How we handle your data.
We collect only what we need, use it only for the purposes stated here, and protect it with appropriate care.
1. Who we are
Desvelado Advisory Private Limited (CIN U70200DL2022PTC396194) is a SEBI-registered Research Analyst (Reg. No. INH000028723). Our registered address is Unit no. 502, 5th Floor, Plot no. A1, D Mall, Netaji Subhash Place, Pitampura, New Delhi – 110034. For privacy queries, contact us at privacy@desvelado.in.
2. Information we collect
We collect: (a) Identity data — name, email, phone number, PAN and Aadhaar/passport details collected during KYC and client onboarding as required by SEBI regulations. (b) Financial data — payment details processed through our payment gateway (we do not store card numbers). (c) Usage data — pages visited, time on site, browser type, IP address and referral source, collected via our own analytics. (d) Communication data — emails, complaint submissions and any other correspondence with us. (e) Research preferences — securities and sectors you have requested coverage on. (f) Account security data — if you set a password for the client portal we store it only as a one-way cryptographic hash, never the password itself, and nobody at Desvelado can read or recover it. If you turn on two-factor authentication we store the shared secret your authenticator app uses, and one-way hashes of your backup codes. (g) Sign-in and account records — when you signed up, when you confirmed your email, when you set or reset a password, when you signed in and out, the browser you used, and an approximate location (city and country only) derived from your IP address at the time. We do not use your device's precise location and we never ask your browser for it. (h) Support records — issues you report to us through the portal, including any description you write and the technical details of the error, together with the reference number we give you. (i) KRA and KYC details — date of birth, gender, address, the documents you upload or fetch through DigiLocker, and the other fields a KYC Registration Agency (KRA) requires us to file for you. (j) Whether you are differently abled — the KRA form has a mandatory field asking this. It is sensitive, so we ask it only for that statutory field and use it for nothing else; if you answer Yes, the further details the KRA requires are collected by our desk, not on the screen. (k) Call recordings — calls with our desk are recorded, and transcribed so they can be searched and reviewed. (l) Screening results — your name is checked against the UN Security Council consolidated sanctions list, as anti-money-laundering rules require.
3. How we use your information
We use your information to: (a) provide the research and subscription services you have subscribed to; (b) comply with SEBI regulations, including client record-keeping requirements under the SEBI (Research Analysts) Regulations, 2014; (c) process payments and manage your subscription; (d) send you research reports, market updates and service communications; (e) respond to your queries and complaints; (f) improve our services and website; (g) prevent fraud and ensure security; (h) complete your KYC and file it with a KRA, as SEBI requires; (i) screen clients against the UN sanctions list and keep the records the Prevention of Money Laundering Act, 2002 requires; (j) keep the record of our calls and messages with you that the SEBI Investor Charter requires. Account security and sign-in records are used to let you into your portal, to detect and stop attempts to guess your password, and to help you and us work out what happened if you tell us something went wrong. When you report a problem or a complaint, we may contact you using any contact detail we already hold for you — including a phone number or email address you gave us during KYC — so that we can reach you about the issue you raised. Research reports served from your portal are watermarked with your name, email address and the time they were served, so that a copy which is shared onward can be traced; this is to protect our research and other clients, and the watermark is visible to you on your own copy. We do not use your data for automated profiling or algorithmic decision-making that affects your rights.
4. Legal bases for processing
We process your data on the following bases: (a) Contract performance — to deliver the services you have paid for; (b) Legal obligation — SEBI regulations and the Prevention of Money Laundering Act, 2002 require us to keep client records (see "Data retention" below), to complete and file KYC with a KRA, and to screen clients against sanctions lists; tax and company law require us to keep invoices; (c) Legitimate interests — improving our products and preventing fraud; (d) Consent — for any marketing communications beyond transactional emails (you may withdraw consent at any time).
5. Sharing your information
We do not sell your personal data. We share it only with: (a) SEBI, BSE (as the Research Analyst Administration and Supervisory Body) and other regulators and authorities, as required by law; (b) a SEBI-registered KYC Registration Agency (KRA) — NDML, CVL KRA, CAMS KRA or DotEx — with which we are required to file and check your KYC record; (c) our KYC and identity-verification providers — Cashfree Secure ID (PAN and Aadhaar-based KYC verification) and DigiLocker, through the Government's API Setu, where documents are fetched from it with your consent; (d) our electronic-signature provider, Leegality (or Digio as an alternative), which sends your agreement for Aadhaar eSign; (e) our payment gateways, Razorpay and Cashfree Payments, to process your payment (we do not store card numbers); (f) our email delivery providers — ZeptoMail (Zoho), Google Workspace and, as a fallback, Amazon SES — and MSG91 to send one-time codes by SMS; (g) Exotel, our telephony provider, which carries and records calls with our desk (transcription of those recordings is done on servers we operate, not by a third party); (h) our legal, audit and compliance advisers under confidentiality obligations; (i) as required by a court order or a law-enforcement request. Sanctions screening is done by us against the UN Security Council consolidated list; your details are not sent anywhere to do it. Every processor is required to use your data only for the purpose we disclosed and to keep it secure.
6. Data retention
We keep KYC records, signed agreements, consent records and the records of the research services we provided for five years after our business relationship with you ends, as the Prevention of Money Laundering Act, 2002 and the SEBI (Research Analysts) Regulations, 2014 require; KYC documents are kept for that period or for eight years from when we received them, whichever ends later. Invoices and payment records are kept for eight years, as GST law and the Companies Act, 2013 require. Complaints are kept for five years after they are closed. For marketing communications, we retain your preferences until you unsubscribe. Website analytics data is retained in aggregate form only and is not linked to your identity after 90 days. Records of our interactions with you — including with prospective clients, before you become a client — are retained for five years, as the SEBI Investor Charter of 2 June 2025 requires. Your password hash and two-factor secret are kept only while your account exists and are deleted when you ask us to erase your details; if you turn two-factor off, the secret and the remaining backup codes are deleted immediately.
7. Your rights
You have the right to: (a) access a copy of your personal data we hold; (b) correct inaccurate data; (c) request deletion of data we are not required to retain by law; (d) withdraw consent for marketing at any time by clicking "unsubscribe" in any email or emailing privacy@desvelado.in; (e) lodge a complaint with the relevant data protection authority. To exercise any of these rights, use the request form at desvelado.in/data-request — it records your request with a reference and a deadline, which an email to a mailbox does not. You may still email privacy@desvelado.in if you prefer. We will respond within 30 days. We confirm who you are before releasing anything, because a copy of your data is everything we hold about you.
8. Cookies & analytics
We use our own analytics (no third-party trackers embedded) to understand site usage. We use session cookies for functionality and a persistent cookie to remember your theme preference (light/dark). We do not use advertising cookies or third-party tracking pixels. You can control cookies in your browser settings; blocking them may affect site functionality.
9. Security
We use industry-standard measures to protect your data: TLS encryption in transit, access controls and regular security reviews. No method of transmission over the internet is 100% secure; we will notify you promptly if a breach affects your personal data.
10. Links to third-party sites
Our site contains links to SEBI SCORES (scores.sebi.gov.in), Smart ODR (smartodr.in) and the Signal newsroom (signal.desvelado.in). We are not responsible for the privacy practices of these sites. Please review their privacy policies.
11. Changes to this policy
We may update this policy to reflect regulatory requirements or business changes. We will notify existing subscribers via email 14 days before material changes take effect. The current version is always at desvelado.in/privacy. Last updated: 6 October 2026.