SmartInvest — Privacy Policy
Last updated: 19 September 2026 Effective date: 19 September 2026
1. About this Policy
1.1 This Privacy Policy explains how Ankura Assets LLP (LLPIN: ABA-1446), a limited liability
partnership registered under the Limited Liability Partnership Act, 2008, with its registered
office at No. 581, 2nd Floor, 23rd 'A' Main, 21st Cross, Sector 2, HSR Layout, Bengaluru – 560102,
Karnataka, India, operating the SmartInvest platform (referred to as "SmartInvest", "we",
"us", "our") collects, uses, shares, retains and protects your personal data when you use
the SmartInvest website at https://smartinvest.co.in/ and related services (together, the
"Platform").
1.2 SmartInvest is the Data Fiduciary responsible for your personal data processed through the Platform. This Policy forms part of, and should be read with, our Terms of Service and Risk Disclosure Statement.
1.3 This Policy is published in accordance with the Information Technology Act, 2000 and the rules made under it, and is designed to align with the Digital Personal Data Protection Act, 2023 ("DPDP Act"). Where the DPDP Act and its rules are brought into force in a way that requires changes, we will update this Policy.
1.4 We will make this Policy available in English and, on request, in any language listed in the Eighth Schedule to the Constitution of India.
2. Key terms
- "Personal data" — any data about an individual who is identifiable by or in relation to that data.
- "Processing" — any operation performed on personal data, including collection, storage, use, sharing, disclosure and erasure.
- "Data Principal" — the individual to whom the personal data relates (you).
- "Data Fiduciary" — the person who determines the purpose and means of processing (SmartInvest).
- "Data Processor" — a person who processes personal data on our behalf (for example, our hosting or email provider).
- Terms such as Opportunity, Holding Vehicle, SPV, LLP, Investment, Transaction Documents and KYC have the meanings given in the Terms of Service.
3. Personal data we collect
3.1 Account and profile data
Name, email address, mobile number, password (stored only in hashed form), and your account preferences and settings.
3.2 Identity and KYC data
To meet identity-verification and anti-money-laundering obligations we collect:
- your PAN and a copy of your PAN card;
- your Aadhaar number and a copy of your Aadhaar (see Section 9 for how we handle this);
- date of birth, and residential address;
- a photograph and specimen signature;
- data automatically extracted from your uploaded documents by optical character recognition (OCR) for you to review and confirm; and
- any additional identity or source-of-funds information we are required to collect.
3.3 Bank and financial data
Bank account details that you provide (including to our team offline) so that investment funds can be transferred and any refunds returned, and details of the amounts you indicate or invest.
3.4 Investment and platform activity
Your Expressions of Interest, the Opportunities you view or engage with, your Investments and their status, signed Transaction Documents, and records of communications and steps in the offline investment process.
3.5 Communications data
The content and metadata of messages you send us or receive from us — in-app messages, inquiry form submissions, emails, SMS, WhatsApp messages, and notes and recordings of calls with our team.
3.6 Marketing and contact-list data
If you are on a contact list we use for updates and campaigns — including a contact whose details were provided to us by a third party or imported from an external list — we hold your name and contact details, the source of those details, your engagement with our messages (for example whether a message was delivered or opened), and your communication preferences and opt-outs.
3.7 Technical and usage data
Device and browser type, operating system, IP address, approximate location derived from IP, pages viewed and actions taken on the Platform, timestamps, referring pages, and diagnostic and error logs. Some of this is collected using cookies and similar technologies (Section 7).
We do not intentionally collect special categories of data beyond the identity data above, and we ask that you do not send us health, religious, caste, political or similar information. Some of the data in Sections 3.2 and 3.3 (password, financial and bank information) falls within "sensitive personal data or information" as defined under the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and is handled with the additional safeguards described in Section 10.
We do not collect data from your device beyond ordinary browser/technical data (Section 3.7) — in particular, we do not read your SMS messages, access your contacts, or collect device identifiers for credit-risk scoring. That kind of collection is standard for lending platforms assessing creditworthiness, which SmartInvest is not; we call this out because it appears in some diligence comparisons and should not be assumed to be part of our data collection.
4. How we collect personal data
- Directly from you — when you register, complete your profile, submit KYC, express interest, communicate with us, or provide bank details for a transfer.
- Automatically — through cookies, server logs and analytics when you use the Platform.
- From third parties — from a person who refers you or adds you to a contact list, from sponsors or co-investors in connection with an Opportunity, from our service providers, and from public or government sources where needed to verify your identity or comply with law.
