Privacy Policy

1. Introduction

1.1 Optima is a group of companies which includes Optima Group Private Limited (“OGPL”), a private limited company incorporated under the Companies Act, 2013 (CIN: U64990MH2025PTC448687); Optima Wealth Private Limited (“OWPL”), a private limited company incorporated under the Companies Act, 2013 (CIN: U66309MH2026PTC465234); and includes all present and future affiliates of OGPL, and OWPL (together “Optima”, “we”, “our” or “us”). This Privacy Policy (“Policy”) applies to all companies within the Optima Group from time to time.

1.2 This Policy outlines our practices in relation to the collection, storage, use, processing, and disclosure of personal data of prospects or clients (“you”, “your”, “user”) that access or use our website and platform (“Platform”), or whose information is otherwise collected by us.

1.3 At Optima, we are committed to protecting your personal data and respecting your privacy. Read this Policy carefully to understand our practices regarding your personal data and how we will treat it. This Policy sets out the basis on which any personal data that we collect from you, that we collect about you, or that you provide us, will be processed by us.

1.4 If you require any information or clarification regarding the use of your personal data or this Policy or the Platform, please write an email to us in the manner specified in Section 13 of this Policy.

2. Data we collect about you

2.1 We collect, use, store, transfer, or otherwise process personal data about you to provide you with, or in connection with, access and use of the Platform, to the extent permissible under applicable laws. Such personal data includes:

Contact Data: Your name, email address, and phone number, where you provide these to us to create or manage your account on the Platform or to enquire about the Platform.
Identity Verification Data: Know Your Customer (“KYC”) documents including, Permanent Account Number (“PAN”), Aadhaar (in a masked format), address proof, photograph, information regarding your Politically Exposed Person (PEP) status, and your residential and nationality details, to fulfil our anti-money laundering (AML) and Foreign Account Tax Compliance Act (FATCA) compliance obligations. This also includes data collected through the Aadhaar Digilocker KYC & eSign process, may include the last four digits of your Aadhaar, geolocation, name, gender, live image capture, year of birth, IP, and device details. In the Optima mobile apps, location is accessed only while you use the app and only when you complete video identity verification or e-signing. It is attached to the KYC/signing compliance record and shared with the regulated verification or e-sign provider; it is not accessed in the background or used for advertising. This process is conducted in accordance with the Information Technology Act, 2000, and is facilitated by our third-party service provider, acting as an Aadhaar Authentication User Agency (AUA) or Sub-AUA. Collection and processing of this data occurs only with your explicit consent.
Conversation and Interaction Data: The record of your conversation with our artificial intelligence (“AI”) agent, including messages you send, the AI agent’s responses, and any information from a group company’s systems that the AI agent displays to you during a conversation at your request. Where you speak with a member of our client partner team about your portfolio, the call is recorded, transcribed, and summarised into a structured record of decisions, instructions and follow-ups.
Financial Data: Your holdings, transactions, allocation mandates, mutual funds, offshore portfolio holdings, advisory instructions, execution records, fee calculations, tax filings and capital gain statements, credit applications, and repayment and credit history fetched through entities duly licensed and regulated by the Reserve Bank of India (RBI) under the Account Aggregator (AA) framework. Such data is transmitted to us securely and in encrypted form by the Account Aggregator, in accordance with applicable laws and regulations. You retain complete control over which bank accounts and investment portfolios you choose to connect and share data from. OWPL acts as the Financial Information User under the AA framework. The scope, frequency and duration of each data pull are fixed by the consent artefact you approve in the Account Aggregator’s own application, and you may revoke that consent at any time through the same application. Revocation stops further pulls; it does not by itself delete data already received.
Session Data: Working memory, inferences, and derived attributes generated while you are actively using the Platform, including your current context and in-progress requests.
Profile and Preference Data: Information the AI agent remembers about you across sessions in order to personalise your experience, such as your stated goals, preferences, and significant life events that you share with the AI agent. This may, incidentally, include limited information about members of your family where you choose to share such information with us (see Section 2.4 below).
Inferences and Classifications: Attributes that we derive about you based on your interactions with the Platform, such as behavioural patterns or profile classifications, and any feedback you submit which we use to personalise and improve your experience.
Technical Data: Your internet protocol address, device identifiers, browser type and version, operating system, and similar technical information that is collected automatically when you use the Platform.
Marketing and Communications Data: Your preferences regarding the channel through which you wish to receive marketing or promotional communications from us.
Consent Records: Records of the consents you grant or withhold through the Platform.

2.2 We are required to collect certain categories of your personal data described above to provide you with access to the Platform. In certain cases, we may collect personal data to comply with our obligations under applicable laws. If you fail to provide us with such personal data as and when requested, we may not be able to perform our obligations to you, including providing you with the features of the Platform.

2.3 We may also collect, use, and share aggregated data which may be derived from your personal data, but is not considered personal data under applicable laws once it no longer directly or indirectly identifies you.

