Privacy Policy

We value the trust you place in us and hence recognize the importance of protecting your privacy. This policy explains how T7 Wealth Creators Pvt Ltd (“we”, “us”, “our”) collects, uses, stores, shares and erases your personal data, and how you can exercise your rights over it. It is published as the notice the Digital Personal Data Protection Act, 2023 requires to be given to a Data Principal.

The Act comes into force in stages, and so do the Rules made under it. The Digital Personal Data Protection Act, 2023 (“DPDP Act”) is the law that will govern how we handle your personal data, and the Digital Personal Data Protection Rules, 2025 (“DPDP Rules”) are made under it. The rights described in Section 6 come into force on 13 May 2027, and until then they cannot be enforced under the Act. A right that a provision has not yet created cannot be enforced under that provision, and that is all it means: what we have set out in the meantime is a promise we have made to you, and it binds us from the day we publish it. Nothing in this policy withdraws a right you have under the law that applies today. We tell you which is which, because a notice describing a future right as an existing one would mislead you just as much as one pretending a promise is a legal right.

What applies today is the Information Technology Act, 2000 and its rules, and the Consumer Protection Act, 2019. The Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 are in force now, and they are where the rights you can enforce today come from: they give you the right to have the information you have given us reviewed and corrected, the option not to give it in the first place, the right to withdraw your consent at any time, and the redressal of a grievance within a month. Where any of those impose a stricter duty than something we have undertaken here, that stricter duty applies.

This policy is an integral part of our Terms of Service and should be read together with it. We are the Data Fiduciary in respect of the personal data described here, and you are the Data Principal.

1) Definitions

Capitalised terms used but not defined here have the meanings given in the Terms of Service and in the DPDP Act and the DPDP Rules.

“Personal Data” means any data about an individual who is identifiable by or in relation to such data.

“Processing” means a wholly or partly automated operation performed on Personal Data, including collection, storage, use, sharing, disclosure and erasure.

“Consent” means the free, specific, informed, unconditional and unambiguous indication of your wish to process your Personal Data, given by a clear affirmative action, as required by the DPDP Act.

If you need help with any other definition, contact the Grievance Officer mentioned in Section 14 of this policy.

2) Scope

This Privacy Policy applies to information collected online by us from you through T7Website or E-Mail, and also to information you give us offline that we later record in digital form, such as details taken over the telephone or written down at an event and then entered into our systems. Where we collect information offline and do not digitise it, it is not covered here, and we will tell you separately if we ever do that. This policy describes our procedures and practices only, and does not apply to the procedures or practices of entities that we neither own nor control, or to people that we neither employ nor manage. The type and mode of information collected is described in Section 3.

3) Personal Data We Collect, and Why

We collect Personal Data through the notice and consent process described in Section 5. Where a field is optional, it is marked as such. We do not collect more Personal Data than is necessary for the purposes below (data minimisation).

3.1 Membership and account information. Membership in T7Website is necessary before you are granted access to products / services. Registration requires you to provide information about yourself such as full name, e-mail address and mobile number. We do not set or store a password for you. When you sign in, we e-mail you a single-use link that takes you to your account, and we store only a SHA-256 digest of that link, never the link itself. You may also register a passkey, which is a device-held credential created through your device’s own authenticator, and in that case we store the public key and credential identifier and never your biometric data, which never leaves your device. You may also give us your gender, date of birth, residential and communication address including PIN code, and nationality, and you may give us your PAN card number where we need it for a tax invoice. Every one of those fields is optional except your name, e-mail address and mobile number, and you can leave the rest blank. We process this Personal Data to establish and verify your identity, create and administer your membership account, provide the products and services you request, issue licences / access rights, collect fees owed, resolve disputes, and enforce our Terms of Service. You may review and update your membership information by logging in to your account, and you may remove a passkey at any time from the passkeys page in your account.

3.2 Payment information. You can pay for the products / services offered through T7Website only through the links provided by us. We do not collect or store any credit card / debit card / cash card / internet banking details that you use to make a payment. Payments are processed directly by our payment gateway service, Razorpay Software Private Limited, which provides the interface for entering your payment instrument details on their systems. What reaches us is the gateway’s record of the transaction, and not your card details. The gateway tells us the payment’s identifier, the amount, the currency, whether it was captured or failed, and the e-mail address you gave it, and we retain that together with our own record of the order: which product or plan you bought, the amount, the gateway’s reference, and the date and time we recorded it. None of it is your card number, its expiry date or its CVV, and none of that is stored by us or comes to us. Where a refund is issued to you, or where you are a distributor / reseller with us, we may collect and store your bank account details or such other information as is required to complete our financial obligations towards you.

