Privacy Policy & Data Protection Notice
Effective Date: May 1, 2026. Last updated: August 14, 2026.
1. Data Protection Notice & Overview
Amortix ("we", "us", or "our") is committed to protecting your personal data in accordance with the Digital Personal Data Protection Act, 2023 (DPDP Act) of India. This Privacy Notice explains what personal data we collect, the purposes for processing, data retention schedules, third-party data processors, your rights as a Data Principal, and how you can exercise those rights.
2. Personal Data We Collect and Purpose of Processing
We collect personal data strictly for specified, lawful purposes with your consent or for performance of our contractual service:
| Category | Data Items Collected | Purpose | Legal Basis |
|---|---|---|---|
| Identity Data | Full name, email address, password hash | Account creation, authentication, security alerts | Consent & Contractual necessity |
| Financial Metrics | Monthly income, expenses, credit score range, employment type, emergency fund status | Calculating debt reduction strategies, risk scoring, AI advisor calculations | Consent (User provided) |
| Loan Inventory | Loan name, principal, balance, interest rate, tenure, EMI amount, lender name | Amortization schedule generation, payoff strategy comparison (Avalanche/Snowball) | Contractual necessity |
| AI Interaction Data | Chat message history with AI Advisor | Providing tailored debt advice, maintaining conversation context | Consent |
| Usage & Technical Data | Anonymized IP hash, device type, page views, error stack traces | Platform security, error troubleshooting, performance optimization | Consent (Analytics) & Legitimate interest (Security) |
3. Third-Party Data Processors
Amortix does not sell or rent your personal data. To deliver our services, we engage reputable third-party data processors bound by strict data processing agreements:
- Supabase Auth & Database: User authentication and encrypted database hosting (PostgreSQL).
- Vercel Inc.: Web application hosting, serverless edge infrastructure, and performance monitoring.
- PostHog Inc. (Consent-Gated): Product analytics and feature usage metrics (loaded only if analytics consent is granted).
- Functional Software (Sentry): Error logging and crash report capture.
- Google Workspace (Gmail SMTP): Transactional email delivery for EMI payment reminders.
4. Data Retention & Purge Schedule
In compliance with DPDP Act §8(7), we retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, or as required by applicable laws:
- Account Profile & Loan Data: Retained for the lifetime of your active account. Purged within 30 days upon account deletion.
- AI Conversation History: Retained for 12 months from creation date, after which message logs are automatically deleted.
- Financial Snapshots & Analytics: Retained for 24 months to power historical trend charts, then anonymized.
- Consent Logs: Retained for 5 years to demonstrate regulatory compliance as required under Indian law.
5. Your Rights as a Data Principal (DPDP Act, 2023)
Under Sections 11 to 14 of the DPDP Act, Indian citizens and platform users possess the following statutory rights:
Right to Summary & Access (§11)
Request a summary of your personal data being processed and identities of data processors shared with.
Right to Correction & Erasure (§12)
Request correction of inaccurate data or complete erasure of your personal data from our systems.
Right to Withdraw Consent (§6(4))
Withdraw your consent at any time. Processing prior to withdrawal remains valid.
Right of Grievance Redressal (§13)
File a complaint with our Grievance Officer, who must respond within 30 days.
6. Grievance Officer & Contact Information
If you have any questions, concerns, or grievances regarding our privacy practices or wish to exercise your data principal rights, please contact our designated Grievance Officer:
Grievance Officer: Data Protection & Compliance Cell
Entity: Amortix Platform Operations (India)
Grievance Email: amortix.admin@gmail.com
Response SLA: Acknowledged within 48 hours; resolved within 30 days as mandated by DPDP Act §13.