2.4 Where, in the course of using the Platform, you share information relating to another individual (for example, a family member) with us, you confirm that you have obtained adequate consent from such individual to allow us to process their personal data in the manner specified under this Policy. If you share personal data of a minor (i.e., an individual below the age of 18 (Eighteen)), you confirm that you are the minor’s parent or legal guardian, or that you have obtained adequate consent from the minor’s parent or legal guardian to allow us to process their personal data in the manner specified under this Policy.

2.5 If you interact with us before becoming a client, the personal data collected at that stage is held separately from client records until you become a client. When you go on to become a client, we will ask for your consent to link your prospect-stage data to your client record so that the agent retains the context of those earlier conversations.

3. How we collect data about you

3.1 We use different methods, as permitted under applicable laws, to collect and process personal data about you. This includes:

Information you provide us: This is the information you choose to provide when you use the Platform or when you correspond with us (for example, by email or chat, or through the Platform). It includes information you provide when you register to use the Platform, use a feature of the Platform, share data through the Platform, or report a problem with the Platform. If you contact us, we will keep a record of the information shared during the correspondence.
Information we collect about you and your device: Each time you access the Platform, we will automatically collect personal data including device and usage information. We collect this information using cookies and other similar technologies.
Information we receive from other sources, including third parties and publicly available sources: We may receive personal data about you from various third parties such as analytics providers, advertising networks, search information providers, and other publicly available sources. We use cookies, which are small data files stored on your browser by Optima to collect certain information. These may include session cookies, which are deleted when the browser is closed, and persistent cookies, which remain until removed. The use of cookies enables us to offer you a more customized experience on the Platform. We may also collect information about you from marketing and referral partners, social media platforms where you engage with our content, and other distribution related entities. Such information is provided to us under agreements that govern its use and protection.
Information we receive from Optima’s group companies: We may receive personal data about you from Optima’s group companies when you utilize services or products offered by said entity through the Platform. Such information may be transferred to us to facilitate service delivery and fulfill our inter-group contractual obligations.

4. How we use your personal data

4.1 We will only use your personal data in accordance with applicable laws and for purposes such as:

to process the onboarding and maintain relationship with you;
to personalise your experience on the Platform, including by remembering your preferences and goals across sessions;
to train and evaluate the AI models that power the Platform, including future versions of our AI agent;
to enable you to access a specific licensed capability offered by a group company, where you choose to activate that capability;
to combine information across the group companies whose capabilities you have activated, so that the agent can give you a single, joined-up view of your financial position;
to generate inferences, classifications and counterfactual scenarios about your circumstances in order to advise you;
to review the quality, accuracy and regulatory compliance of the AI agent’s responses, including review by authorised personnel of conversations and the associated technical records;
to record and summarise calls between you and our client partner team, and to make those summaries available to the AI agent at your request;
to provide and improve the Platform, including troubleshooting, system testing, monitoring performance, and conducting internal data analysis;
to respond to any enquiries you may have about the Platform;
to detect, prevent, and respond to fraud, abuse, and cybersecurity incidents;
to send you administrative communications relating to your use of the Platform and, where you have consented, marketing and promotional communications;
to respond to your queries, feedback, and grievances;
to respond to court orders, establish or exercise our legal rights, or defend ourselves against legal claims;
to comply with applicable legal and regulatory obligations under Indian law, including SEBI regulations, Know Your Client (KYC) norms, Anti-Money Laundering (AML) compliances, and tax laws, and includes risk profiling, monitoring and recording transactions and communications, making necessary disclosures to tax authorities, financial regulators, judicial or government bodies, and assisting in the investigation or prevention of fraud and other unlawful activities;
to facilitate audits conducted by our internal/external auditors or by any third party auditors appointed in accordance with regulatory requirements;
to enforce our terms and conditions;
to detect and prevent illegal activity, and to comply with applicable laws;
to communicate with you by sending emails, text messages, or other notifications about our products and Services;
to employ cloud-based software solutions to fulfill various essential business functions, including, for instance, the management of databases and servers, the processing of digital communications (text messages, phone calls, chats, and emails), and conducting marketing and sales analytics.

5. How we share your personal data

5.1 We may share your personal data for the purposes set out under this Policy to the following third parties:

Our group companies and affiliates;
Service providers such as:

AI and language model service providers, to generate the AI agent’s responses to you;
request routing and caching service providers, which sit between us and our AI service providers;
cloud hosting and data storage infrastructure service providers, to host our backend systems and store Platform data;
front-end hosting infrastructure service providers, to serve the Platform’s user interface;
trusted strategic partners and third-party service providers who assist in payment processing, marketing and advertising, performance monitoring, technology and platform development, technology service provider and account aggregators;
identity verification, Aadhaar authentication and electronic signature providers.

