Privacy policy

This policy covers this website, krystalcapitals.com, and our investing app, invest.krystalcapitals.com. Both are run by Krystal Capitals.

Under India's Digital Personal Data Protection Act, 2023, we are the data fiduciary for the personal data you give us: we decide why and how it is used, and we are responsible for it.

We collect what you give us directly — your name, contact details, date of birth, PAN, bank details, income range, investment goals and risk profile — because a mutual fund distributor is required to collect it in order to transact on your behalf.

We also collect basic technical information when you use this website, such as browser type, device and pages visited. That is used to understand how the website performs, not to identify you.

We keep the emails and WhatsApp messages you send us.

In the investing app, we collect:

• Login details: your name, email address, mobile number, and a scrambled (hashed) form of your password. We never store the password itself.
• Identity and KYC: PAN, date of birth, gender, father's name, address, KYC and CKYC details, occupation, income range, source of wealth, politically exposed person status, place of birth and tax residency, which NSE needs to open your investment account.
• Bank details: account number, IFSC and account type, for payouts and AutoPay.
• Nominee details: name, relationship, share, contact details and identity proof of the people you nominate.
• Investments: your orders, SIPs, AutoPay mandates, folios and holdings, from you and from NSE and the fund houses' registrars.
• Plans: your answers to our risk questions, the plans we suggest to you, and the funds you add to checkout.
• Security and consent records: your IP address, device and browser details, the time of key actions such as giving consent, logging in or entering a code, and what our team does when they help you with your account.

To complete KYC, execute transactions with asset management companies and the NPS registry, understand your needs and suggest suitable schemes as a mutual fund distributor (we are not a SEBI-registered investment adviser), send you statements and portfolio reviews, answer your questions and complaints, and meet our legal and regulatory duties, including anti-money-laundering, tax, record-keeping and AMFI and SEBI rules.

In the investing app, we also use it:

• To open or link your investment account on NSE and keep it up to date.
• To place and track your purchases, SIPs, AutoPay mandates and redemptions.
• To confirm it's really you: email verification, login codes, and the checks we run when you link an existing account.
• To prevent fraud and misuse, and to keep a record of your consent.
• To send you service messages about your account.

In the app, we rely on the consent you give when you sign up and when you open or link an account, and on purposes the law allows without consent, such as meeting our legal obligations.

We never sell, rent or trade your personal data, and we never use it for advertising.

Only where necessary to serve you, or where the law requires it:

• NSE (National Stock Exchange of India), which runs the mutual fund platform the investing app uses to open your account and place your orders.
• Asset management companies (fund houses) and their registrars, CAMS and KFin Technologies (KFintech), who allot and hold your units and pay your redemptions.
• KYC Registration Agencies (KRAs), to check your KYC status.
• Banks and payment systems, through NSE, to collect payments and run AutoPay.
• PFRDA-appointed intermediaries, for NPS.
• Providers this website uses: Netlify, which hosts it; Google, which receives contact-form messages (through Google Apps Script) and runs Google Analytics on this website and in the investing app; and Meta, which runs WhatsApp.
• Service providers who process data for us under contract: our server-hosting provider; Resend, our email-delivery service, which sends the investing app's login codes and account notices; and our WhatsApp Business messaging provider and our customer-records (CRM) tool, which hold the WhatsApp chats you have with us so our team can reply. If we add codes by SMS later, our SMS provider too.
• Regulators, tax authorities, courts and law enforcement, where we are legally obliged.

Each of them receives only what it needs for the purpose above. Any service provider we work with is required to protect your information to the same standard we do. We don't share your data with anyone for their own marketing.

We offer Regular plans of mutual funds. For as long as you stay invested, the fund house pays us a trail commission (a small yearly percentage of what you have invested).

That commission is part of the fund's expense ratio (its yearly running cost, taken from the fund's value). This is why a Regular plan costs more than the Direct plan of the same fund. We charge you no separate fee.

Rates differ by fund house and by type of fund, and can change. Ask us, and we'll tell you what we earn on any fund. More in Disclosures & commissions.

If you message us on WhatsApp, the chat is handled by WhatsApp (Meta) under its own terms, and our replies are sent through our WhatsApp Business messaging provider and kept in our customer records. Messages that the investing app prefills for you never include your PAN, account number or email address.

Please don't send your password, a login code (OTP), card details or bank login to anyone, including us.

This website uses Google Analytics and Google Tag Manager to count visits and see which pages are used. Google Analytics sets first-party analytics cookies on this website for that. If you type an email address, phone number or postal address into a form here, Google Analytics may also send Google a scrambled (hashed) copy. We use no advertising cookies.

The tools on this website run entirely in your browser — the figures you enter are never transmitted to us or stored.

If you're logged in to the investing app, this website checks that with the app so its menu can show your account links. It learns only whether you're logged in.

The investing app also uses Google Tag Manager and Google Analytics to count visits and see which pages and steps are used, for example that an account was opened or that SIPs were started. It sends only the page address, without anything after the "?", counts, and for the planner the risk level of the result (for example "balanced"). It never sends your name, PAN, email, phone number, folio, client code or any amount. Google Analytics sets first-party analytics cookies on the app for this. Besides these, the app uses only the cookies it needs to work: one that keeps you logged in, short-lived ones used while you verify your email or enter a login code, one that remembers if you chose to hide amounts on screen, and one that lasts up to 10 minutes and passes these counts from our server to the page. It uses no advertising cookies.

If you invest with us or have a login on our investing app, we keep these records permanently, as part of our records as a mutual fund distributor. That stays the same if you close your login or stop investing with us:

• Your account details, including KYC and the consents you gave to open your account.
• Your answers to our risk questions.
• The plans we suggested to you.
• The funds you add to checkout.
• Your transactions.
• What our team does when they help you with your account.

Details we use only for marketing, such as your consent to hear about our services, are removed if you ask.

Security records from the investing app, such as login and verification logs, are kept for as long as they are needed to keep accounts safe. Sign-ups to the investing app that are never verified are deleted after 7 days. If you only contacted us through this website and never became a client, we delete your details 2 years after our last contact, or sooner if you ask.

• Encrypted connections for data in transit. The investing app is served only over HTTPS.
• Access to client records is restricted to team members who need it for their work. In the investing app, actions they take on your account are logged under their own name.
• In the investing app, passwords are stored only as hashes, and codes sent by email protect sign-up, login and account linking.
• PAN and bank account numbers are masked on screen in the investing app.

No system is perfectly secure, but these safeguards are reviewed regularly.

You may:

• Ask for a copy or a summary of the personal data we hold about you, and who we've shared it with.
• Ask us to correct, complete or update it. Details held by NSE, the KRAs or the fund houses may need a change request, which we'll help you with.
• Ask us to erase data we no longer need, such as marketing details. The distributor records listed under How long we keep it are kept permanently.
• Withdraw your consent, including for marketing, at any time. If you withdraw consent you gave in the investing app, we may be unable to keep servicing your account; investments you already hold stay in your name with the fund houses.
• Nominate someone to exercise these rights for you if you die or become unable to.
• Complain to us, and if you're not satisfied with our response, to the Data Protection Board of India.

To use any of these rights, contact us as set out below. If you use the investing app, please write from your login email so we can confirm it's you.

The investing app is for adults. We don't open accounts in it for anyone under 18. Nominee details you give us may include children; please share them only with the guardian's knowledge.

We may update this policy, for example when our services or the rules change. When we do, we change this page and the "Last updated" date at the top. If you keep using this website or the investing app after that, the new policy applies.