3.3 Support and feedback information. You may contact us by electronic means such as e-mail or support / feedback forms, disclosing information about yourself such as your name and e-mail address. We may retain the content of your support requests and the associated responses, together with any information you choose to disclose voluntarily, in order to troubleshoot problems, support a safe service, and improve our products and services.

3.4 Surveys and contests. We may run surveys or contests that request and retain contact information such as name, e-mail address and demographic information such as age, gender, physical location including PIN code, employment status, financial status and trading / investment preferences. Participation is completely voluntary and you choose whether or not to disclose this information.

3.5 Computing resource information. We do not inspect, fingerprint or install anything on the device you browse from. We do not read your device’s hardware, firmware or storage, and we install no software on it. T7Website is a website: the pages run in your browser. The site leaves two things on your device, and both can be deleted at any time: the session cookie described in Section 12, which is what keeps you signed in, and your theme choice, which is kept in your browser’s local storage so that the page does not flash the wrong theme while it loads. Neither is used for advertising or profiling, and the theme value carries nothing about you beyond the fact that you chose a light or a dark page. That is different from the ordinary request metadata described in Sections 3.7 and 10. Every web request necessarily carries your IP address, because a server cannot answer a request without knowing where it came from, and we record the time we received it ourselves, rather than relying on anything your browser sends about the time. We also receive the browser and operating system your browser identifies itself as, where your browser chooses to send it, and we use it to read the site and to keep it working. We describe collecting that metadata in Sections 3.7 and 10, and we do not collect it by inspecting your device. If we ever begin inspecting a device, we will say so in this policy before we do.

3.6 Browsing information: cookies and server logs. See Sections 12 and 3.7. We may automatically collect browsing information while you use T7Website.

3.7 Server log files. Web server log files are automatically created and maintained by servers to record the activities performed by them. Our web server logs may include your browser type, operating system, IP address, date and time of visits, and the pages viewed. We retain system and processing logs and associated traffic data for one year from the date of the processing, and we erase them after that, unless the law requires us to keep them for longer. That is the period the law sets for personal data, associated traffic data and other logs of the processing, and we apply it already rather than waiting for the Act’s own provisions to come into force. We keep the logs within India, because the law requires the ICT logs of a body corporate to be kept here, and the minimum it sets runs within the period stated above. We process this data for the security of T7Website, for troubleshooting and to help promote a safe service.

4) Purpose and Usage of the Personal Data Collected

We collect and process your Personal Data for one or more of the following purposes:

We will not process your Personal Data for any purpose that is not connected to the purposes above without first giving you a fresh notice and, where required, taking your consent. Purpose limitation and data minimisation are applied to every collection.

5) Consent, Notice and Withdrawal

Before or at the time of collecting your Personal Data we give you a notice in clear and plain language containing an itemised description of the Personal Data being collected and the specific purpose of processing it, together with links to this policy and to the means by which you may withdraw your consent and exercise your rights. Section 13 says where, on this site, that notice is given.

Your Consent is obtained by a clear affirmative action (such as ticking an unchecked consent box, clicking an unambiguous “I agree” button, or completing the form that asks for the data) and is free, specific, informed, unconditional and unambiguous. You may request the products or services with assurance of quality, and we will not make your acceptance of any other processing a condition of providing them unless the processing is necessary for the service.

You may withdraw your Consent at any time. Withdrawal is as easy as giving consent: write to us, and Section 13 says how. There are three different requests here, and they are not the same. You can withdraw your consent for one particular purpose, which stops that processing and leaves the rest of your account and your other services alone. You can withdraw the consent that a particular service needs in order to continue, and only the services that depend on the withdrawn processing may then become unavailable to you. Or you can ask for your account to be erased, which is a separate request and is dealt with in Section 13. Whichever of them it is, when we act on your withdrawal we stop processing the affected Personal Data and erase it subject to Section 7, except where we are required or authorised by law to retain it, and you do not have to make a second request for that. Section 13 says when we act on it.

