Privacy Policy

Introduction

This Privacy Policy describes how Investory (“Investory”, “we”, “our”, “us”) collects, uses, shares, protects, and otherwise processes your information and personal data through our website https://investory.win/ and the Investory application (collectively, the “Platform”). Investory is a portfolio-analysis tool for retail investors: you import your stock holdings, we pull publicly available fundamentals for each stock, score them, and produce portfolio health scores, summaries, and quarterly reports. Investory is not a broker, exchange, or marketplace, and we do not execute trades or hold your money or securities. Your personal data is primarily stored and processed in India. By using the Platform, creating an account, or availing any paid service, you agree to this Privacy Policy and our Terms of Use, and to processing in accordance with the laws of India (including applicable data-protection and privacy law). If you do not agree, please do not use the Platform.

Information we collect — we limit collection to what the Platform actually needs:

• Account details you provide at sign-up or sign-in — your email address, a password (stored only as a secure bcrypt hash), and, if you sign in with Google, the basic profile identifier Google returns.
• Portfolio & holdings data you import — the stock symbols, quantities, and related figures contained in a broker export (CSV/PDF/Excel) you upload, or synced read-only from a broker (such as Upstox) if you choose to connect one. We use this solely to analyse your portfolio and generate your reports.
• Broker connection tokens — if you connect a broker, we store only a temporary read-only access token issued via OAuth. We never see or store your broker password, and the connection cannot be used to place trades or move funds.
• Usage and access records generated when you use the Platform — such as sign-in events, feature usage, and subscription/plan status — used to operate the service, enforce plan limits, and detect abuse.
• Support communications you send us (for example, feedback or emails to support).

We do not collect biometric data, and we do not store your full card or bank-account credentials — payment details are handled directly by our payment processor / Merchant-of-Record partner (see Sharing, below). If anyone claiming to be Investory asks you for a card PIN, net-banking password, or OTP, do not share it — we never ask for these.

How we use your data

We use your data to create and operate your account; to import, analyse, and score your holdings and generate portfolio health scores, summaries, and quarterly PDF/email reports; to provide, maintain, and secure the Services; to enforce plan entitlements and detect, prevent, and investigate abuse or fraud; to process payments and manage subscriptions (via our payment partner); to respond to your support requests and send you service and account communications; to comply with legal and regulatory obligations; and to produce aggregated, non-identifying analytics about usage of the Services. We use your email for essential service and account messages (including the quarterly reports you opt into); any non-essential or marketing email is opt-out.

Sharing

We do not sell your personal data. We share it only as needed to run the Services: with our payment processor / Merchant of Record (Paddle) to take payments and manage subscriptions, subject to its own privacy policy; with infrastructure and service providers (such as our hosting and database provider Neon, email-delivery provider Resend, and AI providers used to parse uploaded files and generate summaries) that process data on our behalf under appropriate safeguards; with market-data providers (such as the BharatStock API) from which we fetch the public fundamentals for the stocks you hold — we send them the stock symbol, not your identity; and with authentication and broker providers (Google, Upstox) if you choose to use them. We may disclose personal data to government or law-enforcement agencies, or other parties, where we reasonably believe disclosure is necessary to comply with law or legal process, to enforce our Terms, or to protect the rights, property, or safety of Investory, our users, or the public.

Security Precautions

To protect your personal data from unauthorised access or disclosure, loss, or misuse, we adopt reasonable security practices and procedures. Data is encrypted in transit using TLS and at rest (our database provider encrypts data at rest using AES-256); passwords are hashed with bcrypt and never stored in plain text; and broker connections are read-only. However, the transmission of information over the internet is not completely secure for reasons beyond our control. By using the Platform you accept the inherent security implications of data transmission over the internet, and you are responsible for keeping your own login credentials safe.

Data Deletion and Retention

You can delete your account, disconnect a broker, or remove a portfolio at any time from your dashboard, or by writing to us at the contact address below; deleting your account deactivates it, removes your holdings and analysis data from our active systems, and cancels any active paid subscription. We retain personal data only for as long as needed for the purpose it was collected or as required by law. We may retain limited data longer where necessary to resolve a pending dispute, prevent fraud or abuse, meet a legal or compliance requirement, or maintain records of paid transactions, and we may keep aggregated, non-identifying data for analytics.

Your Rights

You may access, rectify, and update your personal data directly through the functionality provided in your dashboard, or by contacting us.

Consent

By visiting our Platform or by providing your information, you consent to the collection, use, storage, disclosure, and otherwise processing of your information in accordance with this Privacy Policy. If you disclose to us any personal data relating to other people, you represent that you have the authority to do so. You may withdraw consent you have already provided by writing to us at the contact address below with the subject “Withdrawal of consent for processing personal data”. We may verify such requests before acting on them. Your withdrawal of consent will not be retrospective and will be in accordance with our Terms of Use, this Privacy Policy, and applicable law. If you withdraw consent we consider necessary to provide the Services, we may restrict or deny the provision of those Services.

Changes to this Privacy Policy

Please check this Privacy Policy periodically for changes. We may update it to reflect changes to our information practices, and we may notify you of significant changes in the manner required under applicable law.

Contact us

Email: [email protected] · Hours: Monday – Friday (9:00 – 18:00 IST)