5. Why we process your personal data, and our legal basis
| Purpose | Data used | Basis |
|---|---|---|
| Create and operate your account; provide the Platform | 3.1, 3.4, 3.7 | Performance of our agreement with you / your consent |
| Verify your identity and assess eligibility | 3.2, 3.3 | Compliance with legal obligations (KYC); your consent |
| Prevent, detect and investigate fraud, money laundering and misuse; screen against sanctions and databases | 3.1–3.7 | Compliance with legal obligations; legitimate use |
| Facilitate an Investment you choose to make — including sharing your data with the relevant Holding Vehicle, sponsor and their advisers | 3.1, 3.2, 3.3, 3.4 | Performance of our agreement with you; your consent; steps to enter the Transaction Documents |
| Process fund transfers and refunds | 3.3, 3.4 | Performance of our agreement with you |
| Communicate with you about your account, KYC, Expressions of Interest and Investments (service messages) | 3.1, 3.4, 3.5 | Performance of our agreement with you; legal obligation |
| Send you updates, newsletters and marketing about SmartInvest and new Opportunities | 3.1, 3.6 | Your consent (which you can withdraw at any time) |
| Provide customer support and handle grievances | 3.1, 3.5 | Performance of our agreement with you; legal obligation |
| Maintain, secure, debug and improve the Platform; analytics | 3.7 | Legitimate use; your consent for non-essential cookies |
| Keep records and make disclosures required by law, regulators or courts | as required | Compliance with legal obligations |
| Establish, exercise or defend legal claims; corporate transactions | as required | Legitimate use |
6. Consent and how to withdraw it
6.1 Where we rely on your consent, we ask for it clearly and separately, and we do not bundle it into your acceptance of the Terms of Service. You are not required to consent to marketing in order to use the Platform.
6.2 You can withdraw your consent at any time — for marketing, by using the unsubscribe link or the preferences in your account, or for any processing based on consent, by contacting the Grievance Officer (Section 16). Withdrawing consent is as easy as giving it.
6.3 Withdrawal takes effect going forward and does not affect processing already carried out. If you withdraw consent that is necessary to provide a service, we may not be able to continue providing that service. We may continue to process data where we have another lawful basis — in particular to meet KYC, anti-money-laundering, tax and record-keeping obligations.
7. Cookies and similar technologies
7.1 We use a small number of strictly necessary cookies and similar technologies to run the
Platform — in particular a secure, http-only session cookie (si_session) that keeps you logged
in, and local browser storage for interface preferences. These cannot be switched off without
breaking core functionality.
7.2 As of this Policy, the Platform does not use analytics, performance, or advertising cookies, and does not use third-party or cross-site tracking cookies. If any are introduced in future, we will list them here with their provider, purpose and duration, and provide a consent mechanism.
7.3 You can control cookies through your browser settings. Blocking strictly necessary cookies will prevent you from signing in.
8. How we share your personal data
We share personal data only as described below. We do not sell your personal data.
8.1 Within SmartInvest. Our staff and contractors may access your data on a need-to-know basis to operate the Platform, verify KYC, prepare and manage documents, provide support, and meet compliance obligations. Access is limited by role.
8.2 With a Holding Vehicle and its parties, for an Investment you choose to make. If you proceed with an Opportunity, we share the data needed to document and complete your Investment with the relevant SPV, LLP or co-ownership group, its sponsor or manager, the other co-investors where relevant, and their lawyers, chartered accountants, registrars and bankers.
8.3 With service providers who process data on our behalf, under contract and only on our instructions, including:
- cloud hosting and infrastructure — Amazon Web Services (EC2 compute, RDS database, and S3
document storage), India region (
ap-south-1); - email delivery — Amazon Simple Email Service (AWS SES), India region;
- messaging — WhatsApp only, via Gupshup as our WhatsApp Business Solution Provider, for service and (where you have consented) marketing messages. We do not use SMS.
- IT support, error monitoring and analytics — none currently used.
8.4 With professional advisers — our own lawyers, auditors and accountants, under confidentiality.
8.5 With authorities — regulators, tax authorities, the Financial Intelligence Unit, law enforcement, and courts, where required by law or to report or investigate suspected fraud or money laundering. We may be prohibited by law from telling you when we make such a disclosure.
8.6 In a corporate transaction — if SmartInvest is involved in a merger, acquisition, financing or sale of assets, your data may be disclosed to the counterparty and its advisers, subject to confidentiality, and may transfer to a successor that agrees to protect it consistently with this Policy.
8.7 With your consent or at your direction — for any other purpose we tell you about at the time.
9. KYC documents and Aadhaar
9.1 We use your KYC data and documents only to verify your identity, assess your eligibility, meet anti-money-laundering and tax obligations, and document your Investments. We do not use them for marketing or profiling.
9.2 KYC documents are stored in encrypted object storage (AWS S3) rather than on the application server. Access to KYC documents is restricted to authorised personnel. Where we export identity data (for example to prepare Transaction Documents), the export is restricted to authorised personnel and is deleted when no longer needed for that purpose.
