Privacy Policy

1. Introduction

Reflextion Ventures Pte Ltd (“Reflextion,” “we,” “us,” or “our”), incorporated in Singapore (UEN: 202551959G) with registered office at 3 Coleman Street #03-40, Singapore 179804, is committed to protecting the personal data of users of the Nandhanush mobile application (“App”) in accordance with the Personal Data Protection Act 2012 of Singapore (as amended, “PDPA”) and all other applicable data protection laws.

This Privacy Policy explains how we collect, use, disclose, retain, and protect your personal data when you use the Nandhanush App. It applies to all users regardless of their country of residence. Where applicable laws in your jurisdiction provide additional rights or protections, those laws apply to you in addition to this Policy.

By using the App or providing your personal data to us, you acknowledge that you have read and understood this Privacy Policy and consent to our collection, use, and disclosure of your personal data as described herein. If you do not agree, please discontinue use of the App.

We may update this Policy from time to time. Material changes will be communicated to you via email or in-app notification before they take effect. Continued use of the App after any update constitutes your acceptance of the revised Policy.

2. Our Obligations Under the PDPA

As an organisation subject to the PDPA, Reflextion adheres to the following key obligations:

• Consent: We obtain your consent before collecting, using, or disclosing your personal data, unless an applicable exception applies.
• Purpose Limitation: We collect, use, or disclose your personal data only for purposes notified to you, or purposes a reasonable person would consider appropriate in the circumstances.
• Notification: We make this Privacy Policy available to you and notify you of data collection purposes at or before the time of collection.
• Access and Correction: Upon written request, we will provide access to your personal data and correct any error or omission.
• Accuracy: We make reasonable efforts to ensure personal data we hold is accurate and complete.
• Protection: We implement reasonable technical and organisational security arrangements to protect your personal data against unauthorised access, use, disclosure, modification, or loss.
• Retention Limitation: We cease to retain personal data once the purpose for collection is no longer served and retention is no longer necessary for legal or business purposes.
• Transfer Limitation: We do not transfer personal data outside Singapore unless the recipient provides a comparable standard of protection.
• Data Breach Notification: We assess and, where required under the PDPA, notify the Personal Data Protection Commission (PDPC) and affected individuals of notifiable data breaches within prescribed timelines.
• Accountability: We implement policies and procedures to meet our PDPA obligations and make information about those policies publicly available.

3. Personal Data We Collect

We collect only the personal data necessary to provide the features of the Nandhanush App. This includes:

Account and Identity Data

• Email address and display name provided during registration.
• Authentication tokens from third-party sign-in providers (Google, Apple) where you choose to use those methods. We do not receive your Google or Apple password.

Financial Planning Data

• Asset details you enter manually: asset names, categories, values, purchase prices, lot sizes, and broker or exchange information.
• Portfolio allocation preferences and investment template selections.
• Cashflow data you enter: income, expenses, and savings figures.
• Net worth data you enter: asset and liability values.
• Retirement income planning data: plan names, target amounts, currencies, and simulation parameters.
• Any other financial data you voluntarily enter into the App for planning purposes.

Usage and Technical Data

• Device type, operating system, and app version (collected via Firebase Analytics for diagnostic and improvement purposes).
• App usage patterns and feature interaction data (aggregated and anonymised where possible).
• Crash and error logs to support technical debugging.

Subscription Data

• Subscription tier (free or premium) and subscription status, managed through RevenueCat. We do not receive or store your payment card details. All payment processing is handled by Apple App Store or Google Play Store.

3.1 Data We Do Not Collect

We do not collect biometric data, government identity document numbers (NRIC, passport), facial recognition data, audio or video recordings, credit bureau data, or any data from your bank or brokerage accounts. All financial data in the App is entered manually by you.

4. How We Collect Your Personal Data

We collect personal data through the following channels:

• Direct input: Information you type or select within the App, including account registration details and all financial planning data.
• Third-party authentication: When you sign in via Google or Apple, those providers share limited profile information (name, email) with us as described in their own privacy policies.
• App interactions: Usage and technical data collected automatically by Firebase Analytics and Firebase Crashlytics as you use the App.
• Subscription management: Subscription status and transaction identifiers shared by RevenueCat upon in-app purchase.
• Communications: Information you provide when contacting us via email or support channels.