We do not send marketing, and here is the honest reason rather than a claim that there is a preference you can set. We have nowhere to record a marketing preference, so we send no marketing communication at all: not by e-mail, not by SMS, not by automated call, and not by a newsletter. We will not begin sending marketing until we have somewhere to record your opt-in and have asked you for it, and when we do we will tell you here how to give and withdraw it. Anything about our products or services that reaches you by e-mail or SMS is a service communication described in the Terms of Service, not marketing.

6) Your Rights as a Data Principal

There are three things here and they are different from one another, so we will not blur them. What you can enforce against us today under the law that applies now. What we have committed to on top of that, and which we do now. And what the DPDP Act will add from 13 May 2027, which you cannot enforce under those provisions until then.

WHAT YOU CAN ENFORCE TODAY, under the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011:

WHAT WE COMMIT TO NOW, ON TOP OF THOSE, AND WHICH DO NOT DEPEND ON ANY COMMENCEMENT DATE:

WHAT THE DPDP ACT WILL ADD, from 13 May 2027, and which you cannot enforce under those provisions until then:

We commit to honouring the last set from the date you can enforce it, and we are not promising it before then. What we do not have today, we do not offer: there is no nomination facility before the Act gives us one, and we will not pretend there is. No part of this Section withdraws a right you have under the law that applies today.

To exercise a right, whether one you can enforce today or one that waits for the Act, write to the Grievance Officer named in Section 14. You can telephone us on the number published in Section 14 for help or to raise a grievance; where we need written confirmation, or have to satisfy ourselves who you are before we can act on a withdrawal or an erasure, we will ask for it by e-mail, and a request made in writing is the easiest way to start. So that we can find you and the records concerned, please give us your full name, the e-mail address or mobile number on your account, your member reference if you have one, the right you want to exercise, and enough detail for us to find the data concerned. You do not need a member reference to make a request, and we do not need one to act on it: if you do not have an account with us, or you cannot find the reference, tell us what else you can, such as the e-mail address or mobile number you used, or the order or the complaint, and we will find the records from that. We hold personal data about people who never registered with us, and their rights are the same as everyone else’s. Where a request relates to correction, completion, updating or erasure, we will carry it out once we are satisfied the request is genuine.

On timelines, precisely. We acknowledge any complaint within forty-eight (48) hours of receiving it and we redress it within one month of receipt. Those are the periods we are held to, and they apply whether the complaint came by e-mail, by telephone or through your account.

The Act’s own redressal system will allow up to ninety (90) days from 13 May 2027, and that is a ceiling for the system rather than a deadline on every request. Where any of these periods conflict, the shortest applies, which today is the one month above.

You also have the right to complain to the Data Protection Board of India if your grievance is not resolved, and a right of appeal to the Telecom Disputes Settlement and Appellate Tribunal against an order of the Board, once the provisions that create those routes are in force. Section 14 says what is available to you today.

7) Storage, Retention and Erasure

Personal Data collected shall be stored and processed on computers / servers owned by or leased to us, hosted by our infrastructure provider as described in Section 10. Whenever you add / change / access your membership account information, we use a secure connection to collect that data.

We retain Personal Data only for as long as the purpose for which it was collected is being served, or as required by law. In particular:

Once the purpose is exhausted, the Personal Data is erased or, where it must be kept for a legal obligation, it is stored with access restricted to that obligation. Rejecting this policy while holding a membership account is dealt with in Section 13.

8) Security Safeguards

We follow stringent, industry-standard technical and organisational security measures to protect against the loss, misuse and unauthorised alteration of the Personal Data under our control. Our security measures include encryption in transit, one-way hashing of single-use sign-in tokens, role-based access controls, audit logging of administrative deletions, and database backups. Whether our contracts with our processors carry the provision the Rules ask for is something we have not yet checked, and Section 10 says so. We hold no password for you, so there is no password for us to store, hash or leak. Access to Personal Data is limited to personnel and processors who need it to perform the purposes in Section 4.

9) Personal Data Breach

If we become aware of a Personal Data breach, we will:

We tell the people affected, straight away, now and whatever else changes. Reporting the breach to the Board is a duty that begins on 13 May 2027, and we will report it from that date. The seventy-two hours runs to the detailed report to the Board, not to our first notification of the Board.

We maintain records of every Personal Data breach and the remedial action taken.

