via Support

If in-app account deletion is unavailable in your application version, you may request account deletion by contacting our support team:

1. Send an email to support@profitly.in from the email address associated with your Proftly account.
2. Include the subject line: "Account Deletion Request".
3. Provide your registered full name and mobile number for identity verification.
4. State clearly that you wish to permanently delete your Proftly account and all associated personal data.

We will verify your identity and process your deletion request within a reasonable timeframe, typically within 30 days of receiving a verified request. Upon deletion, your account will be deactivated and your personal information will be deleted or anonymised, except where retention is required by law, for dispute resolution, or for legitimate business purposes such as maintaining transaction records required for regulatory compliance.

Please note that deleting your account is irreversible. You will lose access to your consultation history, chat messages, financial planning data, subscriptions, and other account-related information.

12. Children's Privacy

The Proftly Platform is intended only for users who are 18 years of age or older. The Platform is not directed toward children under 13 years of age, and we do not knowingly collect personal information from children under 13.

If you are under 18 years of age, you may not create an account or use the Platform without the involvement and consent of a parent or legal guardian, where permitted by applicable law. Financial advisory services on the Platform are intended for adults capable of entering into binding agreements.

If we become aware that we have collected personal information from a child under 13 without appropriate parental consent, we will take steps to delete that information promptly. If you believe a child under 13 has provided us with personal information, please contact us at support@profitly.in.

13. Financial Disclaimer

Proftly is a technology platform that connects users with independent, SEBI-registered financial advisors. Proftly does not provide financial advice, investment recommendations, portfolio management services, or any regulated financial advisory services. All financial advice, recommendations, and opinions are provided solely by the independent advisors you choose to engage with through the Platform.

Investment decisions remain the sole responsibility of the user. Any investment or financial decision you make based on consultations, chat communications, or information obtained through the Platform is made at your own risk. Past performance is not indicative of future results. Investments in securities markets are subject to market risks, and you should read all related documents carefully before investing.

Proftly does not guarantee the accuracy, completeness, or suitability of any advice provided by advisors on the Platform. You are encouraged to verify the SEBI registration status and credentials of any advisor before engaging their services and to seek independent professional advice where appropriate.

14. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or the features of the Platform. When we make material changes, we will update the "Last updated" date at the top of this page and, where appropriate, notify you through the application, email, or other reasonable means.

We encourage you to review this Privacy Policy periodically to stay informed about how we collect, use, and protect your information. Your continued use of the Platform after the posting of changes constitutes your acknowledgment of the updated Privacy Policy, subject to applicable law. If you do not agree with any changes, you should discontinue use of the Platform and may request account deletion as described in Section 11.

15. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

We aim to respond to all privacy-related enquiries within a reasonable timeframe and in accordance with applicable legal requirements.