Personal data moves between group companies only for the purposes described in this Policy and only under written intra-group agreements that set out each company’s role, the permitted flows of data, security obligations, and audit and termination rights.
In order to facilitate the service, Optima will share your information (including Personal Information) with various third parties, including but not limited to, banks, payment gateways, SEBI-registered entities, Stock Exchanges, CERSAI, and KRAs, custodians, fund accountants, registrars and transfer agents, depositories, stock brokers, our statutory, internal and regulatory auditors. This is done solely for the purpose of reviewing your profile and processing your transaction requests for Optima’s Services.
In the event Optima merges with or is acquired by another company or in cases of reorganisation or restructuring of the business, we and our group companies and affiliates may share your personal data, wholly or in part, with other business entities.

5.2 Further, we may also share data where we are required by law, any court, government agency, or authority to disclose such personal data. Such disclosures are made in good faith and belief that it is reasonably necessary to do so for enforcing this Policy, or in order to comply with any applicable laws and regulations.

6. Data security

We implement adequate security measures to protect your personal data from unauthorised access, and such security measures are in compliance with the security practices and procedures prescribed under applicable laws. Optima adheres to industry best practices and established principles for transferring and storing your data. Our controls include encryption of personal data in transit and at rest, role-based access controls with logging of access, mutual authentication between the Platform and the systems of our licensed group companies, audit logging of every request made to a group company’s systems on your behalf, and separation of production and development environments so that identified client data is not used in development. Personal data held in our primary databases and file storage is stored in India. Our SEBI-regulated group companies additionally maintain controls under SEBI’s Cybersecurity and Cyber Resilience Framework.

7. Data retention and destruction

7.1 We will store your personal data for as long as necessary to fulfil our stated purpose(s) in compliance with applicable laws or to meet statutory limitation periods.

7.2 To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

7.3 Upon expiry of the applicable retention period for each category of personal data described above or upon your valid withdrawal of consent, where applicable — we will, to the extent technically feasible, delete or destroy the personal data in our possession or control, unless we are required or permitted by law to retain it.

7.4 Alternatively, we may anonymise such data. Anonymisation is effected by destroying the rejoin keys that link records to you, scrubbing personal identifiers from the content, and removing the inference linkages that could associate the data with you, such that re-identification is not reasonably possible and the data no longer constitutes personal data. Data anonymised in this manner falls outside the scope of applicable data protection law and forms part of our long-term corpus, which we may retain and use indefinitely, including for observability, analytics, and product improvement, without further notice or obligation to client.

8. Your Legal Rights

8.1 Subject to applicable law, you may in certain circumstances have the following rights in respect of your personal data:

the right to access information about how we process your personal data;
the right to correct, update, or erase your personal data;
the right to withdraw consent; and
the right to nominate another individual to exercise your rights under applicable laws in the event of your death or incapacity.

8.2 If you wish to exercise any of the rights set out above or have any questions or complaints, please write an email to us in the manner specified in Section 13 of this Policy.

8.3 We will make all reasonable efforts to address any concerns you may have regarding our handling of your personal data. If you remain dissatisfied with our response, you may approach the Data Protection Board of India.

9. Transfer of Personal Data

We comply with applicable laws in respect of storage and transfer of personal data. We may, to the extent permitted under law, transfer your personal data to service providers or third-party recipients in locations around the world, for the purposes described in this Policy. Wherever your personal data is transferred, stored, or processed by us, we will take reasonable steps to safeguard the privacy of your personal data. We select providers that operate on zero-data-retention terms, meaning your content is not stored after the response is generated.

10. Links to third-party websites and services

The Platform may contain links to, or services provided by, third parties, including our partners and service providers. Third-party services are governed by their own privacy policies, and we do not accept responsibility or liability for their policies or for any personal data collected through them. Please review their policies before submitting any personal data to, or using, such third-party services.

11. Cookies

11.1 Cookies are small data files that are stored on your device. We use cookies and other tracking technologies to distinguish you from other users of the Platform and to remember your preferences. This helps us provide you with a good experience when you use the Platform and also allows us to improve the Platform.

11.2 We identify you by way of using cookies. The cookies shall not provide access to data in your device such as email addresses or any other data that can be traced to you personally. The data collected by way of cookies will allow us to provide you with a tailored and user-friendly experience. The cookies shall enable you to access certain features of the Platform. Most devices can be set to notify you when you receive a cookie or prevent cookies from being sent. If you prevent cookies from being sent, it may limit the functionality that we can provide when you use the Platform.

11.3 Additionally, you may encounter cookies or other similar technologies on certain interfaces of the Platform that are placed by third parties. We do not control the use of cookies by such third parties.

12. Changes to this Policy

12.1 We keep our Policy under regular review and may amend it from time to time, at our sole discretion.

12.2 The terms of this Policy may change and if they do, these changes will be posted on this page and, where required by applicable laws, notified to you.

13. Client Support and Grievance Officer

You may contact us with any enquiry relating to this Policy or your personal data, or write to:

Name	Hraday Jaiswal
Email	compliance@optima.ai
Address	Tulsi Villa, Poddar Road, Santacruz West, Mumbai - 400054