Privacy Notice

This notice explains how Flyweal Labs Private Limited (“Flyweal”, “we”, “us”) processes personal data when you use Frontier Folios Terminal (the “Terminal”, at app.frontierfolios.ai), this website (www.frontierfolios.ai), and our support channels. We are the Data Fiduciary under India’s Digital Personal Data Protection Act, 2023 (the “DPDP Act”) and the rules made under it, and we also comply with the Information Technology Act, 2000 and its rules on sensitive personal data, to the extent they apply.

Registered office: 2/676, Bharwara, Gomti Nagar, Lucknow 226010, Uttar Pradesh, India. CIN U62011UP2026PTC248131. GSTIN 09AAHCF0482H1ZK. Our Grievance Officer’s contact details are in section 16; that person answers questions about this notice and about your personal data on our behalf.

Your relationships with your stock broker, with Razorpay (our payment processor) and with any AI provider whose key you bring are governed by their own notices. Where this notice describes them, it describes what we do with the data they give us or that we send them at your request.

• We collect what is needed to run your account, show your portfolio and provide the research and AI features you ask for. Nothing else.
• We never collect your broker password, PIN or TOTP seed, your PAN, Aadhaar or bank account number, and we never see your card or UPI details (Razorpay does).
• Your data is stored and processed in India (AWS Mumbai). Only AI requests leave India, and only with the context they need; never your name, email or credentials.
• We do not sell personal data, show advertising, or train public AI models on your portfolio.
• You can export, correct or erase your data from Settings or by writing to the Grievance Officer, and you can complain to the Data Protection Board of India if we fail you.

The table lists each category, with examples, the purpose, and the lawful basis under the DPDP Act (your consent under section 6, or a legitimate use under section 7).

We do not collect your PAN, Aadhaar, bank account numbers, biometric data or precise location. If you type such data into a free-text field, we treat it as research content and you can erase it.

• You, when you sign up, connect a broker, write to Copilot or to us, or buy a plan.
• Your broker, through the connection you set up with your own credentials, only while the connection is active.
• Our systems, which generate usage events, logs, invoices, backtest results and AI answers while you use the Terminal.
• Public market data (exchange files, filings, index lists), which is not personal data but is combined with your holdings to produce your analytics.

Where we rely on consent, we ask for it in clear terms at the point it is needed: when you create an account, when you start a broker connection, and when you start a payment. Each request states the data and the purpose, and this notice is linked from it (section 5 of the DPDP Act).

You may withdraw consent at any time, as easily as you gave it: disconnect a broker in Settings → Brokerages, delete a strategy, agent or note, or close your account in Settings → Privacy & terms. You can also write to the Grievance Officer. Withdrawal does not affect processing already done lawfully, and it may stop the features that need that data (for example, we cannot show broker holdings after you disconnect the broker). Where the law requires us to keep data after withdrawal (tax records, for instance), we keep only that data.

When the Government notifies consent managers under the DPDP Act, you will be able to manage consent for the Terminal through a registered consent manager as well.

We use these Data Processors under written agreements that limit them to our instructions. The last two columns say where the processing happens and whether the data leaves India.

When you use AI features, the request and the context it needs are sent to the AI provider: for example, company names, figures, and your holdings’ symbols and weights when you ask about your portfolio. We do not send your name, email, broker credentials or payment details to AI providers, and our agreements do not allow them to use this data to train their models.

We share personal data with nobody else, except when the law requires it (a court order or a lawful request from an authority), to protect our rights or users’ safety, or with your direction. If the company is sold or merged, data moves with the service under this notice and we tell you first.

Data sent to AI providers outside India is transferred as section 16 of the DPDP Act allows, to countries the Central Government has not restricted, under agreements that require protection equivalent to this notice. Everything else is stored and processed in India. If you add your own AI key, you choose the provider and the transfer that comes with it.

