Privacy Notice

1. Who operates Mera Fund

This online service is offered under the name Mera Fund ("Mera Fund", "we", "us", or "our"). Questions, grievances, and requests concerning personal data may be sent to merafund.mitra@gmail.com.

Mera Fund provides an educational financial-wellness assessment. It does not provide investment, tax, legal, insurance, or other regulated professional advice, and it does not execute financial transactions on your behalf.

2. Information we collect

Depending on what you choose to enter, an assessment may include:

• Contact and consent information: email address, consent time, assessment identifier, status, creation time, update time, and expiry time.
• Profile information: age band, city, marital status, family structure, dependants, and dependant age bands or costs.
• Income and spending information: income and salary amounts or ranges, rental income, regular expenses, discretionary expenses, rent or housing payments, and savings estimates.
• Assets, investments, and liabilities: savings, deposits, investments, SIP contributions, real estate, outstanding home or personal loans, interest and EMI information, net-worth inputs, financial goals, and related values.
• Insurance and tax information: insurance types, cover and premium amounts, tax-regime selection, liquidity needs, and risk-profile selections.
• Retirement information: current and target retirement ages, life expectancy assumption, current corpus, monthly investment, retirement expenses, passive income, return and inflation assumptions, and one-time goals.
• Optional statement-derived information: if an account statement or similar source is offered as an input, we may process the financial information needed to populate the assessment and record that an upload was used.
• Feedback: optional satisfaction scores and their submission times.
• Technical and security information: session and request data needed to operate the site, rate-limit attempts, prevent abuse, diagnose failures, and protect the service. Cloudflare and hosting providers may process IP address, browser, device, network, and request metadata for these purposes.

We also create calculated results from your inputs, such as liquidity indicators, savings estimates, net worth, readiness measures, financial-health scores, and suggested next actions. These calculated results form part of the assessment data.

Please do not enter passwords, one-time passwords, bank login credentials, full card numbers, government identification numbers, or information unrelated to the assessment.

3. Why we process information

We process the information described above to:

• start and maintain the assessment you requested;
• calculate, display, and generate your financial-wellness results;
• save progress during the assessment session;
• measure whether assessment sections are complete and useful;
• receive optional product feedback;
• apply rate limits, detect misuse, and protect the service;
• monitor availability, investigate failures, and improve reliability;
• respond to privacy requests and meet applicable legal obligations; and
• create non-identifying operational statistics where reasonably possible.

We rely on the consent you provide before starting an assessment for the collection and use of your email and assessment data. You may decline by not starting the assessment, or withdraw consent as described below.

4. No verified account or guaranteed recovery

Mera Fund does not verify that you control the email address you enter. Entering an email address does not create a conventional user account. Each assessment receives a separate random identifier, and closing the browser or losing the session may prevent you from recovering that assessment through the application.

For privacy requests, we may separately ask you to demonstrate control of the relevant email address before we locate, disclose, correct, or delete matching records.

5. Where information is processed and stored

The production application and PostgreSQL database are hosted using Amazon Web Services in the Asia Pacific (Mumbai) Region, India. Encrypted connections are used between the application and database, and database storage is encrypted.

We use the following service providers as part of operating Mera Fund:

• Amazon Web Services (AWS): application computing, networking, PostgreSQL database hosting, infrastructure monitoring, and database backups.
• Cloudflare: authoritative DNS, content delivery, TLS termination, traffic filtering, bot mitigation, rate limiting, and protection against abusive or malicious requests. Cloudflare operates a global network, so technical request data may be processed outside India as traffic is routed and protected.
• Sentry: production error reporting and reliability monitoring. Mera Fund is configured to avoid sending user identity, form contents, request bodies, cookies, headers, and arbitrary financial context with error events.
• GitHub: private source-code hosting and deployment access. User assessment records are not intentionally stored in the source-code repository.

These providers may process limited information under their own infrastructure and security arrangements. We do not sell personal data or share assessment data with advertisers or data brokers.

6. Retention and deletion

An assessment record is assigned an expiry time and is intended to be retained for no longer than 90 days after consent, unless earlier deletion is requested and verified or longer retention is required by law. An automated maintenance process removes expired assessment records from the active database.

Encrypted Amazon RDS automated backups are maintained separately from the active database and are intended to use a 7-day backup retention period. Information deleted from the active database may remain in an existing backup until that backup expires or is overwritten. Backups are used for disaster recovery and are not used to restore an individual assessment to the live application on request.

Security, audit, and service logs may be kept for a separate limited period where needed to investigate incidents, demonstrate system integrity, or meet legal obligations. Application audit records are designed to use one-way identifiers rather than email addresses or financial inputs.

7. Your choices and privacy requests

You may contact us to request, as applicable:

• information about whether we hold assessments associated with your email;
• access to or a summary of relevant personal data;
• correction of inaccurate or incomplete information;
• erasure of matching assessment records;
• withdrawal of consent for continued processing; or
• review of a privacy concern or grievance.

Send requests to merafund.mitra@gmail.com with the subject "Privacy request". Do not include financial details in the initial email. We may ask you to verify control of the email address used for the assessment and may assign a non-identifying request number. We will explain the outcome and any effect of backup retention.

Withdrawing consent does not affect processing already completed before withdrawal. Withdrawal may require us to end the assessment and delete associated active records, subject to applicable legal exceptions.

8. Security and incident handling

Mera Fund uses measures intended to protect personal data, including encrypted network connections, encrypted database storage and backups, private database networking, least-privileged database roles, restricted administrative access, secret management, rate limiting, edge traffic protection, audit logging, dependency and application checks, monitoring, and backup/restore procedures.

No online service can guarantee absolute security. If we confirm a personal-data incident, we will investigate, contain and remediate it, preserve appropriate records, and provide notifications to affected individuals and authorities where required by applicable law. Security or privacy concerns may be reported to merafund.mitra@gmail.com.

9. Cookies and similar technologies

Mera Fund and Cloudflare may use strictly necessary session, security, load-management, and challenge cookies so the application and its WebSocket connection function and so abusive traffic can be detected. Mera Fund does not intentionally use advertising cookies or cross-site behavioural advertising trackers.

10. Children

Mera Fund is intended only for people aged 18 years or older. We do not knowingly offer assessments directly to children or seek their personal data. Do not submit a child's email address or financial information. Information about dependants should be limited to the broad age band and expense information requested by the assessment.

If you believe a child has provided personal data, contact us so we can investigate and take appropriate action.

11. Changes to this notice

We may revise this notice when the service, providers, security practices, or legal requirements change. The updated version will be published at this address with a new effective date. Material changes affecting an active assessment may also be presented through the application where appropriate.