Privacy Policy

1. Introduction

Wealducate ("we", "us", or "our") is committed to protecting your privacy. This Privacy Policy explains what we collect, where your data is stored, who can read it, and what rights you have.

Wealducate is a sole proprietorship operating from India. Being a sole proprietorship, the business and its proprietor are the same legal person, and this policy is given by that person. For any question about who operates the Services, or to exercise a right described below, write to hello@wealducate.com.

Our products handle data in genuinely different ways, so a single blanket statement would be misleading. Sections 3 to 6 describe each one separately. Read the section for the product you actually use.

2. Which product this applies to

• This website (wealducate.com) — the calculators, lessons, and newsletter. See section 3.
• Vestora — the cloud app — the version you sign into in a browser. Your data is stored on our servers. See section 4.
• Vestora — the desktop app — a Windows application, currently invite-only. Your financial data stays on your own machine unless you choose to move it to the web app. See section 5.
• WealQuest — our learning app. It is the only one of our products intended for younger learners, and it has its own full privacy policy. See section 6.

3. This website (wealducate.com)

The calculators send nothing to us. This website has no backend and no database. Every calculator runs entirely in your browser, and the figures you type into one — your salary, your savings, your age — are never transmitted to us, stored by us, or seen by us. Close the tab and they are gone.

What we do receive:

• Your email address, and your name if you give it, only if you submit a form — the newsletter, the Vestora waitlist, or a request for a desktop invitation. The name is optional. We also note which of those forms you used. What you submit is received and stored for us by Formspree, a form-handling service in the United States (see section 10). Nothing else on the site asks for your name or email.
• A few anonymous events, sent to PostHog in the European Union: when you submit one of those forms (that a sign-up happened, and which form it was); when you click from this website through to the Vestora app or its sample portfolio (which of the two, and from which page); and when you click our email address on the pilot page. Each carries a random identifier that lives only in that browser tab and is deleted when you close it. None includes your name, your email, or anything you typed. These are the only events the website sends; if we add others, this section will say so.
• Anonymous, cookieless usage analytics via Vercel Analytics — which pages were viewed, and from roughly where. It does not use cookies, does not build a profile of you, and does not follow you to other sites.

Cookies: this website sets none. It stores two preferences in your browser's local storage — your chosen language and whether you prefer light or dark mode. These stay on your device and are never sent to us. Clearing your browser data removes them.

4. Vestora — the cloud app

Your data is stored on our servers, and we can read it. We say so plainly rather than implying otherwise.

• Where it lives: on Supabase, in its Mumbai, India data centre. It is encrypted in transit and at rest, and isolated to your own account by database-level row security.
• Who can read it: Vestora can, in order to compute your numbers and keep them current. That is the trade you are making for a service that works across devices and updates itself. We never sell, share, or mine your data, and our staff access it only when you ask for support and authorise it in writing.
• Saved statement passwords: if you save one so that future statements open by themselves, it is stored on our servers under the same account access rules as the rest of your data — not sealed with a key only you hold. Vestora can read it, and uses it only to open your own statements. You can delete a saved password at any time. On the desktop app the arrangement is different, and section 5 says how.
• AI never sees your statements. Statements are read by deterministic parsers — ordinary code that follows fixed rules — not by a language model.
• This is not zero-knowledge encryption. We hold the keys. Any service telling you it stores your data on its servers and cannot read it is describing something different from what we do. If you want your financial data to stay off our servers entirely, that is the desktop app in section 5.
• Backups: we take a nightly verified backup. This is not point-in-time recovery — it restores to the most recent nightly copy, not to the moment before a problem.

5. Vestora — the desktop app (invite-only)

Your financial data never leaves your computer — unless you choose to move your data to the web app. Your holdings, transactions, statements and the figures derived from them are stored in a database on your own machine and are not uploaded to us unless you start that move yourself (described below). No account is required — the app creates a local identity instead of signing you in.

