Privacy Policy

Last updated: 20 September 2026

This Privacy Policy explains what personal data Populse collects, why, and what you can do about it. Populse is operated by Subramani Shanmugam, sole proprietor (Udyam Registration UDYAM-TN-28-0207572), Tamil Nadu, India, who is the Data Fiduciary for your data under India's Digital Personal Data Protection Act, 2023 (DPDP Act).

Populse is an app for following listed Indian companies. It reads what a company files with the exchange, explains it in plain words in your language, tells you which dates need action, and links you to news published about that company. It is not a portfolio tracker, a broker, or a tax service.

1. What we collect

• Your mobile number — to sign you in by SMS OTP and to identify your account. This is the only personal identifier we require.
• Your app settings — the companies you follow, your reading language, your plan, and your notification preferences.
• Your notification token — an identifier issued by Google/Expo so we can deliver push notifications to your device. It is not your phone number and cannot be read by others.
• Feedback you send us — a thumbs rating, a face rating, or the text you type into the feedback form, together with the screen or item it refers to.
• Payment records — if you buy a plan, we store the payment reference, amount, date and status returned by Razorpay. We never see or store your card, UPI or bank details; those are handled entirely by Razorpay on its own checkout page.
• Device and diagnostic information — device model, OS version, app version and crash logs. These carry a randomly generated installation identifier so repeated faults on one device can be grouped; it is not derived from your device, your phone number or your account.
• Usage data — in-app actions such as which companies you open, so we can see which parts of the app work and which do not.
• Company search terms — what you type when searching for a company and how many results came back. These are recorded without any identifier — not your account, your phone number or your device — so a search cannot be traced back to you. We use them only to find companies our search fails to match.

2. What we do not collect

Populse does not offer portfolio tracking, broker connections, holdings import or tax calculations. We do not collect or ask for:

• your holdings, transactions, demat or CAS statements;
• your broker login, API keys or any credential that could place a trade;
• your PAN, bank account or card details;
• your contacts, photos, location or files.

Earlier versions of the app did offer an optional portfolio import. If you used it and any such data remains associated with your account, you can have it erased at any time by writing to us — see section 8.

3. Why we use it, and on what basis

We process your data on the basis of the consent you give when you create an account and accept our Terms, and only for these purposes:

• to sign you in and keep your account secure;
• to show you the companies you chose to follow, in the language you chose;
• to send you notifications about filings, dates and news for those companies;
• to take payment for a paid plan, and to process a refund if you ask for one;
• to fix faults, answer your support and feedback messages, and improve the app.

We do not use your data for advertising, we do not build a behavioural profile of you, and we do not make any automated decision that produces a legal or similarly significant effect on you. You may withdraw your consent at any time by deleting your account (section 8); withdrawal does not affect processing already carried out.

4. Where it is stored, and how it is protected

Your data is stored on Supabase infrastructure in the Mumbai (ap-south-1) region, so your personal data resides in India. Our application servers, which process requests, run on Fly.io in Singapore — our hosting provider retired its Mumbai region — so requests are processed outside India before the data is stored in India. This transfer is permitted under the DPDP Act, which allows transfer to any country the Central Government has not restricted.

Access is restricted by row-level security, all traffic uses TLS encryption, and authentication tokens are held on your device in the Android Keystore. Only one device can be signed in to an account at a time: signing in on a new device signs the previous one out.

5. Who else processes it

These providers process data strictly to deliver the Populse service, under their own contractual obligations to us:

• MSG91 — sends your sign-in OTP by SMS (receives your mobile number).
• Supabase — database hosting, Mumbai, India.
• Fly.io — application server hosting, Singapore.
• Google (Firebase Cloud Messaging) and Expo — deliver push notifications to your device.
• Cloudflare — caching and delivery of public reference data such as company lists. No account data is cached here.
• Anthropic (Claude API) — writes the plain-language explanation of a company's filing. Only the public filing text is sent; your identity is never sent, and Anthropic does not train on API data under its terms.
• Razorpay — takes payment and issues refunds (receives what you enter on its own checkout page).
• Angel One — supplies delayed market prices to our servers. This is a market-data feed; no account of yours is connected to it and no data about you is sent to it.

We do not sell your data, share it with advertisers or data brokers, or disclose it to anyone else, except where we are legally required to do so.

6. How long we keep it

• Account data (mobile number, followed companies, settings, sessions, notification token) — until you delete your account, after which it is erased within 7 business days.
• Usage and diagnostic events — automatically deleted after 30 days.
• Company search terms — automatically deleted after 30 days. They carry no identifier at any point.
• Feedback you send — kept while it is useful for improving the app, and deleted with your account.
• Payment and invoice records — retained for the period Indian tax and accounting law requires, currently up to 8 years, then deleted. These are kept only for legal compliance and are used for nothing else. This is the one category that survives account deletion.

7. If something goes wrong

If a personal data breach occurs, we will notify each affected user and the Data Protection Board of India without undue delay, as the DPDP Act requires, and tell you plainly what happened and what to do about it.

8. Your rights

As a Data Principal under the DPDP Act you have the right to:

• Access — ask for a summary of the personal data we hold about you and who it has been shared with.
• Correction and completion — have inaccurate or incomplete data corrected, in the app or by writing to us.
• Erasure — have your account and data deleted. See Delete your account, or email us. We complete this within 7 business days.
• Withdraw consent — at any time, as easily as you gave it.
• Nominate — name another person to exercise these rights on your behalf in the event of your death or incapacity. Write to us to register a nominee.
• Grievance redressal — complain to us first, using the details below. If you are not satisfied with our answer, you may complain to the Data Protection Board of India.

We answer rights requests free of charge. Please write from the mobile number or email address registered to your account so we can verify it is you.

9. Grievance Officer

For any question, request or complaint about your personal data, contact our Grievance Officer. This is also the contact point required under the DPDP Act and the Consumer Protection (E-Commerce) Rules, 2020.

Grievance Officer: Subramani Shanmugam
Email: support@populse.in (subject line: Privacy Grievance)
Address: Subramani Shanmugam, Sole Proprietor, Tamil Nadu, India
We acknowledge within 48 hours and resolve within 30 days.

10. Children

Populse is for users aged 18 and over. We do not knowingly collect data from anyone under 18, we do not track children, and we do not direct advertising at them. If you believe a minor has created an account, write to us and we will delete it.

11. Changes to this policy

We may update this policy. If a change materially affects your rights or how your data is used, we will notify you in the app before it takes effect.

12. Contact

Questions about this policy can be sent to support@populse.in.

Populse
Operated by: Subramani Shanmugam (Sole Proprietorship)
Udyam: UDYAM-TN-28-0207572
Tamil Nadu, India