10) Sharing, Disclosure and Transfer of Personal Data

We may share Personal Data with our other corporate entities or affiliates, our corporate partners, or a third party in general where it is necessary to process transactions or provide services you have requested. While using services that depend on such third-party entities you may be connected / routed to their servers (a backend operation not directly visible to you) and your browsing information may be visible to them and managed under their own privacy policies. The processors and other third parties with whom we share your Personal Data are:

We require our processors to restrict themselves to processing on our instructions and to apply the same security safeguards we apply ourselves, and we hold them to that. We are reviewing the agreements behind those terms, and we will say so here when we have checked them. We do not sell your Personal Data. If we add a processor or a third-party embed of the kind described above, we will name it in this Section before we use it. Each of those processors handles your data on our instructions, and we are answerable to you for what they hold on our behalf. The accounting records described in Section 13 are our company’s own records, which we are required to keep for tax and company law and which our accounting provider holds for us because that is the service it provides; they are not that provider’s records, and our responsibility for them is ours. A processor may also keep a record of its own for its own purposes: our payment gateway keeps the record of the transaction it took, because it is the party that settled it and it has to be able to answer a dispute about it. Those are its records and its periods rather than ours, we do not set them, and we do not publish a figure for them that we have not checked. Our own obligations in relation to what our processors hold remain ours.

Information we collect may be transferred across international boundaries because some of these entities use servers located in several places across the globe. The standard that applies to us today, and which we hold our processors to, has two parts, and both must be satisfied. First, the recipient must ensure the same level of data protection that we give the data. Second, the transfer must be necessary for the performance of the lawful contract between us and you, or you must have consented to it. Consent is not an alternative to the first part; it is one of the two ways the second part is satisfied, and the same level of protection is required either way. We require that of every recipient, and we are checking the agreements behind it. If we ever transfer sensitive personal data, we will not do so unless the same level of protection is ensured. Under the DPDP Act, once it commences, transfer outside India is permitted subject to whatever the Central Government requires by general or special order, and we will comply with any such order, including any restriction on a particular country or territory.

If you choose to become a member by getting referred by another member (under our Referral System), you acknowledge our right to disclose your name and referral ID to the person who referred you. Being part of the Referral System is voluntary, and you can avoid this disclosure by not mentioning a referrer while signing up.

We may disclose information where required by law: where we, in good faith, believe that disclosure is necessary to meet or enforce our legal obligations or rights, including satisfying any applicable law, regulation, legal process or enforceable governmental request, enforcing our Terms of Service and protecting the rights, property or personal safety of our users or the general public.

If we are partly or wholly acquired by or merged with another business entity, Personal Data may be considered part of the merged / acquired assets and may be transferred to that business entity, subject to this policy and the DPDP Act.

11) Children’s Data and Persons with a Disability

T7Website and our products are intended only for individuals who are at least 18 years of age. Our membership terms require every account holder to be at least 18, so we do not knowingly process the Personal Data of a child (a person below 18 years) at all. Should that ever change, the law requires the verifiable consent of a parent before any personal data of a child is processed, and due diligence to check that the person identifying as the parent is an adult, so we would put that in place before we accepted a child’s data. We do not track, behaviourally monitor or direct targeted advertising at children, and we do not undertake any processing that is likely to cause a detrimental effect on the well-being of a child.

If you believe we have collected a child’s Personal Data, write to the Grievance Officer in Section 14 and we will erase it. Where a person with a disability who is unable to act independently uses our services, we require the verifiable consent of their lawful guardian in the same manner.

12) Cookies

A “cookie” is a small piece of text stored by a web server on a web browser which can later be read back from that browser. Cookies are useful for enabling the browser to remember browser state information specific to a given user. Cookies cannot run programs on your computer, plant viruses or harvest and transmit other data from your hard drive. Browsers are usually set to accept cookies; if you prefer not to receive cookies you may configure your browser to refuse them, though some areas of T7Website may then not function as effectively.

What we actually set. We set one cookie of our own, and it is strictly necessary: t7_session, which keeps you signed in to your membership account. It is HttpOnly, so scripts on the page cannot read it, and it is not used for advertising or profiling. We set no cookie of our own for analytics, profiling or advertising, and we load no third-party script for any such purpose.

The one exception, and it is a real one. The Google Maps embed on the contact page loads on that page and may cause Google to set its own cookies. That happens without any affirmative choice from you, because the map is part of the page rather than something you click. Section 10 sets this out at greater length, including what to do if you would rather not send anything to Google. On every other page of this site, nothing is loaded from a third party and no third-party cookie is set. That is a different thing from the processors we engage to run the service for you, such as our host, who necessarily receive what the service needs in order to work, and Section 10 names them.