5. Purposes of Collection, Use and Disclosure

We collect and use your personal data for the following purposes:

• Creating, operating, and managing your Nandhanush account.
• Providing the App's core features: portfolio tracking, asset management, retirement income planning, cashflow analysis, and net worth modelling.
• Generating AI-assisted portfolio health insights and financial picture summaries (where you use these features), using data you have entered into the App.
• Personalising your experience, including saving your preferences, language settings, and portfolio configurations across sessions.
• Managing your subscription and processing in-app purchases through Apple App Store and Google Play Store.
• Sending you important service communications, including account notifications, Terms updates, and policy changes.
• Detecting, investigating, and preventing fraud and unauthorised access to your account.
• Diagnosing technical issues, improving app performance, and developing new features.
• Complying with applicable laws, regulations, and any requests or requirements of regulatory or law enforcement authorities.
• Any other purpose reasonably incidental to the above, or for which you have given your express consent.

We will not use your personal data for purposes beyond those described above without obtaining your consent or as otherwise permitted by law.

6. Disclosure of Personal Data

We do not sell your personal data. We may disclose your personal data to the following categories of third parties, to the extent necessary to provide you with the App's features or to meet our legal obligations:

Technology and Infrastructure Providers

• Google Firebase (Google LLC): We use Firebase Authentication, Firestore (cloud database), and Firebase Cloud Functions to operate the App. Your account data and financial planning data are stored on Firebase infrastructure. Google's servers may be located in the United States and other regions. Google acts as a data processor under our instructions and is bound by appropriate data processing agreements.
• RevenueCat, Inc.: We use RevenueCat to manage in-app subscriptions. RevenueCat receives your app user ID and purchase status. RevenueCat does not receive your financial planning data.

AI Processing

• Anthropic PBC (Claude AI): When you use AI-powered features, your financial planning data (assets, cashflow, net worth, and portfolio allocations as entered by you) is transmitted to Anthropic's Claude AI model via a secure Firebase Cloud Function for analysis. This data is used solely to generate the AI insights displayed to you. Anthropic is bound by data processing terms. Anthropic's servers are located in the United States. We cache AI-generated outputs in Firebase Firestore to reduce the frequency of data transmissions.

Referral Partners

• When you tap a referral link for a third-party platform (such as FSMOne, Syfe, or Interactive Brokers), you are redirected to that platform. We may receive confirmation that a referral was completed. We do not share your financial planning data with referral partners.

Professional and Legal Advisers

• Lawyers, auditors, accountants, and other professional advisers, where necessary.

Regulatory and Law Enforcement Authorities

• Government bodies, courts, regulators, and law enforcement agencies, as required or permitted by applicable law.

Third-Party Vendors as Independent Controllers

Certain service providers (such as Google and Anthropic) may also process your personal data for their own purposes as independent data controllers — for example, to improve their services or meet their own regulatory obligations. Their processing is governed by their own privacy policies. We encourage you to review those policies:

• Google Privacy Policy: policies.google.com/privacy
• Anthropic Privacy Policy: anthropic.com/privacy
• RevenueCat Privacy Policy: revenuecat.com/privacy

7. AI-Powered Features and Data Processing

Nandhanush includes optional AI-assisted features that analyse financial data you have entered into the App to generate personalised portfolio health insights and financial planning summaries.

When you use these features:

• The financial data you have entered (assets, allocations, cashflow, net worth) is transmitted securely to Anthropic's Claude AI model via an encrypted Firebase Cloud Function.
• AI-generated outputs are cached in your account's Firestore database to reduce repeat transmissions and to preserve your analysis history.
• Your data is used solely to generate the analysis displayed to you. It is not used to train AI models.
• These features are rate-limited and may behave differently depending on your subscription tier.

AI-generated outputs are informational only and do not constitute financial advice. You retain full control over the data you enter and may delete your account and all associated data at any time from within the App's settings.

8. International Transfer of Personal Data

Because we use cloud infrastructure providers (Google Firebase, Anthropic, RevenueCat) whose servers are located outside Singapore, your personal data may be transferred to, stored in, or processed in countries including the United States and other jurisdictions.

Where we transfer personal data outside Singapore, we take steps to ensure that the receiving party provides a comparable standard of protection to the PDPA, whether through contractual safeguards (such as standard data processing agreements) or other legally recognised mechanisms.

