Legal
Privacy Policy
Last updated: 29 September 2026
1. Who We Are
MintX (“MintX”, “we”, “us”, “our”) operates the MintX platform at mintx.trade. This Privacy Policy describes how we collect, use, disclose, and protect your personal data when you use our website, our installable web app, and our iOS and Android apps. It is written to meet India's Digital Personal Data Protection Act, 2023 (DPDP), the EU and UK General Data Protection Regulation (GDPR), and the California Consumer Privacy Act as amended by the CPRA (CCPA). For MintX's own accounts we are the data fiduciary / controller.
2. Data We Collect
Account data — name, email address, and phone number. We use passwordless sign-in (a one-time 6-digit code emailed to you); we do not store passwords.
Sign-in providers — if you sign in with Google or with your broker, we receive the identifier, name and email that provider shares with us. We never receive your Google or broker password.
Profile data — risk profile answers, watchlist tickers, investment preferences, KYC status, linked broker accounts, and onboarding responses used to personalise your experience.
PMS interest data — if you submit the PMS Interest form, the details you provide (including optional PAN and investment profile) for our team to contact you.
Partner interest data — if you submit the Partner Interest form, the firm and contact details you provide (including firm name, role, city, website, book size, mandate, budget, and timeline) for our team to contact you.
Usage data — pages visited, signals viewed, features used, searches, timestamps, device type, browser, and IP address. Security and abuse logs are always kept; analytics runs only if you opt in (section 5).
Advisor-client data — if an investment adviser or portfolio manager using MintX adds you as a client, they may store your holdings, risk profile, suitability assessments, mandates, fee terms, invoices and documents (including KYC) on MintX. See section 7.
Payment data — transaction IDs, subscription plan, and payment status via Razorpay. We do not store card numbers, CVVs, or UPI credentials on our servers.
Communication data — messages sent to our support team and responses to in-app feedback forms.
Push notification tokens — if you grant notification permission, your browser push subscription endpoint and encryption keys are stored on our servers solely to deliver alerts you have requested. You can revoke this at any time from Settings → Notifications.
WhatsApp data — if you opt in to WhatsApp alerts, your phone number is shared with Meta's WhatsApp Cloud API solely to deliver the alerts you requested, using pre-approved message templates. You can opt out at any time from Settings → Notifications.
Telegram data — if you connect Telegram, your Telegram chat ID (not your phone number) is stored to deliver the alerts you requested via the Telegram Bot API. You can disconnect at any time from Settings → Notifications.
Browser permission states — when you grant or deny browser permissions (notifications, motion sensor, geolocation) or install the app, we record those states alongside your account to provide a consistent experience across devices. We do not use this data for profiling or advertising.
Contact data — if you voluntarily use the “Invite a Friend” feature, the app opens your device's native contact picker (with your permission). No contact information is transmitted to or stored on our servers. We only record a boolean flag that you used the invite feature.
Voice search — if you use the microphone button, speech recognition is performed by your browser's built-in speech service (Google for Chrome and Edge, Apple for Safari), which may send the audio to that company. MintX receives only the text transcript, never the audio, and treats it like a typed search.
Journals, diaries and workspaces — trade journal entries, notes, saved chart workspaces and strategy snapshots you create. A shared snapshot link exposes only the strategy, never your identity. Your adviser sees your diary only if you choose to share it.
Motion sensor data — if you grant motion permission (e.g. to enable shake-to-refresh on iOS), accelerometer readings are processed locally on your device only and are never transmitted to our servers.
3. How We Use Your Data & Why We May
- To create and manage your account and authenticate your sessions.
- To put your own watchlist, holdings and saved screens first on your Home page. Signals and screener results are the same for every user; we do not tailor them to your risk profile.
- Personalisation from browsing (optional, off by default). If you turn it on from your Home page, we use the stocks and pages you open on MintX to show “recently viewed” and “pages you open most”. You can turn it off at any time from the same place. It is not available to users under 18.
- To process subscription payments and send billing confirmations.
- To send transactional notifications (signal alerts, price triggers, account events).
- To improve platform features using aggregated, anonymised analytics.
- To respond to support queries and resolve complaints.
- To comply with applicable Indian laws, SEBI regulations, and legal obligations.
Legal basis. Under the DPDP Act we process your data on the basis of your consent or for the legitimate uses the Act permits (such as providing a service you asked for and complying with law). Under the GDPR our bases are: contract (running your account, alerts and subscription),legal obligation (tax, SEBI and other record-keeping), legitimate interests (security, fraud and abuse prevention, service improvement from aggregated data), and consent (analytics, marketing, WhatsApp/Telegram/push alerts). Where we rely on consent you can withdraw it at any time without affecting processing that happened before.
We do not sell your personal data, and we do not use it for cross-context behavioural advertising. We make no automated decisions that produce legal or similarly significant effects about you; signals are the same for every user of a stock and are not decisions about you.
4. Data Storage & Security
Your data is stored on Supabase (PostgreSQL database hosted on AWS in the ap-south-1 Mumbai region) and protected with row-level security policies, TLS encryption in transit, and AES-256 encryption at rest.
