Privacy Policy

Last updated: [DATE] Effective date: [DATE]

1. Who we are

This Privacy Policy explains how NextGenOS Financial Services Private Limited ("NextGenOS", "Taru", "we", "us", "our"), operating the website taru.money and the Taru parent and child mobile applications (together, the "Platform"), collects, uses, stores, shares and protects your personal data.

Current regulatory status: NextGenOS has applied to the Association of Mutual Funds in India (AMFI) for registration as a mutual fund distributor. This ARN application is pending as of the date of this Policy. We are not currently registered with AMFI or SEBI in any capacity. Until AMFI registration is granted, the Platform does not facilitate, execute, or earn commission on mutual fund transactions. See Section 4 for what the Platform does today versus what activates once the ARN is granted.

We are a Data Fiduciary under the DPDP Act in respect of the personal data we determine the purpose and means of processing.

Registered office: A-1304 Romell Diva, Jamuna Bldg, Chincholli Bunder, Malad West, Malad, Mumbai, Maharashtra - 400064 CIN: U66190MH2026PTC472911 Grievance Officer / Data Protection contact: Akshay Kumar, taru@taru.money, +91 8779695364

2. Scope

This Policy applies to:

  • Parent/guardian users who create accounts, complete KYC, and use the Platform to track an existing mutual fund portfolio and access financial-education content; and
  • Child users (individuals under 18 years) whose accounts are created and operated by a verified parent or lawful guardian.

By using the Platform you agree to the processing described here. Where we rely on consent, you may withdraw it at any time (see Section 9).

3. The personal data we collect

3.1 From parents/guardians

  • Identity & KYC data: name, date of birth, PAN, Aadhaar-derived verification tokens (where applicable), photograph, signature, address.
  • Contact data: email address, mobile number, postal address.
  • Financial data: mutual fund folio numbers, transaction history, and portfolio holdings imported from your existing Consolidated Account Statement (CAS) via our processor, CASParser. We do not currently hold your bank account details or execute transactions on your behalf — see Section 4.
  • Account & usage data: login credentials (stored in hashed/encrypted form), device information, IP address, and app interaction logs strictly necessary to provide and secure the service.

3.2 From or about children

  • Identity data: first name (or display name), age or age-band, and the link to the verified parent/guardian account.
  • Learning data: curriculum progress, completed activities, and lesson preferences at the level necessary to deliver the educational content selected by the parent.

Children — important limitation. We do not track, behaviourally monitor, or profile children, and we do not serve targeted advertising to children. Any personalisation of the child's experience (including content from the "Penny" character) is driven by the age cohort and learning settings selected and consented to by the parent, not by behavioural profiling of the child. [Founder note: this must match actual product behaviour. If Penny personalisation uses a behavioural profile of the child, this statement is false and the design must change — Section 9(3) DPDP Act prohibits tracking, monitoring, profiling, and behavioural targeting of children.]

3.3 What we do not collect

We do not collect special-category data beyond what is required for KYC, and we do not collect biometric data except Aadhaar-based verification tokens where you choose to use them.

4. What the Platform does today, and what happens once our ARN is granted

Today (pre-ARN):

  1. Importing and displaying your existing mutual fund portfolio (via CAS) for tracking purposes only.
  2. Delivering the financial-education content selected by the parent for the child.
  3. Operating, securing, and improving the Platform.
  4. Communicating service updates and regulatory information.
  5. Complying with legal and regulatory obligations (DPDP, Income Tax, applicable law).

Once AMFI registration (ARN) is granted, we will additionally process personal data to: 6. Complete KYC for mutual fund distribution. 7. Facilitate mutual fund transactions and portfolio operation in the parent's and/or child's name.

We will update this Policy and notify users before purposes 6–7 become active.

We will not use your data for any new purpose without fresh notice and, where required, consent.

5. Legal basis for processing

We process personal data on the basis of:

  • Your consent, obtained through a clear, itemised consent notice;
  • Verifiable parental consent for any processing of a child's data (see Section 6); and
  • Certain legitimate uses permitted under the DPDP Act (e.g. compliance with law, where you have voluntarily provided data for a specified purpose).

