Privacy Policy
Last updated 2026-10-25
The short version: we read your statement, keep only the fund transactions needed to show your numbers, and discard the file. We do not keep your name, PAN, email, phone number or address from the statement. If you do not create an account, everything is deleted automatically after 30 days without a visit. You can delete it yourself at any time.
1. Who is responsible for your data
FolioQ is operated by Manoj Attal, Pune, India, who is the Data Fiduciary for personal data processed through folioq.in under the Digital Personal Data Protection Act, 2023. FolioQ is not yet a registered company and is not SEBI-registered.
Contact and grievances: Manoj Attal, hello@folioq.in.
2. What we collect and why
| Data | Where it comes from | Why we use it |
|---|---|---|
| Fund transactions: scheme name, ISIN, date, type, units, NAV, amount, registrar | Your CAS PDF | To calculate and show your returns, holdings and history |
| Folio number, inside an internal transaction reference | Your CAS PDF | To avoid duplicate transactions when you upload again |
| Holdings: scheme, ISIN, units, average cost | Your CAS PDF | To show your current portfolio |
| Computed results: value, invested amount, XIRR, return | Calculated by us | To show your dashboard quickly |
| Anonymous user id and session tokens | Created when you upload | To link your data to your browser |
| Consent record: anonymous id, consent type, date and time, IP address | When you tick the consent box or accept the privacy notice | To record your consent as the law requires |
| Email address, or Google account identity | Only if you create an account | To let you sign in and keep your data |
| Email address | Only if you email us asking to be notified | To tell you once when new features launch |
3. What we do not collect
We do not keep your statement PDF or its password. We do not store your name, PAN, email, mobile number or address as printed on the statement; our parser does not return those fields. We do not collect bank account or nominee details. We do not read your email or SMS.
4. How your statement is processed
The PDF and password are sent over an encrypted connection to our parsing service, processed in memory, and discarded once the transactions have been extracted. We do not keep the file or the password, and neither is written to our database. Uploads pass through our hosting provider's request handling on the way, which may hold the request body briefly while it is being processed.
5. Legal basis
We process your personal data on the basis of your consent, given when you tick the consent box before uploading on folioq.in or accept the privacy notice in the app. You can withdraw consent at any time by deleting your data in Settings or emailing us. Withdrawal does not affect processing already done.
6. Who we share it with
We do not sell your data and do not share it with advertisers, lenders, distributors or fund houses. We use these service providers (Data Processors), only to run FolioQ:
- Supabase Inc. (database and authentication).
- Vercel Inc. (website and app hosting).
- Google Cloud (the service that reads your PDF).
- Google LLC, only if you choose to sign in with Google.
To draw your value chart we download public fund NAVs from AMFI and from mfapi.in. Those requests contain only public scheme codes, nothing about you. We may disclose data if required by Indian law or a lawful order.
7. Where data is stored
Your portfolio data is stored with our database provider, Supabase. We will name the exact hosting region here once it is final. Some service providers may process limited data, such as request logs, outside India.
8. How long we keep it
- Anonymous sessions: deleted automatically after 30 days without a visit. A visit means opening FolioQ in the browser that holds your session; each visit restarts the 30 days.
- Accounts: kept until you delete your data or ask us to close your account.
- Consent records: kept after deletion, without linked portfolio data, as evidence of consent. They contain the anonymous id, the time and the IP address recorded at the time of consent.
- Emails you send us: until the matter is closed, or until you ask us to delete them.
- Server logs held by our hosting providers: as per their retention periods.
9. Deleting your data
Open Settings in the app and press Delete my data. This permanently removes your transactions, holdings, returns and computed results straight away. You can upload again afterwards. The anonymous account itself, and the consent record, remain; the anonymous account is removed by the 30-day rule above. To close a saved account entirely, email hello@folioq.in.
10. Your rights
Under the DPDP Act you may:
- ask what personal data we hold and how it is processed;
- ask us to correct or complete it;
- ask us to erase it (you can also do this yourself with Delete my data in Settings);
- withdraw consent;
- nominate another person to exercise your rights in case of death or incapacity;
- raise a grievance with us and, if unresolved, complain to the Data Protection Board of India.
Email hello@folioq.in. For a grievance, write to our grievance contact, Manoj Attal, at that email address.
11. Security
Data is encrypted in transit. Our database provider encrypts stored data. Access to your data is restricted to your session by database row-level security. No system is perfectly secure; if a personal data breach occurs, we will notify affected users and the Data Protection Board as the law requires.
12. Children
FolioQ is not meant for anyone under 18. We do not knowingly process children's data.
13. Cookies, local storage and analytics
We use your browser's storage only to keep your session signed in. We do not use advertising cookies or third-party analytics trackers.
14. Changes
We will post updates here with a new date, and email account holders about material changes.
15. Contact
Manoj Attal (grievance contact)
Email: hello@folioq.in
Location: Pune, India
Please never email us your statement or PAN; we will never ask for them.