13) How Consent Is Given, and How to Reject or Withdraw It

We do not operate a pop-up consent window on T7Website. There is no window that accepts or rejects the policy. Consent is taken at the point where you actually decide to give us your data, which is described next, and where we are required to record it we do record the fact of your acceptance at that point, as the last paragraph of this Section describes.

Where consent is given. Your Consent is given by a clear affirmative action, at the moment we ask for the data:

We set no cookie of our own for advertising, analytics or profiling, and run no analytics or advertising script on T7Website. The single cookie we do set is t7_session, which keeps you signed in and is strictly necessary for that. The one place a third party’s cookie can reach you is the Google Maps embed named in Section 10, on the contact page, and it is loaded when you open that page rather than after you agree to anything. Section 12 explains what cookies are and what we do about them.

How to reject this policy, or withdraw Consent, or ask for erasure. One mechanism does all three: send an e-mail to support@t7wealth.com saying which of the three you want, and stating your reasons if you wish to. You can also telephone us on the number published in Section 14 to ask for help or to raise a grievance, and we will take a complaint from there. To withdraw consent or to ask for erasure we need it in writing, and we need to be satisfied the request came from you, so please e-mail us, and we will confirm by e-mail if we need anything further. There is no form, no account setting and no login required, because a request you have already made should not be made harder than giving consent was. Withdrawal of Consent is as easy as giving it: the same single e-mail address is the whole of the mechanism. The same e-mail is how you re-accept the policy later, and how you ask us to correct anything in Section 3 that is wrong.

The three are different, and they have different effects. Withdrawing your consent for one purpose stops that processing and erases the data processed for it, and the services that depend on it may become unavailable to you, while the rest of your account and your other services continue. Withdrawing the consent that a service needs in order to continue affects that service. Rejecting the policy, or asking for erasure, closes the account, as the next paragraph describes. None of the three needs a second request from you, and telling us which one you mean is all we need.

What happens when you ask. An operator acts on it and replies to you within the timescales in Section 14. If you ask us to erase your data, we delete what we hold about you, we tell you what was removed, and we tell you plainly what remains and why, because deletion in one system is not deletion everywhere.

What we delete. Your account record and everything in it, including your sign-in details, any credential we hold for you, and your contact details. The record of your consent to this policy, which is held with your account. Our record of your purchase in our own database. Any rate-limit counter held against your e-mail address. Your outstanding sign-in link, so it stops working. These deletions happen together, as one operation: either all of them complete or none of them do, so there is no state in which your sign-in details are gone and the rest of your record is not.

Not everything is deleted with your account, and the categories we keep are the ones listed in the table below. A complaint you made to us is one of them, and we would rather tell you that now than have you find it later. Erasure removes your profile data. It does not remove the record of what you complained about and of how we dealt with it, because that record is the evidence of whether we met the deadlines in Section 14, and because you may still have the right to take the matter further.

What we remove, and what is still personal data afterwards. We remove the link between the complaint and your account, and, once the complaint has been redressed (Section 14 uses “redressed” to mean we have actually fixed or answered the substance of it), we remove your contact details from it. An acknowledgement that we have received your complaint does not count as redressing it, and does not start the retention clock. We keep what you wrote and what we wrote back, because a complaint we have not finished redressing is a duty still running, and a complaint we redressed is the only evidence that we dealt with it in time. The text of a complaint may contain identifying information, such as your name, your address, an order number or a payment reference, because it is what you chose to write to us. Removing the separate fields does not remove those, so the complaint text remains personal data and is protected as such until we delete it or effectively anonymise it. We treat it that way the whole time we hold it: it is not treated as anonymous just because your account record has gone. What we do is hold the words for the period in Section 13 and then delete them.

If the complaint has not yet been redressed when you ask us to erase you, we keep your contact details on it. We still owe you a reply, and removing the only route to reach you would leave us unable to honour the very commitment the 48-hour period exists to protect. Those details are deleted automatically the moment the complaint is redressed, and we do not need to be reminded to do it.

What stays, and why. An invoice, receipt and subscription record in our accounting system, because tax and company law require us to keep accounting records, and the period for which we keep them is the period that law requires. Where that accounting record holds your name, e-mail address or phone number, we will reduce those to what the accounting law needs to identify the transaction. This is done by a person in our accounting system rather than automatically, so it is not instant, and we will confirm to you once it has been done for your account. We do not ask you to choose between your rights and the law, and we do not delete records the law requires us to keep.

