Privacy Policy

Section I Who we are

The "data fiduciary" (under the Indian Digital Personal Data Protection Act, 2023) and "data controller" (under GDPR) for personal information processed through Gemfinity is MGL Gemfinity Private Limited — incorporated in India, with its registered office at T1, Business Park, Poovangal, Kozhikode, Kerala 673014.

Our Data Protection Officer can be reached at support@mglgemfinity.com. Mark your message for the attention of the DPO and it reaches them directly — every privacy request is answered by a person, within the statutory response windows under both DPDPA and GDPR.

Section II What we collect

We collect personal data in six categories. The table below is the complete list — if a piece of data isn't here, we're not collecting it.

What we don't collect: precise device location (we use IP-based country only), biometric data, contacts from your phonebook, browser history outside Gemfinity, or any data from third-party social profiles unless you explicitly connect one (Google or Facebook for SSO — and that's just email and name).

Section III How we use it

We use your personal data for the following purposes — and only the following. If we ever need to use your data for a new purpose, we'll ask first.

• To run Gemfinity — generate valuations, store your Vault, deliver Insider content, run the marketplace and Authorized Dealer Program.
• To bill you — process credit pack purchases and marketplace payments, issue tax invoices, handle refunds.
• To keep you safe — detect fraud, enforce our Terms, investigate suspicious activity, respond to security incidents.
• To talk to you — service notifications, support replies, important policy updates.
• To improve the product — aggregate usage analysis (always anonymized), A/B testing, feature research.
• To measure our advertising — when we run ads for Gemfinity on Meta or Google, we report back which purchases resulted, so we know what to spend on. Described in full in Section X, and switchable off.
• To comply with the law — respond to court orders, regulatory inquiries, tax audits, AML checks.

What we don't do

We don't use your gemstone images, certificate scans, or Vault contents to train MGL Valuer or any other AI model — not without explicit, separate, opt-in consent. Your data is yours.

We don't send marketing emails unless you've opted in. We don't run third-party advertising on Gemfinity — no ad banners, no sponsored placements, no ad network reading the pages you browse here.

We are straightforward about the other direction, though: we do advertise Gemfinity elsewhere — on Meta and Google — and to know whether that money is working, we report completed purchases back to those platforms. That's measurement of our own campaigns, not the sale or brokering of your data, and it never includes your gemstone images, certificates, valuations, or Vault contents. Section X sets out exactly what is sent and how to stop it.

Section IV Legal basis

Under DPDPA 2023 and GDPR, every processing activity needs a legal basis. Ours are:

• Contract — most processing is to deliver the service you signed up for. Without it, we couldn't run your account.
• Legal obligation — tax records, AML/KYC documentation for dealer accounts, regulatory reporting.
• Legitimate interest — fraud prevention, security monitoring, product improvement (always with your interests balanced against ours, and always with the option to object).
• Consent — for things outside the above: marketing emails, optional analytics cookies, advertising-measurement cookies and the hashed contact details sent with them, AI-training opt-in.

Section V Sharing & disclosure

We share personal data with the following categories of recipients, and no others:

• Service providers who run infrastructure on our behalf — AWS Mumbai (hosting and transactional email via SES), Razorpay (payments), Microsoft Clarity (product analytics), and Google Firebase (authentication and analytics). Each is bound by a Data Processing Agreement that limits their use of your data to what we've instructed.
• Advertising platforms — Meta Platforms, Inc. (Facebook and Instagram ads) and Google LLC (Google Ads and Google Analytics). When you buy a book or product, we report that purchase — its value, currency, and order reference, plus a one-way hashed form of your email and phone number used only to match you to an ad you may have seen. Unlike the providers above, these two act as independent controllers for their own advertising purposes, which is why this is a separate category and why you can refuse it. See Section X.
• Marketplace counterparties — when you transact, your name, business name, and shipping details (for physical settlement) are shared with the other party. Nothing else.
• Tax & regulatory authorities — when required by Indian law (Income Tax Department, GST authorities, RBI for cross-border transactions, FIU-IND for AML reporting).
• Legal recipients — courts, law enforcement, or other authorities under valid legal process. We require formal process and notify you where we legally can.
• Acquirers — if Gemfinity is acquired or merges with another company, your data may transfer to the new entity, subject to an obligation to honor this Privacy Policy. We'll notify you 30 days before any such transfer.

Section VI International transfers

When data crosses borders — for example, when an India-based dealer transacts with a buyer in Hong Kong — we rely on the following safeguards: Standard Contractual Clauses approved by the European Commission for transfers out of the EEA, and the cross-border transfer rules under DPDPA 2023 once the central government notifies the list of permitted countries.

Our advertising-measurement partners are United States companies: purchase events sent to Meta Platforms, Inc. and Google LLC are processed on US infrastructure. Those transfers rely on Standard Contractual Clauses and, for EEA data, each provider's certification under the EU–US Data Privacy Framework. If you switch advertising measurement off (Section X), nothing is sent and no transfer occurs.

