Privacy Policy
This Privacy Policy explains how VK Investing ("we", "us", "our") collects, uses, stores, shares and protects your personal data when you use our website and services. We are committed to handling your data lawfully and transparently in accordance with the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the Information Technology Act, 2000 and rules made thereunder.
We collect the minimum we need to run a subscription website: your email and name so you can log in, your payment record so we can give you access and send an invoice, and basic analytics so we know which articles people read. We do not sell your data. We do not share it for advertising. We never see your card details.
1. Who we are (Data Fiduciary)
| Data Fiduciary | VK Investing, operated by Vishal Kumar |
|---|---|
| Contact | connect@vkinvesting.com |
Under the DPDP Act, we act as the Data Fiduciary in respect of the personal data described below, and you are the Data Principal.
2. Personal data we collect
2.1 Data you give us directly
| Data | When | Why |
|---|---|---|
| Email address | Account creation | Login, account identification, service emails |
| Full name | Account creation / profile | Personalising your account and invoices |
| Phone number (optional) | Profile | Account recovery and service notifications |
| Payment reference data | Subscription purchase | Recording your subscription, issuing an invoice |
| Correspondence | When you email us | Responding to your query or complaint |
2.2 Data collected automatically
- Usage data — pages viewed, time on page, referring page, approximate session behaviour;
- Device and technical data — browser type and version, operating system, screen size, language;
- IP address — used for approximate location (country/city level), security and abuse prevention;
- Cookies and similar technologies — see Section 9.
2.3 What we do NOT collect
- Your full card number, expiry date or CVV — these go directly to our payment gateway and never touch our systems;
- Your net banking credentials or UPI PIN;
- Your demat account, portfolio holdings, trades or broker details — we do not ask for these and you should never send them to us;
- Your income, net worth or financial position — we are an educational publisher and have no need for this information;
- Aadhaar, PAN or other government identifiers (unless separately required for a lawful tax or refund obligation, in which case we will tell you why).
3. Why we process your data (purposes)
We process personal data only for the following specified lawful purposes:
- Providing the Service — creating and maintaining your account, authenticating logins, and granting access to the content you are entitled to;
- Processing payments — recording your subscription, activating access, issuing GST invoices, and processing refunds;
- Service communication — subscription confirmations, invoices, renewal reminders, expiry notices, and important changes to the Service or these policies;
- Content notifications — informing you when new content is published, where you have opted in;
- Support — responding to your questions and resolving complaints;
- Improving the Service — understanding in aggregate which content is read and how the site performs;
- Security and fraud prevention — detecting unauthorised access, credential sharing and abuse;
- Legal compliance — meeting tax, accounting, and other statutory obligations.
4. Legal basis — your consent
We process your personal data on the basis of the consent you provide when you create an account, subscribe, or continue to use the Service, and for certain legitimate uses permitted under the DPDP Act (such as complying with a legal obligation).
Your consent is free, specific, informed, unconditional and unambiguous, and is given by a clear affirmative action. You may withdraw your consent at any time — see Section 8. Withdrawal does not affect the lawfulness of processing carried out before withdrawal, and may mean we can no longer provide parts of the Service to you.
5. Who we share your data with
We do not sell your personal data. We do not rent it, trade it, or share it with advertisers or data brokers.
We share the minimum necessary data with the following service providers ("Data Processors"), who act on our instructions:
| Provider | Purpose | Data shared |
|---|---|---|
| Supabase | Database, authentication and file storage | Email, name, phone, subscription status |
| Razorpay | Payment processing | Name, email, payment details (collected directly by them) |
| Netlify | Website hosting and delivery | IP address, technical request data |
| Resend | Transactional email delivery | Email address, name, invoice content |
| Google Analytics | Aggregate usage analytics | Pseudonymised usage and device data |
We may also disclose personal data where required by law — including to comply with a court order, statutory notice, regulatory direction, or lawful request by a government authority — or to establish, exercise or defend legal claims.
If our business is transferred, merged or acquired, personal data may be transferred as part of that transaction. We will notify you before your data becomes subject to a different privacy policy.
6. Where your data is stored
Your data is stored on servers operated by the providers listed above, which may be located outside India. Where personal data is transferred outside India, we do so in accordance with the DPDP Act and any restrictions notified by the Central Government, and we require our processors to maintain appropriate security safeguards.
7. Security
We implement reasonable security safeguards to protect personal data against unauthorised access, disclosure, alteration and loss, including:
- HTTPS/TLS encryption for all data in transit;
- Encryption at rest, as provided by our infrastructure providers;
- Passwords stored only in hashed form — we cannot see your password;
- Row-level security controls so that a user can only access their own account record;
- Restricted administrative access;
- Payment data handled entirely by a PCI-DSS compliant gateway, never by us.