Why you may be asked to confirm before we erase. Erasure cannot be undone. Where we can already prove who you are from the message you sent us, we act on it. Where an account holds something of financial value, or where we have any doubt that the request came from the account holder, we may write to the registered address or the e-mail address on file and ask you to confirm before we delete. We will tell you if we are doing that and why. We may write to the registered address or to the e-mail address on file, and a reply from either of those is a confirmation. We will never ask you for your password, for your passkey secret, or for a sign-in link, and we will never ask you to send us any of those.

How you ask. An erasure request reaches us the same way a withdrawal or a correction does: by e-mail to support@t7wealth.com. There is no “delete my account” control inside your account today, and there is no account setting for it. We have chosen an e-mail request as the route, because an erasure cannot be undone, and an irreversible action should carry a check that the request really came from the person it is about. Where we can already prove who you are from the message you sent us, we act on it; where we cannot, we ask you to confirm as the paragraph above describes. Nothing about the request is optional or at our convenience. If we do not act on an erasure request you are entitled to make, you can complain to a consumer commission, and no part of these terms removes any right you have for doing so.

On receipt of a request to withdraw your consent, to reject this policy, or to ask for erasure, an operator acts on it within thirty days of our receiving it. What is deleted depends on which of the three you asked for.

Withdrawing your consent for one purpose stops that processing and deletes the data processed for it, subject to the retention exceptions in Section 7. Your member record, your passkeys and your other services are not touched, and the services that depend on the withdrawn processing may become unavailable to you.

Rejecting this policy, or asking for erasure, is the account-wide one. We suspend your membership account within that period, and that suspension is done by a person rather than by a machine. We are telling you that plainly because nothing on our side notices your rejection by itself: the thirty days is a commitment about what a person will do, not a machine reacting to your e-mail. The erasure is carried out as part of that action, and it is at that point that your data is deleted from the live systems. We do not keep it in case you come back. An operator does this, and it deletes your member record, your passkeys and any outstanding sign-in link, the record of your consent to this policy, our local record of your purchase, and any rate-limit counter held against your e-mail address, and it removes your name and contact details from any complaint that has already been redressed, rather than deleting the complaint, and it leaves those details on a complaint you have not yet had an answer to, because we still owe you a reply and removing the only route to reach you would leave us unable to honour it. All of those deletions run as a single operation, so an erasure cannot half-apply. We keep a dated note that the erasure happened, which holds no name or address, and we will tell you what was removed and what remains. Each category we retain has a stated purpose and a stated period, and there is no general exception:

What we retain Why How long
Invoices, receipts and records that you bought and paid for a subscription We are required by tax and company law to keep accounting records The period that law requires
Server, traffic and processing logs, kept within India The law requires the ICT logs of a body corporate to be kept within India, and we use them to detect and investigate security incidents One year from the date of the processing, then erased, unless the law requires us to keep them for longer. The 180 days the law sets as a minimum runs within that period
Records of a disputed payment or chargeback We need them to answer a dispute about money we actually received Until the dispute and any related proceedings are closed, then deleted
A complaint you made to us It is the evidence of what you complained about and of what we did, which is how we show the 48-hour and one-month periods in Section 14 were met, and how you would take the matter further if you disagreed Three years, from when it was redressed, or, if it never was, from when you sent it. Then the text of the complaint and of our reply is deleted by the daily cleanup process, and what remains is the dates and the reference
The dated note that we erased your account It is how we know an erasure has already happened, so that a restored backup does not bring your account back and so that we do not treat your request as a mistake One year from the erasure, then deleted by the same daily cleanup process. It holds your member reference and the date, and no name, address or email
The erasure record we keep in a separate ledger, outside the database that holds your account It is how we know which accounts have been erased, so that a restored copy of our database cannot quietly serve one of them again Until we are satisfied that no copy of our database from before your erasure can be restored. That is at least the 30 days of our host’s restore window, and longer where we still hold an exported copy. Where we do not know when a copy will be deleted, we keep the record rather than assume it has gone. It holds a random identifier issued to you when you registered, the row number your account held at the time, the date and the fact of the erasure, and no name, address or email
Records required by an order of a consumer commission, tribunal or other authority A lawful direction binds us For the period that direction requires, then deleted

Everything else, including your sign-in details, contact details, preferences and any credential we hold, is deleted from the live systems. The categories named in the table above are the things that are kept rather than deleted, and you are told about them here rather than after you have asked. The complaint is the one among them that carries your own words, which is why it has a paragraph of its own above. We remove the link to your account and, once it is redressed, your contact details. The text you wrote may still name you, so it stays protected personal data and is treated that way until it is deleted or effectively anonymised, and this paragraph is where we say so rather than leaving you to work it out.