We say "your financial data", not "nothing", and the difference is deliberate. Three things do leave your machine — and nothing else, unless you choose to move your data to the web app. All three are also disclosed inside the app itself:

• 1. The invitation-key check — roughly once a day, the app sends your invitation key and a random device identifier so we can confirm the invitation is valid.
• 2. Anonymous usage counts — which kind of statement you imported, whether it succeeded, a rounded range for how many transactions it contained, and a random identifier. Never an amount, a name, a file name, or the contents of an error. This is on by default and you can switch it off in Profile → Security.
• 3. The price lookup — to show current values, the app asks our reference-data service for prices. Because it only asks about what you actually own, that request contains the identifiers of the instruments you hold (ISINs, scheme codes and tickers). It carries no amounts, no unit counts, no values, no folio numbers, no name and no account identifier — but the composition of your portfolio does leave your machine, and we would rather tell you than let "on-device" imply more than it delivers.

The app also checks for updates on launch and downloads signed builds.

Moving from the desktop app to the web app is your choice, and it uploads your data. If you start a move, the desktop app makes one file of your Vestora data on your computer, and you upload that file yourself in the web app, signed in to your web account; from then on that data is stored on our servers and section 4 applies to it. Nothing from your data is sent until you have seen, in the web app, the list of what will and will not come across and confirmed it — to work out that list, the web app sends only the names of the kinds of data in the file and how many entries each holds, never the entries themselves. Your statement passwords are included only if you choose, and then encrypted inside the file. The uploaded file is kept in a private area only your account can read, and is deleted as soon as the move finishes or fails, or after 24 hours at the latest. You can delete your web account and its data at any time (section 8).

Things worth knowing about holding your own data:

• You hold the only copy. Backup and restore are built in, but we have nothing on our side to recover for you if the machine is lost.
• Saved statement passwords are stored on your device. If you set an app-lock passphrase they are encrypted with it; if you do not, they are stored as plain text, and the app tells you so at the time.
• The local database is not encrypted by the app. It is protected by your Windows account and its file permissions, by BitLocker if you use it, and by the app-lock. We decided against encrypting the database itself, because a lost key would mean losing the only copy of your data; backups you export can be password-protected instead.

6. WealQuest

WealQuest is our gamified personal-finance learning app at learn.wealducate.com. It is designed for learners aged 10 and above — the only one of our products intended for anyone under 18. If you are under 18, you may use WealQuest only with the involvement and consent of a parent or legal guardian, who accepts WealQuest's privacy policy on the child's behalf.

What it collects: your account details (an email address, or a Google sign-in), your learning profile (self-declared age group, learning goal, language and mode), and your progress — answers, XP, level, streak and badges. It is stored on Supabase, the same platform as the Vestora cloud app, in its Sydney, Australia data centre.

Your display name and score appear on a leaderboard visible to other signed-in learners. Nothing about you in WealQuest is readable by the public or by search engines.

Two protections apply to the 10–18 age group, and they are built into the app rather than promised here: no usage analytics are sent to our analytics provider for those learners, and links to our adult tools such as Vestora are not shown to them. Because the age group is self-declared, this is good faith rather than proof of age — it is the strongest signal the app holds.

WealQuest's own policy goes into more detail than this summary: WealQuest Privacy Policy.

7. How We Use Your Information

• To provide, operate, and improve our services
• To send you newsletters or updates you have opted into
• To respond to your enquiries and support requests
• To understand which pages and features are used
• To comply with applicable legal obligations

We do not sell, rent, or trade your personal information to third parties, and we do not use it to target advertising.

8. Data Retention and Deletion

We retain personal data only as long as necessary to provide our services or comply with legal obligations. What that means in practice differs by product:

• This website: if you gave us an email address, you can ask us to remove it at any time. The only other things the website records are the anonymous events described in section 3, which carry no name or email address.
• Vestora cloud: your data stays until you delete it, with one exception: the original files of the statements you upload or forward are deleted 3 years after they arrive, unless you choose another period or to keep them. The numbers read from them, and the record of which statement each came from, stay. You may request deletion of your account and its data at any time, and you can export your data in a machine-readable format first.
• Vestora desktop: your data is on your machine, so deleting it is in your hands, not ours — uninstalling the app and removing its data folder removes it. We hold no copy to delete — unless you choose to move your data to the web app (section 5). Moved data is then cloud data and the Vestora cloud rule above applies to it; the file you upload for the move is deleted as soon as the move finishes or fails, or after 24 hours at the latest. The app does not keep a copy of your statement files; the text it reads from each statement is removed from your computer 3 years after the statement arrives, while the numbers read from it stay.