However, no method of transmission or storage is completely secure. We cannot guarantee absolute security. In the event of a personal data breach, we will notify the Data Protection Board of India and affected users as required by the DPDP Act.
8. Your rights as a Data Principal
Under the DPDP Act you have the following rights:
| Right | What it means |
|---|---|
| Right to access | Obtain a summary of the personal data we hold about you and how we process it |
| Right to correction | Have inaccurate or misleading data corrected, and incomplete data completed |
| Right to erasure | Have your personal data deleted where it is no longer needed and no law requires us to keep it |
| Right to withdraw consent | Withdraw consent at any time, as easily as it was given |
| Right to grievance redressal | Complain to us about how we handle your data, and receive a response |
| Right to nominate | Nominate another individual to exercise your rights in the event of your death or incapacity |
How to exercise these rights: email us at connect@vkinvesting.com from your registered email address, stating clearly what you want. We will respond within a reasonable period and in any case as required by law. Some data may need to be retained for statutory tax or accounting reasons even after a deletion request.
You may unsubscribe from content notification emails at any time using the unsubscribe link in those emails. Transactional emails (invoices, renewal notices, security alerts) will continue while your account is active, as they are necessary to provide the Service.
9. Cookies
We use a small number of cookies and similar technologies:
- Strictly necessary — to keep you signed in and maintain your session. The Service cannot function without these.
- Analytics — to understand aggregate usage, such as which articles are read most. These help us improve the content.
We do not use advertising cookies, retargeting pixels or third-party ad trackers. You can block or delete cookies through your browser settings, though doing so may prevent you from logging in.
10. Data retention
| Data | Retained for |
|---|---|
| Account data (name, email, phone) | While your account is active, and a reasonable period thereafter |
| Subscription and invoice records | As required by applicable tax and accounting law (generally 8 years) |
| Support correspondence | Up to 3 years from resolution |
| Analytics data | As per our analytics provider's retention settings |
When personal data is no longer needed for the purpose it was collected and no legal obligation requires its retention, we will erase it or irreversibly anonymise it.
11. Children's data
The Service is not intended for anyone under 18 years of age. We do not knowingly collect personal data of children. We do not undertake tracking, behavioural monitoring or targeted advertising directed at children. If we become aware that we have collected data of a child without verifiable parental consent, we will delete it promptly. If you believe a child has provided us data, please contact us immediately.
12. Automated decision-making
We do not use your personal data for automated decision-making or profiling that produces legal or similarly significant effects on you.
15. Limitation of our responsibility
While we take reasonable steps to protect your personal data, you acknowledge and agree that:
- No system is completely secure. We do not warrant that the Service or our processors' systems are immune from unauthorised access, and we accept no liability for any breach that occurs despite reasonable safeguards;
- We are not responsible for the acts or omissions of third-party processors (hosting, database, payment, email and analytics providers) beyond requiring them to maintain appropriate safeguards;
- We are not liable for any loss arising from your own conduct, including sharing your login credentials, using a compromised device, or failing to keep your contact details current;
- We are not liable for non-delivery or delayed delivery of any email, including login codes, invoices and renewal reminders, where caused by your mail provider, spam filtering, or an incorrect address;
- We are not responsible for data you voluntarily send us that we did not request — in particular, please never send us portfolio holdings, demat details, bank credentials or income information;
- To the fullest extent permitted by law, our liability in connection with personal data is limited to the amount you paid us in the three months preceding the event.
16. Data you should never send us
We do not need and do not want: your demat account details, portfolio holdings, trading history, bank account credentials, card numbers, UPI PIN, net worth, income details, or Aadhaar number. If you send such information voluntarily, you do so at your own risk and we accept no responsibility for it, though we will delete it once identified.
17. Changes to this Policy
We may update this Privacy Policy from time to time. The "Last updated" date will change. Where changes are material, we will notify you by email or by a prominent notice on the site before they take effect.
18. Grievance Officer
In accordance with the DPDP Act and the Information Technology Act, 2000, the contact details of our Grievance Officer are:
| Name | Vishal Kumar |
|---|---|
| Designation | Grievance Officer & Data Protection Contact |
| connect@vkinvesting.com | |
| Acknowledgement | Within 48 hours of receipt |
| Resolution | Within 15 working days |
If you are not satisfied with our response, you have the right to escalate your complaint to the Data Protection Board of India established under the DPDP Act.