On the three-year figure. The Consumer Protection Act, 2019 does not itself set how long we must keep a complaint record. What it sets is how long you have to complain about us: a consumer forum will not ordinarily entertain a complaint filed more than two years after the cause of action arose, and it can accept a later one where you had sufficient cause. Three years is a period we have chosen, not one the Act requires. We chose it because two years plus a margin leaves room for a complaint admitted late, and because we would rather hold your words a little longer than too briefly.

Two things about that choice, stated rather than glossed over. Going past the ordinary two-year limitation period does not establish that three years is enough in every case, and we are not claiming it is: a different period may apply to you, or to a particular claim, and if one does it overrides ours. And where some other legal requirement, an order of a consumer commission or tribunal, or a live dispute applies, we hold the record for as long as that requires instead, and we will tell you if that is the reason.

When the three years starts, and the word that matters here is “redressed”. For a complaint we have redressed, it runs from the date we redressed it. For a complaint we never redressed, it runs from the date you sent it to us. Those are the only two starting points and we use the same three-year length for each.

“Redressed” means we fixed it or gave you a final answer on the substance. It does not mean we wrote back to say we had received it. Our acknowledgement of a complaint within 48 hours is a separate step and it is not what starts this clock, because most complaints are acknowledged long before they are resolved and the record of what you actually complained about is needed right up until the end.

This applies to every complaint, including one we never redressed. A complaint nobody ever picks up is not exempt from deletion on the ground that we still owe you an answer. On the rule above it is deleted three years after you sent it, and the register brings an old unresolved complaint to a person rather than letting it sit.

A complaint we have redressed but which you dispute is not thrown away. Where a legal requirement, an order of a consumer commission or tribunal, or a live dispute applies, we put the record on hold and it is not deleted at all while that lasts.

How the deletion runs. A record becomes eligible for deletion when its retention period ends, and it is removed by the daily cleanup process, which is scheduled to run once a day. Your data is deleted from the live systems when the erasure action is completed, and that is not the same as every copy of your data ceasing to exist at the same moment. A copy of our database taken before the erasure, whether it is one our host can restore within its 30-day window or one we exported ourselves, can still hold your data until that copy is deleted. We keep an exported copy only while it is needed. Once a newer copy of the same database has been taken and verified, the older one is deleted, unless it was taken before a change we have not yet verified, or an authority has directed us to keep it, in which case we delete it as soon as that reason ends. A copy that has been committed to our repository is the one exception we do not delete, because the repository’s history keeps it and we do not treat that as a copy we have removed. Every copy we export through our backup process is registered with the erasure record, so that rule is something we apply and can be shown, and not only something we say. The age of a copy is not evidence that it has been deleted. Where a copy is restored, the erasure record in the table above is what tells us to reconcile it rather than serve the account again, and we keep that record until we are satisfied no such copy can be restored. Removing your data from the live systems and the deletion of a copy taken earlier are two different things, and we are describing both. If you would rather we deleted one of the retained categories too, tell us and we will say whether we are permitted to, and we will delete whatever we are not required to keep straight away rather than at the end of the 30 days. When a retention period above is set by law or by an authority’s direction rather than by us, we cannot shorten it, and we will tell you which category it is and why.

This means a closed account is genuinely closed. If you later want to return, we will ask you to register again, and we will treat you as a new member rather than assuming anything about the old account.

Notice of a change is not the same as consent, and we treat them differently. If we change this policy, we will give you at least 30 days’ advance notice of any material change. That notice tells you what is changing; it does not record your consent. Where a change alters what we use your data for, or introduces a new purpose, we will ask you for your consent separately and specifically, and we will not rely on your silence as consent. Consent has to be free, specific, informed, unconditional and unambiguous, and it has to be given by a clear affirmative action, so a failure to reply cannot be treated as agreement. That is how we apply the requirement now, and it is the rule for a purchase as well: consent to a purchase has to be an explicit and affirmative action, and we do not record it automatically or through a pre-ticked box. Continuing to use a service, or not rejecting a notice, is not a fresh consent to a new purpose, and we do not treat it as proof that you have read the change. If we ask you for consent and you do not give it, we will not carry out the new processing.

