1. INTRODUCTION & OVERVIEW

Welcome to Upright (accessible via https://www.upright.club and associated applications), operated by Redingle Technologies Private Limited ("Upright", "Company", "We", "Us", or "Our"). Upright is a personalized wealth intelligence platform designed for Indian investors, providing automated financial insights, consolidated portfolio tracking, market update filtering, cashflow risk detection, and micro-investing capabilities.

Privacy isn't just a feature at Upright. We are committed to protecting your privacy, data sovereignty, and financial confidentiality. This Privacy Policy ("Policy") governs how we collect, process, store, disclose, and erase your Personal Data in strict compliance with applicable regulatory frameworks:

• The Digital Personal Data Protection Act, 2023 (DPDP Act);
• The Information Technology Act, 2000 and rules framed thereunder;
• RBI Non-Banking Financial Company – Account Aggregator Directions, 2025; and
• SEBI (Investment Advisers) Regulations, 2013.

By registering or using the Upright Platform, you acknowledge that you have read, understood, and agreed to the data practices described in this Policy.

2. REGULATORY ARCHITECTURE & OPERATIONAL ROLES

To maintain total compliance with Indian regulatory frameworks, Upright operates under a defined multi-entity structure:

2.1 Legal Status of Entities

• Redingle Technologies Private Limited: Operates as the technology platform, data custodian, and data processor responsible for user interface, data security infrastructure, visualization, and automated insights.
• Partha Harshal Deshpande: Sole proprietor and SEBI-Registered Investment Adviser (SEBI Registration No. INA000022321). Mr. Partha acts as the primary regulated Financial Information User (FIU) under the RBI Account Aggregator framework and owns all regulated investment advisory services provided through the platform.
• Finvu (Cookiejar Technologies Private Limited): RBI-licensed Non-Banking Financial Company – Account Aggregator (NBFC-AA) facilitating consent-driven data transfers from Financial Information Providers (FIPs).
• Augmont Goldtech Private Limited: Regulated bullion trading and vaulting entity providing execution and custody for Digital Gold and Digital Silver micro-investments.

2.2 Functional Segregation

• Automated Insights (Upright App): Visualizations, tax exposure flags, cashflow alerts, and AI responses are calculated algorithmically for informational purposes and do not constitute SEBI-regulated investment advice.
• Personalised Investment Advisory: Regulated investment advisory is provided strictly via a separate, dedicated onboarding flow under the SEBI RIA license of Partha Harshal Deshpande (INA000022321).

Micro-Investing: Buying and selling of Digital Gold and Digital Silver are fulfilled directly by Augmont, with payments processed securely via our payment gateway operator (currently, Cashfree Payments).

• Augmont Goldtech Private Limited acts as the independent seller, merchant of record, and vault custodian.
• Upright does not store physical gold/silver, maintain the physical vault ledgers, or guarantee metal purity (which is 24K / 99.9% pure, backed directly by Augmont).
• All Digital Gold/Silver balances, vaulting, and buybacks are bound by Augmont's Terms of Service.

3. ACCOUNT AGGREGATOR MANDATES & CREDENTIAL SECURITY

Upright aggregates financial holdings exclusively through the RBI-regulated Account Aggregator network powered by Finvu under the FIU mandate of Mr. Partha.

3.1 Finvu Terms & Consent Requirements

By initiating bank or portfolio aggregation on Upright, you agree to be bound by the Finvu Account Aggregator Terms & Conditions alongside this Policy. Consent is obtained exclusively through explicit, unbundled Consent Artefacts specifying the scope, purpose, and duration of access.

3.2 Credentials & OTP Security Guarantee

• Zero Password / external PIN Capture: Upright never capture, store your banking passwords, external PINs, or OTPs. All authentication occurs directly on your bank's secure portal or Finvu's SDK interface.
• No Exploratory Discovery: Upright will not execute background discovery requests without your explicit knowledge and approval.

4. CATEGORIES OF DATA WE COLLECT

5. PURPOSE OF COLLECTING DATA

We collect and process your data to provide, secure, and improve the Upright experience. In particular, we use it to:

• Create and verify your account, complete KYC, and provide support;
• Deliver personalized insights, automated analytics, and relevant value-added personal finance tools;
• Build your consolidated financial view and generate the prioritised insights, tax-exposure flags, cashflow alerts, and deep-dive analysis core to the platform;
• Power ARC's responses to your questions;
• Process your Digital Gold/Silver orders with Augmont;
• Support advisory services where you've separately opted in;
• Detect and prevent fraud, unauthorised access, and money-laundering, and meet our obligations to SEBI, RBI, and other regulators;
• Measure and improve Platform performance and usability;
• Send service updates and, where you haven't opted out, product tips and offers.

