Privacy Policy

This policy explains how Financial Fitness(operated by Sudhir Khot, the “Data Fiduciary”, “we”, “us”) collects, uses, stores and protects your personal data when you use the 5-Day Goal Setting Challenge platform at kaijing.in. It is written to align with India's Digital Personal Data Protection Act, 2023 (DPDP Act) and the Digital Personal Data Protection Rules, 2025. Our service is intended for users in India.

You can reach us about anything in this policy at sudhirkhot@kaijing.in.

1. What personal data we collect

We collect only what we need to run the challenge and support you:

• Account details: your name and email address. Your password is handled and stored by our authentication provider in hashed form; we never see it.
• Your worksheet entries: the financial details you choose to enter across the five days: income, expenses, assets, liabilities, goals, plans, insurance cover and personal reflections.
• Service-request (lead) forms: if you ask to speak with our team, the details you submit on that form: name, contact number, city and profession. The term-insurance eligibility form additionally collects your date of birth, the cover amount you want, your annual income and any self-reported lifestyle health conditions (e.g. BP, diabetes), only the fields shown on the form you fill in.
• Purchase & access details: when you buy the course, we receive your name, email, phone and order details from our payment partner so we can grant you access.
• Consent records: the consent choices you make, the policy version, the date/time, and your IP address and browser type at that moment, kept solely as an audit trail of your consent.
• Progress data: which of the five days you have started or completed, and when.

2. Why we use it (purposes)

We use your data only for these specific purposes, and not for anything else:

• To create and secure your account and give you access to the course.
• To save your worksheet entries so you can return to them, and so our team can recall your numbers if you ask us for personal coaching.
• To respond to a service request you submit (e.g. a mutual-fund discussion, a free analysis, or a term-insurance eligibility check) and contact you about it.
• To keep an audit record of the consent you have given.
• To understand, in aggregate and without identifying you, how to improve the platform.

We do not sell or rent your data, and we do not run advertising on this platform.

3. Our lawful basis: your consent

We process your personal data on the basis of your consent, which we ask for by a clear, un-ticked checkbox at the point we collect the data, when you sign up, and on each service-request form. You can withdraw your consent at any time, and doing so is as easy as giving it: use the controls on your Account page or email us. When you withdraw consent we stop using your data for the relevant purpose; this does not affect processing already carried out.

4. Who processes your data

We use a small number of trusted service providers (“Data Processors”) to run the platform. Each handles your data only on our instructions and only for the purpose below:

• Supabase: database and hosting. Your data is stored in the ap-south-1 (Mumbai, India) region, protected by Row-Level Security so each account can reach only its own data.
• TagMango: our course payment and purchase platform, which is the source of your purchase and contact details.
• Pabbly Connect: an automation service that relays your order event from the payment platform to us so we can grant access.

Some of these providers may process limited data outside India. Where that happens, it is only to the extent permitted under the DPDP Act, and not to any territory restricted by the Government of India. Payments and refunds are handled entirely on the payment platform; we do not store your card or banking details.

5. Your rights

Under the DPDP Act you have the right to:

• Access a summary of the personal data we hold about you and how we process it.
• Correct, complete or update your data, you can edit much of it yourself on your Account page, or ask us.
• Erase your data and close your account.
• Withdraw consent at any time (see section 3).
• Grievance redressal: raise a concern with us and have it addressed (see section 6).
• Nominate another person to exercise your rights on your behalf in the event of your death or incapacity.

To exercise any of these, use your Account page where available, or email sudhirkhot@kaijing.in and we will action access, export or erasure requests within 30 days.

6. Grievance redressal

If you have any concern about how we handle your data, please contact our Grievance Officer:

• Grievance Officer: Sudhir Khot
• Email: sudhirkhot@kaijing.in
• Phone: +91 70288 27795

We will acknowledge your grievance and respond within a reasonable time. If you are not satisfied with our response, you have the right to lodge a complaint with the Data Protection Board of India.

7. How long we keep your data

• Account & worksheet data: for as long as you keep your account, so your progress is there when you return. We delete it on account closure or an erasure request.
• Service-request (lead) data: kept while we follow up on your request and for a reasonable period afterwards, then deleted.
• Consent records: retained as an immutable audit trail for as long as needed to demonstrate the lawful basis for processing.

8. How we protect your data

Your data is encrypted in transit and at rest by our hosting provider, and access is restricted by Row-Level Security so each user can reach only their own records. Even our team needs explicit administrative access to view your data for coaching, and only with your consent. We keep administrative access limited to the people who need it.

9. Data breaches

In the unlikely event of a personal data breach affecting you, we will notify the Data Protection Board of India and the affected users as required under the DPDP Act and its Rules.

10. Children

This platform is intended for adults. We do not knowingly collect or process the personal data of anyone under 18 without verifiable parental or guardian consent, and we do not profile or target children. If you believe a child has provided us data, contact us and we will delete it.

11. Changes to this policy

If we change this policy in a substantive way, we'll update the version and date above and ask you to re-consent the next time you sign in.

This policy was prepared in good faith to align with the DPDP Act 2023 and its 2025 Rules. It is provided for transparency and is not legal advice, and nothing here certifies legal compliance. Please have it reviewed by a qualified Indian data-protection lawyer before relying on it in production.