We do not transfer personal data to jurisdictions on the FATF "high-risk" list or jurisdictions subject to comprehensive sanctions.

Section VII Your rights

You have the following rights over your personal data — under DPDPA 2023 if you're in India, under GDPR if you're in the EEA, and under both for cross-border traders. To exercise any of them, write to support@mglgemfinity.com. Statutory response window: 30 days under DPDPA, 1 month under GDPR.

We don't charge for fulfilling rights requests. We may ask for proof of identity to prevent someone else exercising your rights — usually a confirmation from the email address we have on file.

Section VIII Data retention

We keep personal data only as long as we need it for the purpose collected, plus any statutory retention period. Specifics are in the table in Section II — but in summary:

• Active account data — for as long as your account is open;
• Closed account data — 90 days for personal data, longer for transactional records;
• Tax records — 7 years (Income Tax Act, India);
• AML/KYC documentation — 5 years post-relationship (Prevention of Money Laundering Act);
• Behavioral analytics — 24 months identifiable, indefinitely after aggregation;
• Backups — deleted data can persist in routine backups for a short period after deletion, until those backups roll over.

When the retention period ends, we delete the data or irreversibly anonymize it (no person can be identified). Anonymized data may be retained indefinitely for product analytics and research.

Section IXSecurity

We treat security as foundational, not a feature. Our practices include:

• Encryption — encrypted at rest, and TLS for everything in transit between your browser and our servers.
• Access control — least-privilege, role-based access for our team, reviewed when roles change.
• Monitoring — server-side logging and alerting on unusual authentication activity.
• Vulnerability management — dependency and platform patching, internal review of security-sensitive changes, and a coordinated disclosure route for externally reported issues.
• Incident response — documented playbook with notification commitments under DPDPA (72 hours to the Board, prompt notification to affected users where required).
• Vendor security — every processor goes through a security review and signs a DPA with audit rights.

No system is perfectly secure, but we work hard to make ours as good as it reasonably can be. If you discover a vulnerability, please write to support@mglgemfinity.com — we practise coordinated disclosure, we'll acknowledge your report, and we won't pursue researchers who report in good faith.

Section X Cookies & tracking

We use a small number of cookies and similar technologies. Essential cookies are always set — the platform cannot run without them. Analytics and advertising measurement are on by default and can be turned off at any time; see Turning analytics and ad measurement off below.

What we send to Meta and Google — exactly

We would rather over-explain this than have you guess. When you complete a purchase, and only then, we send:

• The fact that a purchase happened, its value and currency, and an order reference so a later refund can be matched to it.
• Your email address and phone number, one-way hashed before they leave your browser or our server. Hashing is irreversible: the platform can compare the hash against an account it already holds, but cannot read your address from it. This is what lets Meta and Google tell that a purchase came from someone who saw one of our ads.
• Ad click identifiers that were attached to the link when you arrived from an advertisement, plus your IP address and browser user-agent, which those platforms use for matching and fraud prevention.
• Refunds and cancellations, so the reported figures correct themselves rather than overstating our results.

Some of this is sent from our own servers rather than your browser — a method Meta calls the Conversions API. It exists because ad blockers and browser privacy settings block the in-page version; it does not collect anything beyond what is listed above, and it is covered by the same off switch.

What is never sent: your gemstone images, certificate scans, valuation requests or results, Vault contents, marketplace listings, support conversations, business or KYC documents, or your password. Nothing about the stones you own ever reaches an advertising platform.

Turning analytics and ad measurement off

Add ?analytics=off to any Gemfinity URL and we stop loading Microsoft Clarity, Google Analytics for Firebase, and every advertising tag described above in that browser — including the server-side purchase reporting, which is suppressed for your account as well, not just in the page. The setting is remembered for future visits, so you only need to do it once; ?analytics=on reverses it. Blocking the tags with a browser extension or content blocker works too, and nothing on Gemfinity will break if you do.

To be straightforward with you: we do not currently act on browser Do-Not-Track or Global Privacy Control signals, because neither is implemented consistently enough for us to treat it as a reliable instruction. Use the opt-out above and it will be honored exactly. If you'd rather we removed your analytics history altogether, write to support@mglgemfinity.com.

Section XI Children's privacy

Gemfinity is not directed to children. Under DPDPA 2023, processing of children's personal data (under 18 in India) requires verifiable parental consent — and our service isn't meaningful for minors anyway. We don't knowingly collect data from anyone under 18.

If you believe a minor has created an account, please write to support@mglgemfinity.com and we'll close the account and delete the data.

Section XII Contact & DPO

For all privacy-related correspondence — access requests, deletion requests, complaints, security disclosures, or questions about this policy — please write to:

Data Protection Officer
MGL Gemfinity Private Limited
T1, Business Park, Poovangal
Kozhikode, Kerala 673014
India

Email: support@mglgemfinity.com

If you'd prefer to escalate a privacy concern outside MGL Gemfinity, you may contact the Data Protection Board of India (once notified by the central government) or, for EU residents, your national supervisory authority. We'll always tell you exactly which body has jurisdiction over your specific situation.