We don't use your data for any purpose beyond what's listed here and elsewhere in this Policy without asking first.

6. GOVERNANCE & PROCESSING

Upright features an AI-driven financial query assistant, ARC. We operate under strict contractual, technical, and privacy safeguards:

• Enterprise API Architecture: Upright's AI capabilities integrate with enterprise-grade APIs of advanced Large Language Models (including models provided by Google Gemini and other leading AI providers). All API requests are processed through secure, enterprise-tier endpoints under contractual data-processing terms that prohibit our providers from retaining or using your data beyond generating a response.
• Protection of Raw Financial Data: Your raw, personally identifiable financial records, bank transaction ledgers, and account balances are never shared with or used by third-party public AI models for model training. We do not transmit any personal identifyable personal data to any AI provider:
  • Your PAN, KYC documents, or verification status;
  • Full bank or demat account numbers;
  • Your name, phone number, email address, date of birth, or postal address;
  • Your banking passwords, external PINs, or OTPs - which we never hold at all (Section 3.2).
• Anonymized Data for Model Enhancement & Results: We may use aggregated, de-identified, and anonymized query patterns (from which all personal identifiers have been permanently stripped) to improve our AI systems' internal intent recognition, financial reasoning algorithms, and response quality.

7. DATA LOCALIZATION & ZERO CROSS-BORDER TRANSFERS

In strict compliance with Account Aggregator framework agreements and Indian data localization regulations:

• Indian Data Residency: Upright's own infrastructure, databases, and storage, including all Personal Data, Financial Information, backup files, and encrypted ledgers are hosted and processed exclusively on servers located within India. Where third-party AI providers, used to power ARC (refer Section 6), they operate under contractual data-processing terms requiring India-region processing wherever technically available, and prohibiting retention or use of your data beyond generating a response.

8. DATA SHARING & THIRD-PARTY DISCLOSURES

We do not sell or rent your Personal Data to third parties. We share your information only on a need-to-know basis with trusted partners, service providers, and regulated entities to facilitate platform services:

Operational Service Providers & External Links: Our Platform may contain links to or integrations with other third-party service providers or business partners not explicitly named above, solely to the extent required to execute, maintain, secure, or enhance platform services, or where you have provided explicit consent. We are not responsible for the privacy practices, security standards, or content of those linked external platforms. We encourage you to review the privacy policies and terms of any third-party service you visit or interact with.

9. DATA RETENTION, ERASURE & STATUTORY EXCEPTIONS

We retain Personal Data only for as long as necessary for the purpose it was collected, or as required by law - whichever is longer. Retention for regulated categories of data is governed by statutory minimums under the Prevention of Money Laundering Act, 2002 (which apply to KYC and transaction records for every user, whether or not you take advisory services), and, where you have taken advisory services, the SEBI (Investment Advisers) Regulations, which take precedence over shorter default periods.

9.1 Account Deletion & Data Retention Protocol

In the event you request account deletion or revoke your Account Aggregator consent, your data will be handled in accordance with the following rules:

• 30-Day Platform Hard Deletion (PII): Upon receiving an account deletion request or Finvu consent revocation, all your personally identifiable financial records, bank transaction ledgers, portfolio snapshots, and personal identifiers stored on Upright's production systems will be permanently hard-deleted within thirty (30) days of your deletion request or Finvu consent revocation (the KYC, transaction, advisory, and tax records listed above are unaffected by this and continue to be retained for their own statutory periods).
• Statutory SEBI & Tax Exceptions: If you formally enrolled in the SEBI-regulated investment advisory journey, Mr. Partha is mandated under SEBI (Investment Advisers) Regulations to retain advisory advice records, risk questionnaires, and compliance logs for the mandatory statutory period (typically 5 years). Similarly, statutory purchase invoices for Digital Gold/Silver transactions may be archived solely for tax and accounting compliance.
• Retention of Anonymized Data: Notwithstanding user account deletion or consent revocation, Upright reserves the right to retain, process, and utilize aggregated, de-identified, and anonymized data derived from your usage of the Platform prior to deletion. Such anonymized data does not contain any personally identifiable information (PII) and can no longer be linked back to re-identify any individual. Anonymized data may be retained indefinitely for platform analytics, trend analysis, research, risk modelling, system optimizations, and AI intent calibration.