9.3 Aadhaar and PAN masking. Decided 2026-09-19: we mask both your Aadhaar number and your
PAN wherever they are displayed or stored for general use — showing only the last four characters
(for example XXXX XXXX 1234 for Aadhaar, XXXXX1234X for PAN) — consistent with UIDAI's
requirement to retain only the last four digits of an Aadhaar number outside a limited set of
authorised purposes. The unmasked document image and number remain available only within the
encrypted KYC document store (Section 9.2) for identity verification and for preparing Transaction
Documents, where the full number is genuinely required. Engineering work landed 2026-09-19:
both fields are now masked at the source in every API response (the investor's own view, and every
admin screen); an admin can only see the unmasked numbers via an explicit, separately-logged
"reveal" action, used to cross-check against the uploaded document.
You may choose to provide an alternative officially valid document instead of Aadhaar where the law
allows.
9.4 We keep KYC records for the period required by the Prevention of Money-Laundering Act, 2002 and the rules under it (see Section 11).
10. Storage, location and security
10.1 Location. Your personal data is stored and processed in India. We do not transfer personal data outside India. If that changes, we will update this Policy and comply with the DPDP Act's transfer rules.
10.2 Security. We apply reasonable technical and organisational measures appropriate to the
risk, including: encryption of data in transit (HTTPS), hashed password storage, an http-only
secure session cookie, role-based access controls, an Origin check and rate limiting on sensitive
endpoints, security headers, and logging. KYC documents are stored in a private, encrypted-at-rest
(S3 default encryption) AWS S3 bucket in India (ap-south-1) rather than on the application
server's local disk.
10.3 No system is completely secure. You are responsible for keeping your login credentials confidential and for the security of your own devices and email account.
10.4 Breach notification. If a personal-data breach occurs, we will notify the Data Protection Board of India and affected Data Principals as required by the DPDP Act and its rules.
11. How long we keep your personal data
| Data | Retention |
|---|---|
| Account and profile data | While your account is active, and for 12 months afterwards to handle queries and disputes |
| KYC data and documents | At least 5 years after your relationship with us and each Holding Vehicle ends, as required by the Prevention of Money-Laundering Act, 2002 |
| Investment records and Transaction Documents | For the life of the Investment and for 8 years afterwards |
| Communications and support records | 3 years from the last interaction, or longer if relevant to a dispute or legal obligation |
| Marketing contact data | Until you unsubscribe or object, and then only a suppression record so we do not contact you again |
| Technical logs | 12 months, longer if needed for security investigation |
When a retention period ends, we delete the data or irreversibly anonymise it.
12. Your rights
Subject to the conditions and exemptions in applicable law, you have the right to:
- Access — get a summary of the personal data we hold about you and how we process it, and the identities of the Data Fiduciaries and Processors with whom we have shared it;
- Correction and completion — have inaccurate or misleading data corrected, and incomplete data completed or updated;
- Erasure — have your personal data erased where it is no longer needed for the purpose it was collected and we are not required to keep it by law;
- Withdraw consent — as described in Section 6;
- Grievance redressal — raise a grievance about our handling of your data or our response to a rights request; and
- Nominate — nominate another individual to exercise your rights in the event of your death or incapacity.
How to exercise your rights. Contact the Grievance Officer (Section 16) from your registered email or through your account. We may need to verify your identity. We will respond within 30 days. Our services are normally free; we may charge a reasonable fee or decline a request that is manifestly unfounded, excessive or repetitive, and will tell you why.
Complaints. If you are not satisfied with our response, you may complain to the Data Protection Board of India once it is operational, and you retain any other remedy available under law.
13. Children's data
The Platform is intended only for individuals aged 18 or over. We do not knowingly collect personal data of children. If we learn that we have collected a child's data without the required consent, we will delete it. We do not carry out tracking, behavioural monitoring or targeted advertising directed at children.
14. Third-party links
The Platform may link to third-party websites and services. We are not responsible for their privacy practices. Review their policies before providing them your data.
15. Changes to this Policy
We may update this Policy from time to time. We will post the updated version on the Platform and change the "Last updated" date. For material changes we will take reasonable steps to notify registered users, such as by email or an in-app notice. Continued use of the Platform after a change takes effect means you accept the updated Policy, except where your fresh consent is required.
16. Grievance Officer and contact
Grievance Officer
- Name: Compliance Team, Ankura Assets LLP
- Email:
grievance@smartinvest.co.in - Address: No. 581, 2nd Floor, 23rd 'A' Main, 21st Cross, Sector 2, HSR Layout, Bengaluru – 560102, Karnataka, India
You may contact the Grievance Officer about this Policy, to exercise your rights, or to raise a complaint. We will acknowledge your complaint within 48 hours and endeavour to resolve it within 30 days.
General privacy queries: support@smartinvest.co.in.