Privacy Policy

1. Who is responsible

GetMeIPO is operated by [Legal entity name — to be confirmed], [Registered address — to be confirmed] ("we", "us"). We decide how your personal data is used, so we are the data fiduciary under the Digital Personal Data Protection Act, 2023 ("DPDP Act").

2. What we collect

Your Google account. When you sign in with Google we receive and keep your Google account ID, name, email address and profile photo. We never see your Google password.

Sessions. Each sign-in creates a session that lasts up to 30 days. We store a hashed session token, its expiry and your browser's user-agent, and set one HttpOnly cookie in your browser to keep you signed in.

Applicant details you choose to save. Names, PAN, demat IDs, UPI IDs and, if you add them, bank account numbers for you and family members, plus your budgets, plan and Pro trial status. These are encrypted with AES-256-GCM before they are written to the database.

Telegram, if you link it. Your Telegram chat ID and username, and your alert choices.

Technical logs. Our hosting providers may keep standard request logs (such as IP address, browser and time) for security and troubleshooting.

We do not collect your UPI PIN, bank or broker passwords, or card details. We don't place bids, so we never see your money.

3. Why we use it

To sign you in and keep you signed in; to show you your own saved applicants, budgets, plans and allotments, and let you copy them when you apply; to send the Telegram alerts you switch on; to work out whether your account has Pro; and to keep GetMeIPO secure. Alert messages contain public issue information and, unless you switch off "My bids" in Settings, your first name and the labels you gave your applicants (like "Spouse") with the issues they bid in and the amounts. They never contain PAN, demat, UPI or bank details. We may also send you occasional service messages on Telegram, such as a reminder that your Pro plan is ending; send /stop to the bot to stop all messages. We do not sell your data, share it with brokers, or use it for advertising or marketing.

4. Family members' data and consent

When you save another person's details you act on their behalf, and the DPDP Act expects you to have their consent. Save details only for people who have agreed and asked you to manage their applications. If they withdraw consent, remove their details with Remove; it takes effect straight away.

5. How we protect it

Saved applicant details are encrypted with AES-256-GCM using a key kept separately from the database, so a copy of the database alone can't be read. Connections use HTTPS. Session tokens are stored only as hashes. Access to production systems is limited to the people who run GetMeIPO. No system is perfectly secure; if a breach affects your data, we will tell you and the Data Protection Board of India as the DPDP Act requires.

6. Who we share it with

Only the service providers that make GetMeIPO work, and only what each one needs:

Google, to verify your sign-in. Telegram, to deliver your alerts. Our hosting and database providers, which store data on our behalf: Railway (app server), Neon (database, hosted on AWS in Singapore) and Vercel (website only, no account data). An AI model provider for the AI verdict, which receives public issue data only, never your details or applicants: [AI provider — to be confirmed].

We may also disclose data where Indian law requires it.

7. Cookies

The app uses one essential cookie to keep you signed in. The website uses no advertising or analytics trackers.

8. How long we keep it

We keep your data while your account is open. Sessions expire after 30 days, and expired sessions and Telegram link codes are purged regularly. Press Delete account in Settings and we remove your account, sessions, Telegram link and saved applicants from the database straight away. Disconnect Telegram, or send /stop to the bot, to remove the Telegram link alone. Backups, if any, are overwritten on a rolling basis [backup retention period — to be confirmed].

9. Your rights

Under the DPDP Act you can ask for a summary of your data, correct or update it, have it erased, withdraw consent, nominate someone to act for you, and raise a grievance. Most of this you can do yourself in the app (edit, Remove, Delete account). For anything else, write to [Contact email — to be confirmed]. If you're not satisfied with our answer, you can complain to the Data Protection Board of India.

10. Children

GetMeIPO is for adults. Don't create an account if you're under 18. A minor's details should be saved only by their parent or lawful guardian.

11. Changes

We may update this policy. The date at the top shows the latest version, and we'll flag material changes in the app.

12. Contact and grievance officer

Email: [Contact email — to be confirmed]. Grievance officer: [Grievance officer — to be appointed], [Registered address — to be confirmed].