10. DATA BREACH NOTIFICATION PROTOCOL

In the event of a confirmed or suspected security incident or data breach:

1. We will notify the Data Protection Board of India and affected Data Principals in the manner and within the timelines prescribed under the DPDP Act and Rules, and will notify CERT-In as required under applicable cybersecurity directions.
2. User Notification: Affected users will be notified without undue delay via registered email and in-app alerts, detailing the nature of the breach, measures taken, and recommended mitigations, in full compliance with the DPDP Act, 2023.

11. REASONABLE SECURITY PRACTICES & SAFEGUARDS

1. We understand that as effective as our security measures are, no security system is completely impenetrable. As part of our reasonable security practices under applicable Indian law and industry standards, we undergo strict reviews to ensure appropriate information security encryption and controls are placed for both data in motion and data at rest within our network and servers.
2. Data transmitted between your device and our servers is encrypted using industry-standard TLS/HTTPS protocols, and sensitive financial databases are stored at rest using AES 256-bit hardware encryption. Our databases are stored on cloud servers secured behind enterprise firewalls; access to these servers is password-protected, encrypted, and strictly limited to authorized personnel on a need-to-know basis under multi-factor authentication.

12. YOUR LEGAL RIGHTS UNDER THE DPDP ACT, 2023

As a Data Principal, you possess the following statutory rights:

1. Right to Access: Request a summary of your personal data processed by Upright and third-party disclosure logs.
2. Right to Correction & Erasure: Request updating of incomplete data or hard deletion of your identifiable records (subject to the statutory retention periods described in Section 9).
3. Right to Withdraw Consent: Revoke Finvu AA consent or platform processing consent at any time via app settings.
4. Right of Grievance Redressal: Right to prompt resolution of data grievances.
5. Right to Nominate: Nominate an individual to exercise your data privacy rights in the event of death or incapacity. See Section 17 for full contact details.

13. COOKIES AND TRACKING TECHNOLOGIES

Upright uses cookies, web beacons, mobile SDKs, and similar tracking technologies to enhance your browsing experience, maintain secure user sessions, analyze traffic patterns, and understand app feature engagement. Cookies don't give us access to personal data stored on your device.

1. Essential Cookies & SDKs: Necessary for session management, user authentication, and secure interaction with our APIs and account aggregator flows.
2. Analytics & Performance Cookies: Collect aggregated telemetry on how users interact with the app, screen load times, and feature navigation, enabling us to continuously improve product performance.

You can manage cookie preferences or SDK permissions through your browser or mobile device settings. Disabling essential session cookies or SDK permissions may impair core security controls and interactive features on the Platform.

14. MARKETING COMMUNICATIONS

We may send you product updates, tips, and promotional offers by email, telephone, SMS, WhatsApp, or in-app push notifications. You can opt out at any time using the unsubscribe link, or your in-app notification settings, or, by emailing us. Opting out of marketing does not affect essential service, security, or transaction-related communications, which we will continue to send.

15. CHILDREN'S PRIVACY

The Platform is intended for use only by individuals who are 18 years of age or older and capable of entering into a binding contract under the Indian Contract Act, 1872. We do not knowingly collect Personal Data from anyone under 18. If we become aware that we have inadvertently done so, we will delete it promptly. If you believe a minor has provided us with Personal Data, please contact us at the details in Section 18.

16. GOVERNING LAW & JURISDICTION

This Privacy Policy is governed by the laws of the Republic of India. Any legal dispute or proceeding arising out of or relating to this Policy shall be subject to the exclusive jurisdiction of the competent courts located at Kolkata, West Bengal, India.

17. GRIEVANCE REDRESSAL OFFICERS

In accordance with the Information Technology Act, 2000, the Consumer Protection (E-Commerce) Rules, 2020, and the DPDP Act, 2023, details of our designated Grievance Officer are set out below:

• Grievance Officer Level 1: Mr. Rahul Ghosh (rahul.ghosh@redingle.com)
• Grievance Officer Level 2: Mr. Partha Harshal Deshpande (partha@advisoira.com)
• SEBI RIA Registration No: INA000022321
• BASL Membership No: BASL2512
• Entity Name: Redingle Technologies Private Limited
• Jurisdiction / Location: Kolkata, West Bengal, India
• Compliance Email: compliance@advisoira.com
• Customer Support Email: support@redingle.com

If you are not satisfied with the resolution of a grievance relating to Advisory Services, you may lodge a complaint on SEBI's SCORES portal at scores.sebi.gov.in, or through the SEBI-recognised Online Dispute Resolution portal at smartodr.in.

18. CONTACT US

For all other queries about this Policy or our data practices, write to us at support@redingle.com

Redingle Technologies Private Limited

1-FR, 65/D/4, Naya Patty Road, Dum Dum Park, North 24 Parganas, West Bengal – 700055, India