All data is transmitted over encrypted HTTPS/TLS connections; we enforce HTTPS-only access (HSTS preload) and automatically upgrade any insecure requests. We use passwordless email OTP authentication (no passwords to store or leak), HTTP security headers (HSTS, CSP, X-Frame-Options), row-level security, and regular security audits. If you discover a vulnerability, please report it to security@mintx.trade.
Client-side storage — the MintX PWA stores the following data locally on your device: session tokens (required for authentication), preference settings (theme, layout), a service worker cache of app pages for offline access, and optionally a WebAuthn credential ID if you enable App Lock (biometric/PIN). Biometric data — fingerprints, face scans — never leave your device; the WebAuthn standard ensures they are processed entirely by your device's secure enclave.
Client-side encryption— any portfolio data cached locally for offline viewing is encrypted with AES-256-GCM using the Web Crypto API before being written to your device's storage. The encryption key is session-scoped and is discarded when you close the app.
6. Third-Party Services
MintX uses the following service providers, who process data on our behalf and only for the purposes below:
- Supabase — database and authentication (AWS ap-south-1)
- Razorpay — payment processing (PCI-DSS certified)
- Google — analytics (only with your consent) and Google sign-in (only if you use it)
- Vercel — platform hosting and edge network
- Meta (WhatsApp Cloud API) — delivers WhatsApp alerts to users who opt in
- Telegram — delivers Telegram alerts to users who connect their account
- Resend — transactional email delivery
- Your broker — only if you link or sign in with a broker account; access is read-only
International transfers.Our database is in Mumbai, India. Some providers above (including Vercel, Google, Resend and Meta) may process data in the United States or elsewhere. Where the GDPR applies, those transfers rely on the European Commission's Standard Contractual Clauses or an adequacy decision. We also disclose data where required by law, a court, or a regulator such as SEBI.
7. If Your Adviser Uses MintX
When a SEBI-registered adviser or portfolio manager keeps your client records on MintX, that firm decides what is collected and why (it is the data fiduciary / controller) and MintX processes the data on its instructions. Send requests about those records to your adviser first; we will help them respond.
Your adviser can erase your working data at any time. SEBI rules require them to keep KYC, agreements, risk profiles, suitability records, advice records and fee records for five years; those are retained, locked away from day-to-day use, and made available only for regulatory inspection. Your own MintX account is separate and is yours to keep or delete.
8. Data Retention
We keep personal data only as long as we need it:
- Account data — while your account is active. When you delete your account it is erased immediately from our live systems, along with your stored files; routine database backups roll over within 30 days.
- Login security counters — 30 days. Expired sign-in and link tokens — 1 day after expiry.
- Abuse strike history — 90 days. Search, impression and unanswered-question logs — 180 days.
- Activity, notification and message-delivery logs — 12 months.
- Payment and invoice records — kept for the period required by the Income Tax Act, 1961 and GST law (currently up to 8 years), unlinked from your account once it is deleted.
- Security audit and compliance logs — kept as required by law, with your identity removed once your account is deleted.
- Aggregated statistics that cannot identify you may be kept indefinitely.
9. Your Rights
Depending on where you live, you have some or all of these rights:
- Access / right to know — a copy of the personal data we hold and how we use it.
- Correction — fix inaccurate or incomplete data.
- Erasure / deletion — delete your account and personal data.
- Portability — receive your data in a machine-readable format.
- Withdraw consent — as easily as you gave it.
- Object or restrict (GDPR) — object to processing based on legitimate interests, or ask us to pause it.
- Opt out of sale or sharing, and limit use of sensitive data (CCPA) — we do not sell or share personal information, and we use sensitive information such as PAN only to provide the service you asked for.
- Nominate (DPDP) — name someone to exercise your rights if you die or become incapacitated.
- Grievance redressal (DPDP) — complain to us, and then to the Data Protection Board of India.
Self-serve: export your data and permanently delete your account at any time from Settings → Data & Privacy, and change consent from Your Privacy Choices in the footer.
For anything else, email privacy@mintx.trade from your registered email address so we can verify it is you. An authorised agent may act for you (CCPA) with your signed permission. We respond within 30 days (within one month under the GDPR, 45 days under the CCPA, extendable where the law allows) and never treat you differently for exercising a right.
If you are unhappy with our response you may complain to the Data Protection Board of India, your local EU/UK data protection authority, or the California Privacy Protection Agency.
10. Data Breaches
If a breach affects your personal data we will tell you and the Data Protection Board of India without undue delay, notify the relevant EU/UK authority within 72 hours where the GDPR applies, and explain what happened and what you can do.
11. Children's Privacy
MintX is not intended for users under the age of 18. We do not knowingly collect personal data from anyone under 18, and we do not track, profile or target children. If you believe a minor has registered, contact privacy@mintx.trade.
12. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you by email or in-app notification for material changes, and ask for fresh consent where the law requires it.
13. Contact & Grievance Officer
For privacy queries, data requests or complaints, contact our Grievance Officer (DPDP Act, 2023) and privacy lead:
privacy@mintx.trade
MintX, Mumbai, Maharashtra, India.