What we record when you give Consent. When you accept this policy or give consent for a specific purpose, we record the date and time, the version of this policy you accepted, which version it was shown against, the consent text you were shown, and the action you took. That record is stored with your account, is not used for anything else, and is deleted with your account when your data is erased. If you ask what you consented to and when, we can tell you from that record.

Sections 6, 7, 8 and 9 set out the rights and protections that apply to you irrespective of any rejection, and nothing in this Section restricts your right to complain to the Data Protection Board of India once it is in a position to receive complaints, or to complain to a consumer commission or any other competent authority today.

14) Questions and Grievances: the Grievance Officer

If you have a question, request or grievance about how we collect, store, use, share or erase Personal Data, or you wish to exercise a right in Section 6 or withdraw consent under Section 5, contact our Grievance Officer. We acknowledge within forty-eight (48) hours and resolve within one month of receipt, which are the periods in Section 6. The ninety-day ceiling belongs to the DPDP grievance rules that come into force on 13 May 2027, and we do not offer it to anyone in the meantime.

One person and one address. The Grievance Officer named below is a director of T7 Wealth Creators Pvt Ltd, and the same mailbox answers your questions about personal data, receives your complaints and takes your support requests. We have no separate support department, so there is no other address and no other person to send them to, and a message to this one reaches us whichever kind it is. These are the contact details of the person who answers questions about how we process your data. Being the Grievance Officer is a role in this company, and it is not an appointment as Data Protection Officer under the DPDP Act.

Name: Syam Mohan V S

Designation: Director & Grievance Officer

E-mail: support@t7wealth.com

Telephone: +91 8075364997

Postal address for written complaints: The Grievance Officer, T7 Wealth Creators Pvt Ltd, C5, 2nd floor, Dotspace, The Cliff3, TC No 24/1625, Market Road, Kuravankonam, Thiruvananthapuram, Keralam - 695003, India.

Our details, for the record. The legal name of the company is T7 Wealth Creators Pvt Ltd. The website is www.t7wealth.com. The principal address of our office is the one above. Customer care and grievance redressal are both handled at support@t7wealth.com and on +91 8075364997. We have no landline and no fax number, so there is none to give you.

Complaint tracking. When we receive a complaint we give you a reference number in our acknowledgement, and that reference stays the same for the life of the complaint, so you can quote it in any follow-up and we can find the history.

What you can expect from us. We acknowledge receipt of your complaint within forty-eight (48) hours, and we redress it within one month of receipt. That is required of us today, and we are not going to miss it. Where we cannot meet the one month, we will tell you before the month is up, give you the reason, and give you a date. Both periods run from the moment we receive it, by e-mail or by telephone, and not from the day it is entered in our register. Explaining a delay does not extend the deadline, and the one month is a commitment on us and not a target we are aiming at. You will get a reply that names the person handling your matter.

Complaints you send us. You will receive a reference number in our acknowledgement, and that reference stays the same for the life of the complaint, so you can quote it in any follow-up. If you ask for a copy of the complaint as we have recorded it, we will send you one. You can also take your complaint to the National Consumer Helpline, which the Government of India operates for consumer grievances and which handles e-commerce complaints.

If you are not satisfied with our response, you may lodge a complaint with the Data Protection Board of India once the Act’s complaint provisions are in force, which is on 13 May 2027, and you may appeal an order of the Board to the Appellate Tribunal from the same date. Those routes are not available to you today, and we are not going to describe as a right you already have something you cannot yet use. We describe them because we intend to honour them from the date they become available, and because you always have the routes below in the meantime. What is available to you today is a complaint to the consumer commission having jurisdiction under applicable law under the Consumer Protection Act, 2019, and to any other competent authority. Nothing in this policy stops you doing either.

15) Policy Modifications

We may change this privacy policy as and when we wish to do so. The procedure we follow while making changes is described under Modifications & Alterations in the Terms of Service. We will give you at least 30 days’ advance notice of any material change. This policy was last modified on 2026-10-21 and carries version 2026-10-21.9. The version is what we record against your consent, and it is a separate marker from the date so that two revisions made on the same day can still be told apart. This revision sets out the security measures we actually apply, and it removes the second, different list of safeguards that the Terms used to carry, so that the two documents do not contradict each other. It also says when the breach-reporting duty begins and no more than that.