9. Retention of Personal Data

We retain your personal data for as long as your account remains active and for a reasonable period thereafter to fulfil legal, compliance, and business purposes, including resolving disputes and preventing fraud.

• Account data: Retained for the duration of your account. Upon account deletion, your data is removed from our active systems within 30 days, subject to any legal retention requirements.
• Financial planning data: Retained only for the duration of your account, as this data is entered by you and has no independent value to us after account closure.
• Technical and usage logs: Retained for up to 12 months for diagnostic purposes.
• Subscription records: Retained for up to 7 years as required for accounting and tax compliance purposes.

Third-party service providers (Google, Anthropic, RevenueCat) may retain data in accordance with their own retention policies, independently of our instructions.

10. Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, use, disclosure, modification, or loss. These measures include:

• Encryption of data in transit (TLS) between the App and our backend services.
• Firebase Security Rules controlling access to your data in Firestore.
• Firebase Authentication managing session security.
• Access controls limiting which personnel and systems can access personal data.
• Regular review of our security practices.

You can assist in protecting your account by keeping your login credentials confidential, enabling two-factor authentication where offered, and logging out of shared devices. Contact us immediately at support@reflextion.ai if you suspect unauthorised access to your account.

11. Your Rights

Subject to the PDPA and applicable law, you have the following rights regarding your personal data:

• Right of Access: You may request access to personal data we hold about you and information about how it has been used or disclosed in the past 12 months.
• Right of Correction: You may request correction of any inaccuracy or incompleteness in your personal data. Much of your financial planning data can be edited directly within the App.
• Right to Withdraw Consent: You may withdraw your consent to our processing of your personal data at any time. Withdrawal may affect our ability to continue providing certain features, and we will notify you of the likely consequences before withdrawal takes effect.
• Right to Account Deletion: You may delete your account at any time from within the App's settings. Upon deletion, your data will be removed from our active systems as described in Section 9.
• Right to Lodge a Complaint: If you are dissatisfied with how we have handled your personal data, you may lodge a complaint with the PDPC at www.pdpc.gov.sg.

For EU/UK users: you additionally have the right to erasure, data portability, restriction of processing, objection to processing, and the right not to be subject to a decision based solely on automated processing.

For California users: you additionally have the right to know what personal information is collected, the right to delete it, the right to opt out of the sale of personal information (we do not sell your data), and the right to non-discrimination for exercising these rights.

To exercise any of these rights, contact our Data Protection Officer at the details in Section 16.

12. Data Breach Notification

We maintain procedures to detect, assess, and respond to personal data breaches. Where a breach is assessed as notifiable under the PDPA, we will notify the PDPC and, where applicable, affected individuals, within the timelines prescribed by law.

13. Cookies and Tracking Technologies

The Nandhanush mobile application does not use browser cookies. However, we use the following mobile analytics and tracking tools:

• Firebase Analytics: Collects anonymised usage data (screen views, feature interactions, session duration) to help us improve the App.
• Firebase Crashlytics: Collects crash reports and diagnostic data to support bug fixing.
• Session tokens: Stored locally on your device by Firebase Authentication to maintain your login session securely.

You may opt out of Firebase Analytics data collection through your device's system privacy settings (iOS: Settings → Privacy & Security → Tracking; Android: Google account settings → Data & Privacy). See our Cookie Policy for more detail.

14. Links to Third-Party Services

The App may contain referral links or references to third-party platforms (such as brokers or financial service providers). We are not responsible for the privacy practices or data handling of these external services. We encourage you to review the privacy policies of any third-party service you access through the App.

15. Changes to This Privacy Policy

We may update this Policy from time to time to reflect changes in our practices, applicable laws, or regulatory requirements. The updated Policy will be made available within the App and on our website. Your continued use of the App following any update constitutes your acceptance of the revised Policy.

16. Contacting Us — Data Protection Officer

For any questions, concerns, or requests relating to this Privacy Policy or the handling of your personal data, please contact our Data Protection Officer:

Data Protection Officer
Reflextion Ventures Pte Ltd
3 Coleman Street #03-40, Singapore 179804
Email: privacy@reflextion.ai

We will respond within prescribed regulatory timelines or otherwise within a reasonable period.