Last updated 27 September 2026
This policy covers two different kinds of data, handled two different ways:
We process your account data to provide you the Services and bill you for them. We process client data you enter solely to run the calculations, reports, and features you use — never for our own purposes, and never sold to anyone.
Before you enter or import a client's data, the platform requires you to confirm that client has been informed their data will be stored in S4PMIA and has given free, specific, and informed consent to that. This is your responsibility as the client's advisor and Data Fiduciary — our confirmation step is there to create a record of when you told us that, not to replace your own duty to actually obtain it.
We use a small number of trusted service providers ("subprocessors") to run the platform. We don't sell your data or your clients' data to anyone, for any purpose.
| Who | What they do for us | Where |
|---|---|---|
| Supabase | Hosts our database — this is where all client data lives, encrypted. | AWS ap-northeast-1 (Tokyo, Japan) |
| Vercel | Hosts the S4PMIA web application. | United States (global edge network) |
| Anthropic | Powers the AI-assisted document-import feature (reads an uploaded document to pre-fill a client's record). | United States |
Some of these providers process data outside India. India's data protection law currently permits transferring personal data to any country the government has not specifically restricted, and none has been restricted as of this policy's date. If that changes, we'll adjust our practices to stay compliant.
We keep your data for as long as your account is active. If your account is cancelled, client data is flagged for deletion 30 days later and deleted once that's confirmed — except data you're independently required to keep under SEBI's record-keeping rules (currently five years from the relevant record, longer if a client dispute is open), which we'll retain on your written instruction for that period instead. You can request an export of your data, in a common file format, at any time.
Under the DPDP Act, a Data Principal (you, or your client) can ask to access, correct, or erase their personal data, and to know who it's been shared with. For your own account data, contact us directly. For your clients' data, they should generally go through you (their advisor and Data Fiduciary) first — but if a client contacts us directly, we'll help them get in touch with you, and provide you reasonable technical assistance to fulfil their request within the platform.
For any complaint about how your data, or your clients' data, is handled through S4PMIA, contact our Grievance Officer at grievance@s4pmia.com.
The Services are not directed at, and we do not knowingly collect data from, individuals under 18. An advisor should not enter a minor's data into the Services without appropriate parental or guardian consent, obtained in line with the DPDP Act's rules on processing a child's data.
We may update this policy from time to time. We'll notify you of material changes before they take effect.
Questions about this policy: grievance@s4pmia.com.
This is a working draft prepared with AI assistance and is being reviewed before it is treated as final.