9. Your Rights (GDPR / Indian DPDP Act)

Depending on your location, you may have the following rights regarding your personal data:

• Access: Request a copy of the data we hold about you
• Rectification: Correct inaccurate or incomplete data
• Erasure: Request deletion of your personal data
• Portability: Receive your data in a machine-readable format
• Objection: Object to certain processing activities
• Withdrawal of consent: Unsubscribe or revoke consent at any time
• Nominate someone: You may nominate another person to exercise your rights on your behalf if you die or become unable to act. Tell us and we will record it.

To exercise any of these rights, contact us at hello@wealducate.com.

10. Third-Party Services

Our products integrate with the following third-party services:

• Supabase — authentication and database for the Vestora cloud app (in Mumbai, India) and for WealQuest (in Sydney, Australia) (Privacy Policy)
• Vercel — hosting, edge delivery and cookieless analytics for this website (Privacy Policy)
• PostHog — product analytics for our apps and a few anonymous click and sign-up events on this website (section 3), hosted in the European Union. It records which features are used and when, so we can tell what is working. It is configured to receive no personal financial data: no statement contents, no holdings, no balances, no account numbers (Privacy Policy)
• Formspree — receives and stores what you submit through this website's newsletter, waitlist and desktop invitation forms, in the United States (Privacy Policy)
• Google — sign-in, if you choose "Sign in with Google" in Vestora or WealQuest. Google tells us your name, email address and profile picture (Privacy Policy)
• Cloudflare and Resend — receive the statement emails you forward to your personal Vestora address and pass them to Vestora.
• No AI services. Vestora does not currently send any of your data to an AI service. An alert our own code cannot read confidently is shown to you to confirm.

Where your data is processed. Vestora's cloud database is in India. Some of the services above work outside India: WealQuest's database is in Australia, PostHog is in the European Union, Formspree is in the United States, and Vercel, Cloudflare, Resend and Google run networks in several countries. India's data-protection law allows personal data to be processed outside India unless the Government of India restricts transfers to a particular country.

We are not responsible for the privacy practices of these services. We encourage you to review their policies.

11. Children's Privacy

The age we work to is 18, not 13. India's Digital Personal Data Protection Act treats anyone under 18 as a child, and that is the line our products are built around.

This website and both versions of Vestora are for adults. They are not designed for or directed at children, and we do not knowingly collect a child's personal data through them.

WealQuest is deliberately different. It is a learning app designed for learners aged 10 and above, so it is meant to be used by children — and it is built for that rather than pretending otherwise. Anyone under 18 may use it only with the involvement and consent of a parent or legal guardian, who accepts WealQuest's policy on the child's behalf. We show no third-party advertising to anyone, we do not use a child's data for behavioural advertising or for profiling beyond what is needed to run and improve the learning service, we send nothing to our analytics provider for learners in the 10–18 age group, and we do not show them links to our adult tools. Section 6 summarises this and WealQuest's own privacy policy sets it out in full.

A parent or guardian may review, correct, or request deletion of a child's information at any time by contacting us at hello@wealducate.com.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by updating the "Last updated" date at the top of this page. Your continued use of our services after changes constitutes acceptance of the updated policy.

13. Contact Us

If you have questions or concerns about this Privacy Policy, please contact us at:

For a plain-language explanation of how Vestora protects your data, see How We Protect Your Data.

14. Data questions, complaints and grievances

If you have a question about your data, want to exercise a right, or wish to complain about how we have handled it, write to hello@wealducate.com. We aim to acknowledge within 48 hours and to resolve within 30 days. Please come to us first — we would much rather fix it directly. You also have the right to complain to the Data Protection Board of India if you are not satisfied with our response.