Privacy Policy

1. Who we are

Parampara Nest (the "Platform") is a family wealth-management and legacy-planning service provided by Paramparanest Technologies Pvt. Ltd. ("Paramparanest", "we", "us"). It is available at www.paramparanest.com.

For the purposes of India's Digital Personal Data Protection Act, 2023 and the rules made under it (together, the "DPDP Act"), Paramparanest is the Data Fiduciary for the personal data processed on the Platform. "You" means anyone who creates or uses an account, including a Family Head and any Family Member invited to a family.

2. What this policy covers

This policy applies to the Platform — the website, the sign-up and sign-in pages, and the web application — and to messages we send you about your account. It works together with our Terms of Service and with the Privacy Notice shown inside the application's Privacy & Consent Center, which summarises the same practices at the point where you make each consent choice.

It does not apply to third-party websites or services you reach through links, or to your own dealings with banks, insurers or other institutions whose details you record on the Platform.

3. Personal data we collect

Account and profile information

• Your name, email address, mobile number, PIN code, state, district, city and address.
• The plan you select at sign-up, your role (Family Head or Family Member) and your Member ID.
• Profile details you add later, such as date of birth, gender, marital status, nationality and KYC status.

Family and financial records you choose to add

• Family member details, relationships and family events.
• Assets, liabilities and loans, bank lockers, insurance policies, business details, investments and SIPs, family income and expenses, travel documents, nominees and legacy or will-related information.
• These records can include account, policy, folio or registration numbers and values, because that is what the features are for. You decide what to enter.

Documents you upload

• Files you store in the Document Vault, attach to a record, or submit for automatic form filling — for example policy documents, statements, bills, photos and identity documents.

Security and account-activity information

• Your password, which is stored only in a one-way hashed form (see section 11).
• Two-step verification settings, trusted-device records, sign-in sessions, failed sign-in counts and temporary lockouts.
• One-time passwords (OTPs) issued for verification, which expire shortly after they are sent.

Consent and audit records

• Each consent you give or withdraw, with the time and the version of the Privacy Notice in force, and the acknowledgement you give when you agree to this policy at sign-up.
• An activity log of changes made within your family account, and requests you raise under "My Data Rights".

Communications

• Emails and WhatsApp messages we send you (such as OTPs, invitations and reminders) and their delivery status.
• Questions you type into the Ask Claude AI assistant (see section 6).

Technical information

• Information your browser sends with every web request, such as IP address, browser type and the pages requested, and the cookies and browser storage described in section 12.

Payment information

• We do not store your full card or bank account details. When paid plans are purchased, payment is handled by a payment service provider, and we receive only what is needed to confirm and manage your subscription (for example the plan, amount, date and a payment reference).

4. How we collect it

• From you — when you sign up, complete your profile, add records, upload documents, give or withdraw consent, or contact us.
• From your family — a Family Head may enter details about Family Members (for example when adding them to the family tree or sending an invitation), and Family Members with permission may add records to the family account.
• From documents you submit — when you use automatic form filling, details are read from the document you choose. You review them before anything is saved.
• From lookups you trigger — when you enter a PIN code or IFSC code, the matching place or bank branch details are fetched from a public directory to fill the form.
• Automatically — through cookies, browser storage and normal web request information, as described in section 12.

5. Why we use it and our legal basis

Under the DPDP Act, each purpose needs a lawful basis. Some of our processing relies on your consent, which you can manage at any time in the Consent Center. Some is necessary to provide the service you asked for or for other legitimate uses permitted by the DPDP Act, and is disclosed to you rather than asked for.

We do not use your personal data for advertising, we do not sell it, and we do not build marketing profiles from your financial records. Third-party cloud storage (Google Drive / OneDrive) is listed in the Consent Center but is not yet available; no such processing takes place until the feature is launched and you choose to connect it.

6. AI-assisted features

Two optional features use an artificial-intelligence service provided by Anthropic, PBC (the "Claude" models). They only run when you choose to use them.

Automatic form filling (document scan)

When you upload a document and choose to have its details filled in automatically — for example an insurance policy, a gold purchase bill or an investment statement — the document you selected is sent to the AI service so that the relevant fields can be read from it. The extracted details are shown to you to check and edit before anything is saved. If you prefer not to use this, you can always type the details in yourself.

Ask Claude AI assistant

When you ask Ask Claude AI a question, your question, the recent conversation, and a summary of the family records you are permitted to view are sent to the AI service to generate the answer. That summary is limited to items such as names, categories, statuses and values. It deliberately excludes account numbers, policy numbers and similar identifiers, and it never includes the contents of your documents. The assistant can only read; it cannot create, change or delete anything.

AI-generated answers and extracted details can be inaccurate. Please check them before relying on them. The separate Nest Assistant help widget works inside your browser and does not send your data to an AI provider.

7. Who we share it with

People you authorise

Your family records are visible only to you and to the Family Members that you, or your Family Head, grant access to, within the level of access granted. Each family's records are held separately, and every request is checked on our server against the signed-in person's permissions, so one family cannot see another family's records.

