Privacy Policy

1. Introduction & Scope

WinToday Technologies ("WinToday", "We", "Us", "Our") respects your personal privacy and is committed to transparent data management. This Privacy Policy applies to personal information collected through our Android mobile application, website, and related financial operational services.

This policy reflects actual technical and data processing workflows implemented in the WinToday codebase. We do not engage in unauthorized third-party data brokerage or selling of investor information. Please read this document carefully to understand how your information is handled.

2. Categories of Personal Data Actually Collected

We collect only the information necessary to provide, administer, and secure our investment services, fulfill identity verification obligations, and disburse payouts:

A. Account & Contact Details

• Basic Identifiers: Full name, verified mobile phone number, email address, and referral code attribution.
• Security Credentials: Passwords stored in irreversibly hashed form using Bcrypt, and optional client-side application PINs.

B. Profile & Demographic Information

• Date of birth, gender, residential address (address lines, city, state, postal PIN code), country of residence, and uploaded profile photograph or selfie image.

C. Identity Verification & KYC Data

• PAN Records: 10-character Permanent Account Number (PAN), verification status, date of submission, and digital image copies of the PAN card.
• Aadhaar DigiLocker Verification References: Verification session references and status tokens generated during authorized consent-based DigiLocker eKYC flows via our authorized technology partner (Message Central). Note: WinToday stores masked references (e.g., ••••••••1234) and does not store or process raw biometric fingerprints or iris records.
• Live Selfie Verification: Facial selfie photographs submitted by the investor to confirm liveness and establish match with identity documentation.
• Administrative Dossier History: Review timestamps, verification notes, and status transition logs (KycStatusHistory).

D. Banking & Financial Details

• Beneficiary bank name, account holder legal name, bank account number (masked in routine displays), Indian Financial System Code (IFSC), and branch name.
• Nominee designations (nominee legal name, relationship, date of birth, mobile number, and allocated allocation percentage).

E. Transaction & Payment Records

• Deposit transaction amounts, payment method selected (UPI, IMPS, NEFT), submitted 12-digit Unique Transaction Reference (UTR) numbers, and uploaded payment receipt screenshots (PaymentReceipt).
• Investment plan contracts, daily return ledger credits, withdrawal requests, and payout settlement references.

F. Technical Telemetry & Device Data

• Firebase Cloud Messaging (FCM) device tokens, hardware model, operating system platform (Android/iOS), IP addresses, user-agent headers, and authentication timestamps.

3. Purposes of Data Processing

Your personal and financial data is processed for specific, verifiable operational purposes:

• Identity Verification & Fraud Prevention: Validating that investors are genuine Indian resident adults and preventing identity theft, duplicate accounts, or synthetic user manipulation.
• Contract Execution & Account Administration: Processing deposits, matching UTRs against bank statements, activating investment plans, calculating daily returns on business days, and processing payouts.
• Whitelisted Withdrawal Disbursement: Ensuring that funds are disbursed exclusively to the verified bank account belonging to the authenticated account holder.
• Operational Communications: Delivering critical transaction receipts, KYC approval notices, withdrawal status alerts, and security notifications via push notifications, SMS, or email.
• Legal & Regulatory Recordkeeping: Maintaining immutable financial transaction histories and audit logs required for accounting and commercial compliance under Indian laws.

4. Data Storage & Access Controls

We apply structured organizational and technical controls to safeguard personal records:

• Controlled Database Infrastructure: Data is persisted in relational database stores protected by firewall rules, network isolation, and strict administrative credentials.
• Sensitive Attribute Masking: Sensitive identifiers, including PAN numbers, Aadhaar references, bank account numbers, and payment UTRs, are programmatically masked in serialized application outputs and administrative overviews.
• Gated File Storage: Uploaded identity documents and payment receipts are housed on private storage disks. Access requires authenticated and role-verified administrative sessions.
• Internal Role-Based Access: Only designated customer support and financial compliance staff have permission to review identity dossiers and payment proofs. All administrative access is captured in system audit trails.

5. Data Sharing & Third-Party Service Providers

WinToday does not sell, lease, or rent personal investor information to advertising agencies or third-party marketing brokers. Data sharing is limited to essential technical service providers:

• Authorized eKYC Providers (Message Central): To verify Aadhaar identities securely, investors are directed through consent-based DigiLocker verification gateways operated by Message Central. Data shared is limited to that required to initiate and verify the cryptographic eKYC token.
• Banking & Escrow Partners: Bank account numbers, IFSC codes, and transaction amounts are shared with authorized Indian banking partners to execute verified withdrawal payouts.
• Notification Services (Google Firebase): Device tokens are transmitted to Firebase Cloud Messaging (FCM) to deliver operational push notifications to your mobile device.
• Cloud Infrastructure Providers: Server hosting and database backup services that operate under strict confidentiality and security commitments.
• Legal & Law Enforcement Disclosures: We may disclose personal data to Indian law enforcement, judicial courts, or regulatory authorities where required pursuant to a valid legal order, court summons, or statutory requirement under Indian law.

6. Data Retention & Archival Policies

WinToday retains personal and financial records for periods dictated by operational necessity and statutory requirements:

• Active Accounts: Personal profile, KYC, and banking data remain retained as long as your account remains active.
• Financial Records: Transaction ledgers, payment UTR proofs, withdrawal records, and return credits are retained for a minimum of eight (8) years to comply with Indian commercial, taxation, and financial recordkeeping requirements.
• Telemetry & Session Tokens: Device tokens and expired session identifiers are purged or rotated periodically.

7. Investor Rights & Account Deletion Requests

Subject to applicable legal obligations and financial recordkeeping laws, investors possess the following rights regarding their personal data:

• Right to Access & Rectification: You may inspect your profile information within the application and submit correction requests for inaccurate or outdated details.
• Right to Account Closure: You may request account termination once all active investment contracts are settled and balances disbursed.
• Deletion Requests: You may request the deletion of non-mandatory profile information by writing to support@wintoday.app. Please note: Financial transaction records, KYC identity documentation associated with verified transactions, and audit logs cannot be erased prior to the expiration of mandatory statutory retention periods under Indian tax and commercial laws.

8. Device Tokens & Push Notifications

Our mobile application requests permission to register a device token with Firebase Cloud Messaging. This token is used solely to deliver operational notices:

• Payment verification and activation notices.
• Daily return accrual summaries.
• Withdrawal status updates (submission, review, settlement).
• Important security alerts (password resets, novel device logins).

You can revoke notification permissions at any time through your Android or iOS device settings, although disabling alerts may prevent timely receipt of security notices.

9. Protection of Minors

The WinToday platform is strictly intended for individuals who are at least 18 years of age. We do not knowingly solicit or collect personal information from minors. If we discover that an account has been opened by an individual under 18 years of age, the account will be immediately suspended and pending funds returned subject to verification.

10. Policy Updates & Inquiries

WinToday may amend this Privacy Policy periodically to reflect technological developments, service modifications, or updates to Indian privacy legislation (including the Digital Personal Data Protection Act, 2023). When changes occur, the revised version will be published on the Platform.

11. Grievance Officer & Official Contact

In accordance with the Information Technology Act, 2000, and the Digital Personal Data Protection framework, any complaints or concerns regarding the processing of your personal data should be directed to our designated officer:

• Grievance & Data Privacy Officer: WinToday Technologies
• Escrow Desk: Koramangala, Bengaluru, Karnataka, India
• Direct Email: support@wintoday.app
• Operating Hours: 09:00 to 18:00 IST (Monday through Friday)