Privacy Notice

This Privacy Notice explains how Lineage Money Private Limited ("Lineage", "we", "us", "our") processes your personal data when you use the Lineage platform at lineage.money and our applications. We act as a Data Fiduciary under the Digital Personal Data Protection Act, 2023 ("DPDP Act") and the DPDP Rules, 2025.

1. Who we are

Lineage Money Private Limited, registered office at No. 43, Residency Road, Shanthala Nagar, Ashok Road, Museum Road, Bangalore North, Bengaluru, Karnataka 560025, India. CIN: U66190KA2026PTC220443.

2. Personal data we collect

Identity — name, date of birth, PAN (last 4 digits shown on screen, full PAN kept encrypted — scrambled so no one but you can read it), Aadhaar reference (we never store the 12-digit Aadhaar in plaintext), photograph (only if you upload one).
Contact — email, mobile number, postal address.
Financial — bank account references, demat holdings, mutual fund folios, insurance policy numbers, income/expense data you import via AIS, ITR, CAS, or bank statements.
Family — names and relationship of family members you choose to add, beneficiary and nominee details, will/estate-plan content you draft.
Technical — device identifiers, IP address, browser/app version, session cookies, structured request logs (retained 180 days in India per CERT-In Directions).
Communications — emails / messages between you and our support, marketplace advisors, or grievance officer.

3. Purposes for which we process your data

To provide the core service — wealth tracking, tax planning, estate planning, family-member coordination.
To compute tax estimates and savings opportunities (these are estimates, not advice — see Disclaimer).
To enable you to share data, on your explicit instruction, with marketplace advisors (auditors, investment advisers, attorneys) you choose to engage.
To secure your account — authentication, fraud prevention, abuse detection.
To meet legal obligations — incident reporting (CERT-In), grievance redressal (IT Rules 2021, DPDP §13), record-keeping.
With your separate optional consent: product update emails, anonymized analytics to improve the product.

4. Legal basis

For the purposes above, we rely on (a) your consent, given through the signup flow and visible at Account → Consents, or (b) the "certain legitimate uses" basis under DPDP §7 (e.g. complying with a legal obligation, responding to a medical emergency). Marketing emails and anonymized analytics rely on consent only and can be withdrawn at any time.

You always — you can export everything via your account.
Marketplace advisors — only when you explicitly initiate an engagement, and only the data you choose to share.
Sub-processors — Cloudflare Inc. (hosting + storage), Resend (transactional email), and any partner FIU credentials in B2B2C deployments. A current list is published at Security → Sub-processors.
Authorities — only when compelled by lawful order from an Indian court, regulator, or law enforcement agency.
We do not sell your personal data. Ever.

6. Retention

Active account: as long as you keep your account active.
After account deletion: a 90-day grace window for accidental deletion / data export, then permanent erasure of personal data. Anonymized aggregates may be retained indefinitely.
Request logs: 180 days in India, as required by CERT-In Directions, 2022.
Grievance and DSR tickets: 3 years from resolution, for audit.

7. Your rights as a Data Principal

You can exercise the following at Account → Data Rights or by writing to [email protected]:

Access — get a copy of the personal data we hold about you.
Correction / completeness / update — fix what's wrong.
Erasure — delete your data (subject to retention requirements above).
Withdraw consent — revoke any optional consent without affecting the core service.
Nominate — designate a person to exercise your rights in case of death or incapacity.
Grievance — escalate concerns to our Grievance Officer (see Grievance Redressal).

We respond to verified requests within 90 days; most requests are resolved sooner.

8. Security

All personal data is encrypted at rest using AES-256-GCM under a two-tier key hierarchy (per-family Data Encryption Keys + a platform Key Encryption Key). Transport is TLS 1.3. We log every access for 180 days. See Security for the full posture and our incident-response commitments.

9. Cross-border transfers

We process personal data in India. Cloudflare's Asia-Pacific edge may serve cached static assets globally, but personal data and database storage stay within India. The Central Government may notify restricted countries under DPDP §16; we will update this notice if any such restriction affects our infrastructure.

10. Children's data

The Lineage platform is intended for adults (18+). When a parent / guardian adds a minor as a family member, we treat the minor's data with the heightened obligations of DPDP §9 and DPDP Rules 2025 §10 — no behavioural tracking, no targeted communication, processing only as needed to support the family-member record and consented services.

11. Personal data breaches

If a breach of your personal data occurs, we will inform you in plain language — what happened, the likely impact, what we did about it, and how to contact us — without delay, and we will also report the breach to the Data Protection Board of India and CERT-In within the timelines they require.

12. Changes to this notice

Material changes are notified via email and the in-app notification feed. The version + effective date in the header tell you which iteration you are reading. Past versions are kept under /privacy/archive/ for transparency.

13. Contact

Questions about this notice or your data: [email protected].

Grievances: [email protected] or see Grievance Redressal for our Grievance Officer and the 24-hour acknowledgement / 15-day resolution commitment.