Service providers

We use the following providers to run specific features. Each receives only what that feature needs.

Legal and safety reasons

We may disclose personal data where required by law, court order or a lawful request from a government authority, or where necessary to protect the rights, safety or security of our users, the public or the Platform.

Business changes

If Paramparanest is involved in a merger, acquisition or reorganisation, personal data may be transferred as part of that transaction, subject to this policy and applicable law. We will tell you before your data becomes subject to a different privacy policy.

8. Processing outside India

Your account and family records are stored on servers located in India. Some service providers listed in section 7 — including Anthropic, Google and Meta — may process the data they receive in other countries, such as the United States. Any such transfer is made only as the DPDP Act permits, and never to a country or territory that the Government of India has restricted by notification.

9. How long we keep it

• While your account is active, we keep your account information and records so the Platform can work for you and your family.
• Archived records. When you archive an asset, liability, document or will, it moves to the Archived Vault and becomes read-only. This preserves your family's history rather than erasing it.
• Consent and audit records are kept as an unalterable record of what was asked and what was answered. Nobody, including us, can edit or delete them after they are written, because they are our evidence of compliance.
• OTPs, sessions and trusted-device records expire automatically; sessions and trusted devices last up to 30 days.
• After your account is closed, or once the purpose for which the data was collected no longer applies, we delete or anonymise your personal data, except where we must keep it longer to comply with law, resolve a dispute, enforce our terms, or because it is linked to an obligation that is still active, such as an outstanding loan recorded in your family account.

10. Your rights and choices

Under the DPDP Act you have the right to:

• Access information about the personal data we process about you and how it is used, and obtain a copy of your data. You can export your data at any time from Privacy & Consent → My Data Rights.
• Correct, complete or update inaccurate or incomplete data. Most details can be edited directly in the application.
• Request erasure of personal data that is no longer needed, subject to the retention exceptions in section 9.
• Withdraw consent at any time in the Consent Center. Withdrawing is as easy as giving consent. It stops the processing that relies on that consent from then on; it does not affect processing already carried out, and access already granted to a Family Member is not removed automatically — ask your Family Head to remove it if that is what you want.
• Grievance redressal — raise a complaint about how your data is handled (see section 15).
• Nominate another person to exercise these rights on your behalf in the event of your death or incapacity, by writing to our Grievance Officer.

Requests raised inside the application by a Family Member are first reviewed by that family's Family Head. You can also contact our Grievance Officer directly at any time. If you are not satisfied with our response, you may complain to the Data Protection Board of India after first using our grievance process.

You can also control notifications by changing your WhatsApp & Email Notifications consent, and sign out of devices you no longer use.

11. How we protect it

We use reasonable technical and organisational safeguards appropriate to the sensitivity of family financial information, including:

• Passwords stored only as salted, one-way PBKDF2-HMAC-SHA256 hashes — never in readable form.
• Optional two-step verification, with its secrets encrypted where they are stored.
• Sign-in session cookies that page scripts cannot read (HttpOnly), automatic sign-out after 10 minutes of inactivity, and a temporary lock after 5 failed sign-in attempts.
• A permission check on our server for every record that is read or changed — the browser is never trusted to decide what you may see — and separate storage for each family's records.
• Access to the AI assistant limited to a safe summary that leaves out sensitive identifiers (section 6), and rate limits on messaging features.
• Encrypted (HTTPS) connections to our public website, and an unalterable audit trail of consent decisions.

No method of storing or transmitting data is completely secure, so we cannot guarantee absolute security. If a personal data breach occurs, we will notify the Data Protection Board of India and the affected users as the DPDP Act requires. Please keep your password private, turn on two-step verification, and tell us straight away if you suspect someone else has used your account.

12. Cookies and browser storage

We use only what the Platform needs to work. We do not use advertising cookies, cross-site tracking or third-party analytics.

Google Maps, which loads only when you open the map picker, may set its own cookies under Google's policies. Blocking cookies for our site will prevent you from signing in.

13. Children and family members

Accounts may only be created by adults aged 18 or over. A family's records can include information about children and other relatives — for example in the family tree, as nominees, or as the insured person on a policy. If you enter information about another person, you confirm that you are entitled to do so and, for a child, that you are their parent or lawful guardian providing that information on their behalf. We do not knowingly allow children to create accounts, and we do not use children's data for tracking, behavioural monitoring or targeted advertising.

14. Changes to this policy

We may update this policy as the Platform or the law changes. Each version carries a version number and effective date at the top of this page. If a change materially affects how we use your personal data, we will tell you through the application or by email before it takes effect and, where the change relies on consent, ask for your consent again. The in-app Privacy Notice keeps every earlier version, so the wording you agreed to always remains available.

15. Grievance Officer and contact

If you have a question, a request about your personal data, or a complaint, please contact our Grievance Officer:

Please include your registered email address or Member ID so we can find your account. We will acknowledge your grievance within 2 working days and aim to resolve it within 30 days. Signed-in users can also raise requests from Privacy & Consent → My Data Rights.