We keep personal data only while it is needed for the purpose it was collected for, or as the law requires, and then erase it (section 8(7) of the DPDP Act). In practice:

• Account, portfolio and research data: while your account is open. After you close it, deleted within 30 days, except what we must keep by law.
• Billing and invoice records: 8 years, as tax and company law require.
• Server and security logs: about 14 days.
• Feedback reports and screenshots: until the report is closed plus 12 months.
• Website enquiries: up to 24 months from your last message, or until you ask us to delete them.
• Backups: erased on their normal cycle of 35 days after the live copy is deleted.
• Inactive accounts: if you do not use the Terminal for three years and we have no legal reason to keep your data, we will notify you and then erase it.

• Encryption in transit (TLS) and at rest for the database, files and backups.
• Broker credentials and your own AI keys are envelope-encrypted with a dedicated key-management service, bound to your account.
• The database is not reachable from the internet; services run in private networks behind a load balancer.
• Access by our staff is limited to what their role needs and is logged.
• Sign-in with passkeys or a password plus authenticator; session tokens are short-lived.
• Image metadata (including GPS) is stripped from screenshots you upload.

If a personal data breach affects you, we will notify you and the Data Protection Board of India in the manner and time the DPDP Act and rules require, describing what happened, the likely impact, what we are doing, and what you can do. You can report a suspected security problem to support@flyweal.com.

Under the DPDP Act you have the right to:

• Access a summary of your personal data, the processing we do, and the processors and other fiduciaries we have shared it with (section 11).
• Correct, complete, update or erase your personal data (section 12).
• Grievance redressal, through our Grievance Officer and then the Data Protection Board of India (section 13).
• Nominate a person to exercise these rights for you if you die or become incapacitated (section 14).
• Withdraw consent at any time (section 6).

How to exercise them

• In the Terminal: Settings → Privacy & terms gives you a JSON export of your account data, and lets you file a correction or erasure request; Settings → Brokerages disconnects a broker; you can close your account there too.
• By email: write to the Grievance Officer at grievance@flyweal.com from the address on your account. We may ask you to confirm your identity in a way that does not require more data than needed.

We acknowledge every request within 48 hours with a reference, and respond within 30 days. Where a request is complex we may take longer, up to the 90 days the rules permit, and we will tell you why. There is no charge. If we refuse a request (for example because the law requires us to keep the data), we explain the reason.

If you are not satisfied, you may complain to the Data Protection Board of India after you have used our grievance process. Nothing in this notice limits rights you have under other laws.

The DPDP Act also asks Data Principals to act in good faith (section 15): do not impersonate another person, do not suppress material information when you provide identity documents, do not file a false or frivolous grievance, and provide only data that is correct when you exercise a right to correction or erasure.

The Terminal is for adults (18 and over) and we do not knowingly process children’s data. If you believe a child has an account, write to the Grievance Officer and we will close it and erase the data.

• Strictly necessary (Terminal): httpOnly cookies for sign-in and security, and preference cookies for theme and density. These cannot be switched off while you use the Terminal.
• This website: no analytics, advertising or third-party tracking cookies. Your theme choice is kept in your browser’s local storage and never sent to us.
• Product measurement (Terminal): first-party only, recorded against your account to understand which features are used. No advertising trackers, no cross-site tracking.
• Razorpay checkout opens in its own window and sets its own cookies under Razorpay’s policy.

We honour your browser’s “Do Not Track” setting on this website by default, because we track nothing to begin with.

AI features generate text and analysis for you to read; they do not make decisions about you. Plan limits, credits and alerts are rule-based and visible in the app. We do not profile you to decide eligibility, pricing or access, and we do not use your portfolio or research content to train public AI models.

Grievance Officer, Flyweal Labs Private Limited
Email: grievance@flyweal.com
Address: 2/676, Bharwara, Gomti Nagar, Lucknow 226010, Uttar Pradesh, India

General support: support@flyweal.com. This notice is published in English; you may ask us for a copy in any language listed in the Eighth Schedule to the Constitution of India. When we make material changes we post the new version here with a new effective date and tell you in the app or by email before it applies. See also the Terms of Use, the Subscription & Refund Policy and the Risk Disclosure.