Privacy Policy

MutualSpace — a product of Mutual Space Private Limited

Effective Date: 3 July 2026 | Last Updated: 3 July 2026

1. Introduction

Mutual Space Private Limited ("MutualSpace", "we", "us", "our") operates the MutualSpace mobile application and related services (the "App"), which allow users to explore, invest in, and manage mutual fund investments in India. This Privacy Policy explains what personal data we collect, why we collect it, how we use and share it, and the choices and rights available to you.

By downloading, accessing, or using the App, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree with the terms of this policy, please do not use the App.

2. Who We Are

This Certificate of Incorporation does not itself constitute a license to solicit deposits or funds from the public; our mutual fund distribution activity is conducted strictly within the scope of our AMFI/ARN registration.

3. Scope & Applicability

This Policy applies to all users of the MutualSpace App, available on Android and iOS, and covers data collected through the App, associated customer support interactions, and any linked web-based account portals. It does not cover the privacy practices of third-party platforms (such as your bank, UPI app, DigiLocker, or KRA) that you interact with independently of the App.

4. Information We Collect

We collect the categories of information below where necessary to open and operate your investment account, comply with SEBI/AMFI/KYC regulations, and provide the App's core functionality.

4.1 Identity & Contact Information

• Full name (as per PAN)

• Date of birth, gender

• PAN (Permanent Account Number)

• Email address and mobile number

• Residential address

• Profile photograph (optional, if uploaded)

4.2 KYC & Regulatory Information

• KYC status and KYC Registration Agency (KRA) records, sourced from and shared with CDSL Ventures Limited (CVL KRA) and CAMS KRA

• Documents retrieved via DigiLocker for identity verification and e-KYC

• Electronic signature (eSign) data captured during onboarding and transaction authorization

4.3 Financial & Transaction Information

• Bank account and UPI details used for SIP/lumpsum payments and redemptions

• Payment transaction records processed via the ONDC network

• Investment holdings, portfolio value, SIP mandates, order history, and transaction status

• Folio numbers and Asset Management Company (AMC) records associated with your investments

4.4 Communications Data

• OTPs and delivery records for SMS-based authentication and notifications, processed via MSG91

• Records of support requests, feedback, and correspondence with us

4.5 Device & Usage Information

• Device identifiers, operating system, and app version

• App activity, crash logs, and performance diagnostics, collected via Google Firebase

• IP address and approximate location (where permitted by your device settings)

5. How We Use Your Information

• To create and verify your investor account, including KYC and PAN verification

• To process mutual fund purchase, redemption, SIP, and switch transactions on your instruction

• To communicate transaction confirmations, portfolio updates, and account-related alerts via SMS, email, or push notification

• To send promotional and marketing communications about products, offers, and investment opportunities (see Section 11 for opt-out)

• To detect, prevent, and investigate fraud, unauthorized access, or security incidents

• To comply with SEBI, AMFI, PMLA, and other applicable regulatory and statutory obligations

• To respond to customer support requests and grievances

• To improve App performance, fix bugs, and understand feature usage through diagnostic data

6. Legal Basis for Processing

We process your personal data primarily on the basis of your consent, given at the time of onboarding and at each subsequent data-linked action (such as KYC verification or a transaction authorization). Certain processing is also carried out to comply with our obligations as a SEBI/AMFI-regulated intermediary, where such processing is permitted without separate consent under applicable law. You may withdraw consent at any time as described in Section 10, subject to our ability to continue serving you or complete statutory retention obligations already in progress.

7. How We Share Your Information

We do not sell your personal data. We share it only with the following categories of parties, strictly to the extent necessary to operate the App and fulfil your instructions:

All third parties that process data on our behalf are contractually bound to use it only for the specified purpose and to maintain reasonable security safeguards.

8. Data Storage & Security

• Data is stored on secure cloud infrastructure (Amazon Web Services) with encryption in transit (TLS/SSL) and access controls limiting data access to authorized personnel only.

• PAN, KYC, and financial data are handled in line with SEBI intermediary data-security expectations.

• While we take reasonable and appropriate measures to protect your data, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

9. Data Retention

We retain KYC records, transaction history, and related regulatory data for a minimum of 5 years from the date of account closure or the last transaction, in line with SEBI/AMFI record-keeping requirements. Data no longer required for these purposes, or for which you have validly withdrawn consent, is deleted or anonymized, except where continued retention is legally mandated.

If you request deletion of your account, we will delete your account and associated non-statutory data; records we are legally required to retain (such as KYC and transaction records) will be retained only for the mandated period and used solely for that regulatory purpose.

10. Your Rights

Under India's Digital Personal Data Protection Act, 2023, you have the right to:

• Access a summary of the personal data we hold about you and the processing activities involved

• Correct or update inaccurate or incomplete personal data

• Erase personal data that is no longer necessary for the purpose it was collected, subject to our statutory retention obligations

• Withdraw consent at any time for processing based on consent

• Nominate another individual to exercise your rights in the event of death or incapacity

• Grievance redressal — raise a complaint with us directly, and if unresolved, with the Data Protection Board of India

To exercise any of these rights, contact us using the details in Section 17. We will respond within a reasonable timeframe as required under applicable law.

11. Marketing Communications

We may send you promotional messages, product updates, and investment-related offers via SMS, email, WhatsApp, or push notification. You can opt out of marketing communications at any time by using the unsubscribe link in emails, replying STOP to SMS where supported, or adjusting notification preferences within the App. Opting out of marketing communications does not affect transactional or regulatory communications, which we are required to send.

12. Analytics, Cookies & Tracking

The App uses Google Firebase for analytics, crash reporting, and diagnostics. Firebase may collect device identifiers and usage data to help us understand app performance and fix issues. This data is used for internal product improvement and is not used to sell advertising to third parties.

13. Children's Data

The App is intended for use only by individuals who are 18 years of age or older, as mutual fund investment accounts require legal capacity to contract. We do not knowingly collect personal data from minors. If we become aware that we have inadvertently collected data from a minor, we will take steps to delete such data.

14. Data Breach Notification

In the event of a personal data breach that affects you, we will notify the Data Protection Board of India and affected users as required under the DPDP Act and Rules, and take reasonable steps to contain and remediate the breach.

15. Third-Party Links

The App may contain links to third-party websites or services (e.g., AMC fund fact sheets, DigiLocker, payment pages). We are not responsible for the privacy practices of these third parties, and we encourage you to review their respective privacy policies.

16. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. Material changes will be communicated via the App or email, and the "Last Updated" date at the top of this page will reflect the most recent revision. Continued use of the App after changes take effect constitutes acceptance of the updated Policy.

17. Grievance Officer & Contact

If your grievance is not resolved to your satisfaction within a reasonable period, you may escalate it to the Data Protection Board of India or the relevant SEBI/AMFI grievance redressal mechanism.

18. Governing Law & Jurisdiction

This Privacy Policy is governed by the laws of India, including the Digital Personal Data Protection Act, 2023, and applicable SEBI/AMFI regulations. Any disputes arising out of or in connection with this Policy shall be subject to the exclusive jurisdiction of the courts in Bangalore, Karnataka.

© 2026 Mutual Space Private Limited. All rights reserved.