Privacy Policy

• •Account information: name, email address, PAN (encrypted at rest)
• •Financial data: transaction history, holdings, capital gains — imported from broker contract notes and trade reports you upload, or that we read from a mailbox you connect
• •Usage data: pages visited, features used (for improving the product)

• •Portfolio tracking: computing holdings, P&L, FIFO lots, and capital gains
• •Tax computation: LTCG/STCG classification, surcharge, cess calculations
• •Report generation: Schedule CG, tax computation sheets, holdings valuation
• •Email processing: if you connect a mailbox, we scan it on a schedule and parse the broker statements and contract notes we find, to import trades automatically
• •We do NOT use your data for trading, advisory, or recommendation purposes

• •All data is stored on encrypted AWS infrastructure in the Mumbai (ap-south-1) region
• •PAN numbers are encrypted at rest using AES-128 encryption
• •Passwords are hashed using bcrypt (never stored in plain text)
• •All connections use HTTPS/TLS encryption
• •Authentication uses JWT tokens with 24-hour expiry
• •We never ask for or store your broker login credentials
• •If you connect a mailbox, the app password you provide IS stored, encrypted at rest, because it is what lets us keep reading new statements. Deleting the connection deletes it

• •We do NOT sell, rent, or share your personal or financial data with any third party
• •We do NOT provide your data to advertisers, data brokers, or analytics companies
• •We use Anthropic’s Claude to read your financial documents. The document’s contents are sent for parsing; we do not send your name, PAN, or account identifiers as separate data
• •We use Google Gemini only to read PUBLIC company filings from the exchanges (for example, demerger announcements). Your documents are never sent to it
• •We use AWS SES for sending transactional emails (invite links only)

• •If you connect your mailbox, we access it read-only via IMAP using an app password you provide — scoped to fetching broker statements and contract notes
• •We do NOT have access to your Gmail account, contacts, or other emails beyond that read-only scan
• •We only read the contract note and statement attachments (PDF files)
• •You can revoke access at any time by disconnecting your mailbox

• •Access: You can view all your stored data through the app
• •Correction: You can edit your profile, transactions, and holdings at any time
• •Erasure: You can ask us to delete your account and all associated data by writing to the Grievance Officer below. We action it within 30 days and confirm when it is done
• •Withdraw consent: You can disconnect a mailbox at any time, which deletes the stored app password and stops all further reading. Withdrawing consent does not undo processing already carried out lawfully
• •Nominate: You can nominate another person to exercise these rights on your behalf in the event of death or incapacity, by writing to the Grievance Officer
• •Complain: If we do not resolve your grievance, you may escalate to the Data Protection Board of India
• •Portability: You can export your data from the Statements tab (PDF/Excel downloads)

• •Your portfolio and tax data is retained while your account is active, because it is the record your filings are computed from — a capital-gains history is not useful if it is truncated
• •Original document files (the PDFs we parsed) are purged after 365 days; the figures extracted from them remain
• •If you delete your account, all personal and financial data is permanently deleted — this action is irreversible
• •Consent records are retained after deletion, as the law requires us to be able to show what was agreed and when
• •We may retain anonymised, aggregated data that cannot identify you

Under the Digital Personal Data Protection Act, 2023, you may contact our Grievance Officer about anything in this policy, or to exercise any right listed above:

• •Grievance Officer, Scade — privacy@scadeai.in
• •We acknowledge within 72 hours and resolve within 30 days
• •If you are not satisfied with our response, you may complain to the Data Protection Board of India

• •If a breach affects your personal data, we will notify you and the Data Protection Board of India without undue delay, with what we know: what happened, which data was involved, and what we are doing about it
• •We will tell you even where we are not certain of the impact. You should hear it from us rather than discover it

• •We use localStorage for authentication tokens and UI preferences
• •We do not use tracking cookies or third-party analytics

Scade is not intended for users under 18 years of age.

• •We may update this policy from time to time
• •Changes will be posted on this page with an updated date
• •Continued use of Scade after changes constitutes acceptance

• •For privacy concerns: privacy@scadeai.in
• •For general inquiries: support@scadeai.in