Privacy Policy
Crypto India is operated by Headkey Software Technologies Private Limited ("we", "us", "our"). Effective date: 9 October 2026 · Version: 2026-10-09
1. Who we are and how to contact us
Headkey Software Technologies Private Limited is the "Data Fiduciary" (under India's Digital Personal Data Protection Act, 2023, "DPDP Act") and the "controller" (under the EU/UK GDPR, where it applies) for the personal data described here.
- Privacy and grievance contact: info@headkeysoftwaresolution.com · +91 98450 00699
- Company identification number (CIN): U72900KA2019PTC130529
- Grievance Officer: Suhas Raju, info@headkeysoftwaresolution.com, #3, 3rd Floor, RR Block, 4th A Main, Santrupthi Nagar, J P Nagar 7th Phase, Bengaluru, Karnataka, India 560078
- Postal address: #3, 3rd Floor, RR Block, 4th A Main, Santrupthi Nagar, J P Nagar 7th Phase, Bengaluru, Karnataka, India 560078
2. What this policy covers
This policy explains what personal data Crypto India (a crypto portfolio dashboard for India (live prices, practice trading, TDS/tax tools; real custody only when a regulated custodian is connected)) collects, why, who we share it with, how long we keep it, and the rights and choices you have. It applies to the Crypto India website and web app, its APIs, and emails, SMS and push notifications we send.
3. Personal data we collect
| Category | Examples | Where it comes from |
|---|---|---|
| Account | Name, email, password (hash), Google profile picture, referral / leader handle | You / Google |
| KYC | Full name, PAN, Aadhaar last 4 + hash of full number, DOB, address, PEP status, source of funds | You |
| KYC verification | Full Aadhaar/PAN checked with Karza (OTP / PAN-Aadhaar link) when configured | You, Karza |
| AML | Sanctions / PEP screening results | Screening provider |
| Portfolio | Holdings, paper/live transactions, swaps, SIPs, alerts, watchlist, copy-trading, credits wallet | You / market data |
| Documents for AI insights | Uploaded ID/financial images sent to an LLM for analysis | You |
| Tax | 1% TDS estimates and Schedule VDA tax reports you generate | Calculated from your activity |
| Security | IP address, user agent, 2FA settings, login history | Automatically |
| Consent records | Policy versions accepted, time, IP, browser | When you accept |
We do not intentionally collect sensitive categories of data (such as health, financial account numbers, biometric data, religious or political beliefs) unless listed above. Please do not upload such data unless a feature specifically asks for it.
Payment card details are entered on the payment provider's own page or SDK. Crypto India receives only a payment reference, amount and status, never your full card number.
4. Why we use it (purposes) and our legal basis
| Purpose | Legal basis (DPDP Act) | Legal basis (GDPR, where applicable) |
|---|---|---|
| Create and secure your account, sign you in | Your consent (given at sign-up) | Performance of a contract |
| Provide the features you ask for (advisor answers, document insights, onboarding media) | Your consent | Performance of a contract |
| Process payments and keep billing records | Your consent; compliance with law (tax/accounting) | Contract; legal obligation |
| Send service emails (verification, password reset, receipts, security alerts) | Your consent | Contract; legitimate interests |
| Prevent fraud and abuse, keep the service secure | Legitimate uses permitted by law | Legitimate interests |
| Marketing messages (only if you opt in separately) | Your separate, optional consent | Consent |
We do not sell your personal data. We do not use your data for targeted advertising.
5. AI features
Crypto India uses AI for portfolio advice-style answers, insights on documents you upload (including KYC/ID images if you use that feature), and onboarding media. Uploaded document images are sent to the AI provider. AI output is not investment advice.
- AI output is generated automatically, can be wrong, incomplete or biased, and is not professional advice.
- Content you submit to an AI feature (text, images, audio, files) is sent to the AI provider listed below only to produce the result you asked for.
