Wealthiness ("we", "us", "the platform") is operated by an individual sole proprietor based in Mumbai, India. This policy explains what personal data we collect, why, who we share it with, and the rights you have under India's Digital Personal Data Protection Act, 2023 (DPDP), the EU/UK General Data Protection Regulation (GDPR), and equivalent laws elsewhere.
1. Who is the controller
The data controller is the sole proprietor operating Wealthiness from Mumbai, Maharashtra, India. For any privacy question, data request, or complaint, write to info@wealthiness.biz. A registered postal address can be supplied on written request.
2. Data we collect
- Account data: name, email, hashed password (or OAuth identifier), country, account-creation date.
- Onboarding answers: age, employment, income range, savings, business goals, time available, risk appetite, lifestyle preferences and (optionally) date/time/place of birth if you choose the cosmic feature.
- Plan data: generated blueprints, drafts, regenerations, downloaded PDFs, view counts.
- Payment data: we do not store full card or bank details. Our merchant of record (Paddle.com) processes payments and shares with us only: transaction ID, amount, currency, country, tax, and Paddle customer ID.
- Communications: support emails, push-notification opt-ins, marketing-email opt-ins.
- Usage & device data: IP-derived country, browser type, pages visited, timestamps, referring URL, error logs.
3. Why we collect it (legal basis)
- To provide the service: generate, store and display your plans (contract performance / DPDP "specified purpose").
- To process payment: issue tax-compliant invoices and prevent fraud (contract + legal obligation).
- To improve the product: aggregate, de-identified usage analytics (legitimate interest; consent for non-essential cookies).
- To send service emails (plan-ready, payment receipt, password reset) — contractual necessity.
- To send marketing — only with your explicit opt-in; withdraw any time.
4. Third-party processors
We share the minimum data needed with the following sub-processors. Each is bound by its own privacy commitments:
- Supabase (US/EU): database, authentication, file storage.
- Paddle.com (UK): merchant of record — payment processing, tax handling, invoicing.
- Anthropic (US): Claude API for plan generation. Inputs are sent for inference and not used to train models.
- Tavily (US): web-research API used during plan generation.
- Resend (US/EU): transactional email delivery.
- OneSignal (US): web-push notifications (only if you opt in).
- Google Analytics 4 (US): anonymised usage analytics (only if you accept analytics cookies).
- Inngest (US): background job orchestration for plan generation.
- Cloudflare (US/global): CDN, DDoS protection, edge runtime.
5. International transfers
Because some processors above are based outside India / the EEA, your data may be transferred to and stored in the US, EU, UK and other jurisdictions. Where required, we rely on the recipient's GDPR Standard Contractual Clauses or equivalent safeguards.
6. Cookies & analytics
We use a small number of strictly-necessary cookies for login and fraud prevention (no consent required). Analytics cookies (Google Analytics 4) are loaded only after you accept them. You can clear cookies from your browser at any time.
7. Retention
Account, plan and onboarding data are kept for as long as your account is active. After account deletion, personal data is erased within 30 days; anonymised analytics may be retained for statistical purposes. Tax-relevant payment records are kept for up to 8 years as required by Indian tax law.
8. Your rights
Under DPDP and GDPR you have the right to:
- Access a copy of your personal data
- Correct inaccurate data
- Erase your account and associated data ("right to be forgotten")
- Withdraw consent for marketing or analytics
- Port your data to another service
- Lodge a complaint with the Data Protection Board of India or your local supervisory authority
To exercise any right, email info@wealthiness.biz. We respond within 30 days.
9. Children
The service is not directed at, and we do not knowingly collect data from, anyone under 18. If you believe a minor has signed up, email us and we will delete the account.
10. Security
We use TLS in transit, encrypted storage at rest, row-level security on all user-scoped tables, and least-privilege access for administrators. No system is perfectly secure; we will notify affected users without undue delay if a breach materially risks your rights.
11. Changes
We may update this policy. The "Last updated" date above will change. Material changes are emailed to active users.