6. Children's data and verifiable parental consent

Before processing any personal data of a child, we obtain verifiable consent from the child's parent or lawful guardian, as required by Section 9 of the DPDP Act and Rule 10 of the DPDP Rules.

  • A child account can only be created and operated by a parent/guardian whose adult identity has been verified on the Platform (through our KYC process and/or a government-authorised digital identity token such as a DigiLocker-issued token).
  • A self-declaration or tick-box ("I am over 18", "I am the parent") is not sufficient and is not relied upon as verification.
  • We retain a record of the consent and the verification method.
  • The parent/guardian may review, correct, or delete the child's data and withdraw consent at any time, which will result in deactivation of the child's account and erasure of the child's data subject to legal retention requirements.

We do not undertake tracking, behavioural monitoring, or profiling of children, and we do not direct advertising at children.

7. Sharing and disclosure

We share personal data only with:

  • Data Processors acting on our instructions under contract (e.g. CASParser for CAS import; cloud hosting providers; analytics limited to non-child, aggregate data).
  • Regulators and authorities where required by law (tax authorities, courts, and — once we are registered — SEBI, AMFI, FIU-IND).

Once AMFI registration is granted, we will also share data with regulated intermediaries required to execute transactions: AMCs, RTAs (e.g. CAMS/KFintech), payment aggregators, and KYC Registration Agencies. This Policy will be updated at that time.

We do not sell personal data. We do not share children's data with advertisers.

8. Data processors and infrastructure

We engage processors who are contractually bound to protect personal data and to process it only on our instructions. Our current key processors include [CASParser, hosting/cloud provider, etc.]. A current list is available on request from the Grievance Officer.

9. Your rights as a Data Principal

Under the DPDP Act you have the right to:

  • Access a summary of the personal data we process about you and our processing activities;
  • Correction, completion, updating, and erasure of your personal data;
  • Grievance redressal (see Section 12);
  • Nominate another individual to exercise your rights in the event of death or incapacity; and
  • Withdraw consent at any time, as easily as it was given.

To exercise any right, contact our Grievance Officer (Section 1). We will respond within the timelines prescribed under the DPDP Rules.

10. Data retention and erasure

We retain personal data only for as long as necessary for the purpose collected or as required by law. When the purpose is served, consent is withdrawn, or you have not engaged with the service within the applicable retention period, we will erase the data, except where retention is legally required. Once we are AMFI-registered, SEBI/AMFI/PMLA record-keeping obligations will additionally apply. Child data is erased upon withdrawal of parental consent or account closure, subject to mandatory retention.

11. Data security and breach notification

We implement reasonable technical and organisational security safeguards, including encryption in transit and at rest, access controls, and logging. In the event of a personal data breach, we will notify the Data Protection Board of India and affected Data Principals in the manner and within the timelines prescribed under the DPDP Rules.

12. Grievance redressal and escalation

If you have any concern about how we process your personal data:

  1. Contact our Grievance Officer: Akshay Kumar, taru@taru.money, +91 8779695364. We will acknowledge and resolve your grievance within the timeline prescribed by law.
  2. If unresolved, you may escalate to the Data Protection Board of India in accordance with the DPDP Act and Rules.

13. Cross-border data transfer

Your data is primarily stored and processed in India. We may transfer data outside India only to countries/territories not restricted by the Central Government, and subject to applicable law and contractual safeguards.

14. Changes to this Policy

We may update this Policy. Material changes — including the activation of distribution-related processing once our ARN is granted — will be notified through the Platform. The "Last updated" date reflects the latest version.

15. Contact

NextGenOS Financial Services Private Limited A-1304 Romell Diva, Jamuna Bldg, Chincholli Bunder, Malad West, Malad, Mumbai, Maharashtra - 400064 Grievance Officer: Akshay Kumar | taru@taru.money | +91 8779695364