- How long each AI provider keeps that content, and whether it may use it to improve its models, is set by that provider's own terms (linked below). We do not use your content to train our own models.
6. Who we share it with
We share personal data only with service providers ("Data Processors") that help us run Crypto India, and only what they need:
| Provider | What it does for us | Their policy |
|---|---|---|
| Emergent | Hosting, optional Google fallback, AI gateway, file storage | https://emergent.sh |
| MongoDB | Database | https://www.mongodb.com/legal/privacy-policy |
| CoinGecko | Market prices | https://www.coingecko.com/en/privacy |
| Binance / WazirX / CoinDCX (data / links) | Exchange info | Their respective privacy policies |
| Stripe, Razorpay, PayPal | Credit top-ups and subscriptions | https://stripe.com/privacy · https://razorpay.com/privacy/ · https://www.paypal.com/in/legalhub/privacy-full |
| Custodian (only when live) | Holds crypto and executes transfers | Named in-app when configured |
| Karza | Aadhaar OTP, PAN, PAN-Aadhaar link | https://karza.in |
| OpenAI, Anthropic, Google Gemini | AI | Their privacy policies |
| SendGrid / Resend | https://www.twilio.com/legal/privacy · https://resend.com/legal/privacy-policy | |
| Twilio | SMS OTP | https://www.twilio.com/legal/privacy |
| Sign-in | https://policies.google.com/privacy | |
| AWS S3 (if enabled) | File storage | https://aws.amazon.com/privacy/ |
We may also disclose data if required by law, court order or a government authority with lawful power to ask, or to protect the rights, safety or property of our users or the public. If Headkey Software Technologies Private Limited is involved in a merger or acquisition, data may transfer to the new owner under this policy.
7. International transfers
Some providers above process data outside India (for example in the United States or the EU). We transfer data only to countries not restricted by the Government of India under the DPDP Act. Where GDPR applies, we rely on appropriate safeguards such as the provider's Standard Contractual Clauses.
8. How long we keep it
- Account data: while open.
- KYC, AML, transaction and tax records: as required by applicable law (including PMLA and tax rules) after closure.
- Consent and security logs: up to 3 years.
When you delete your account we delete or anonymise your personal data within 30 days, except records we must keep by law (for example invoices and payment records, usually kept for up to 8 years under Indian tax law), which we keep only for that purpose.
9. Your rights
Under the DPDP Act you can:
- get a summary of the personal data we hold about you and how we process it;
- ask us to correct, complete, update or erase your personal data;
- withdraw your consent at any time (this is as easy as giving it: ask us to delete your account by emailing info@headkeysoftwaresolution.com). Withdrawal does not affect processing already done;
- nominate another person to exercise your rights if you die or become incapable;
- raise a grievance with us at info@headkeysoftwaresolution.com. We aim to respond within 15 days. If you are not satisfied, you may complain to the Data Protection Board of India.
If the GDPR applies to you, you also have the rights of access, rectification, erasure, restriction, objection, data portability, and to complain to your local data protection authority.
How to use them: email info@headkeysoftwaresolution.com for a copy of your data, corrections, deleting your account or any other request. We may ask you to verify your identity first.
10. Children
Crypto India is meant for people aged 18 or older. You must confirm you are 18+ when you sign up. We do not knowingly collect personal data from anyone under 18. If you believe a child has given us data, email info@headkeysoftwaresolution.com and we will delete it.
11. Security
We use reasonable security safeguards, including encrypted connections (HTTPS), hashed passwords, access controls and limited staff access. No online service is completely secure. If a personal data breach affects you, we will notify you and the Data Protection Board of India as the law requires.
12. Cookies and local storage
See our Cookie Policy.
13. Changes to this policy
When we make a material change, we will update the version and effective date above and ask you to review and accept the new version the next time you sign in. You can always see the current version at /legal/privacy.
14. Contact
Headkey Software Technologies Private Limited · info@headkeysoftwaresolution.com · +91 98450 00699