Privacy Policy

1. Overview & Data Handling Identity

Novekra ("we," "our," or "us") operates the Novekra financial intelligence workspace located at novekra.com. Novekra is an individually owned proprietary software platform operated by Harsh Ishwarbhai Mehta (no incorporated corporate entity, LLP, or registered partnership exists). For data privacy inquiries and operational administration of your personal data:

2. Data We Collect & How We Collect It

We collect information strictly necessary to provide portfolio tracking, financial analytics, and market intelligence:

• Account Credentials: Display name, verified email address, and encrypted password authentication tokens (managed securely via Supabase Auth).
• Self-Reported Financial Records: Manual asset entries, liabilities, budgeting transactions, cash flows, and financial goals recorded in your private workspace and synced to user-scoped database tables.
• Broker Demat Connections: When you choose to connect an authorized Indian broker account (e.g., Zerodha Kite Connect, Upstox API v2), we ingest temporary OAuth authorization tokens, account identifiers, and read-only portfolio snapshots (holdings, quantities, ISINs, and average purchase prices).
• AI Interaction Logs: Prompts submitted to Ask Novekra AI, deterministic tool inputs (e.g., stock quote lookups, financial calculator parameters), token usage metrics, and security audit timestamps.
• Technical Telemetry: Anonymized HTTP request headers, IP addresses, rate-limiting windows, and security audit logs required to protect service availability.

3. Purpose of Processing & Non-Monetization

Your personal data is processed solely for the following specified purposes:

• To compute and display personal portfolio valuations, asset allocation charts, and AMFI market-cap categorizations.
• To answer natural-language financial and mathematical queries via the Ask Novekra AI engine.
• To enforce tenant isolation, user rate limits, and cryptographic protection against cross-account data leaks.
• To fulfill statutory compliance obligations under applicable Indian privacy and cybersecurity laws.

We do NOT sell, rent, monetize, or broker your personal data or financial holdings to third-party advertisers, credit rating agencies, or data brokers.

4. Cryptographic Security & Broker Token Isolation

We implement defense-in-depth technical and organizational measures to safeguard sensitive financial data:

• AES-256-GCM Token Encryption: Broker credentials and OAuth access tokens are encrypted at rest using AES-256-GCM with Authenticated Additional Data (AAD) cryptographically binding the user ID, connection ID, and provider name. Unencrypted broker tokens are never persisted in plaintext.
• Database Row-Level Security (RLS): Every user table in PostgreSQL is governed by Supabase RLS policies ensuring that data can only be queried or mutated by the verified authenticated owner (`auth.uid() = user_id`).
• No Trading Execution Rights: Novekra requests strictly read-only portfolio permissions (`portfolio:read` or equivalent) from broker OAuth endpoints. Novekra has zero technical capability or tooling to execute buy/sell orders, withdraw funds, or modify demat accounts.
• Session Privacy & Cache Control: Sensitive financial endpoints enforce strict HTTP response headers (`Cache-Control: private, no-store, no-cache, max-age=0, must-revalidate`) preventing browser caching on shared workstations.

5. Third-Party Service Providers & Market Data Feeds

We engage vetted infrastructure and API providers to deliver platform features:

• Supabase Inc.: Managed PostgreSQL database hosting, authentication, and encrypted data storage.
• Upstox / RKSV Securities India Pvt. Ltd.: Platform market quote feeds, security search, company sector metadata, and optional broker demat portfolio sync. Market pricing is provided via periodic HTTP snapshots and may be indicative or delayed; it does not represent instantaneous tick-by-tick order-matching feeds.
• Zerodha Broking Ltd.: Kite Connect OAuth authorization and optional broker demat portfolio sync.
• OpenAI Inc.: Large language model processing for Ask Novekra AI. Chat requests are dispatched with `store: false` to prevent OpenAI from using customer queries for model training. Broker credentials and demat account numbers are never transmitted to OpenAI.

6. User Data Rights & Implemented Platform Controls

In accordance with general privacy principles and emerging standards under the Digital Personal Data Protection Act, 2023 (DPDP Act), Novekra provides the following implemented technical controls:

• Right to Access & Review: You can view all imported holdings, manual assets, and connected accounts directly within your workspace at any time.
• Right to Disconnect Brokers: You can disconnect your Zerodha or Upstox account at any time from Account Settings, which immediately deletes stored encrypted credentials from our database. Note that upstream broker tokens expire according to each broker's standard session expiration policy (or can be revoked in your broker portal).
• Right to Erasure (Account Deletion): You have the right to permanently erase your Novekra account and all associated data. You can execute this self-service operation in Account Settings, triggering an immediate cascade deletion across active database tables.
• Grievance & Privacy Inquiries: You may register questions, feedback, or complaints regarding personal data handling by emailing privacy@novekra.com. Inquiries are handled directly by the Operator on a reasonable best-effort basis while formal statutory grievance processes are being reviewed with legal counsel.

7. Regulatory & Non-Advisory Notice

8. Retention & Updates to This Policy

We retain personal data for as long as your user account remains active. When you initiate account deletion via Account Settings, your profile, imported broker portfolio snapshots, stored broker credentials, and related records are permanently removed from active application databases via automated cascade deletions. Technical rate-limiting counters operate on transient sliding time windows and reset automatically. Automated retention schedules, long-term archival policies, and specific log retention periods have not yet been formally established or audited, and remain subject to qualified legal review. We may update this Privacy Policy periodically; updates will be posted on the Platform.