Privacy Policy

Antidote AI, by Nine Spot Seven · Effective: 27 July 2026

This policy explains what personal data Nine Spot Seven (“we”, “us”) collects through Antidote, why we collect it, and the rights available to you. It is written to align with India’s Digital Personal Data Protection Act, 2023 (“DPDP Act”).

1. What we collect

• Advisor account data — your name, email address, firm details, and professional registration details (such as ARN or SEBI registration number) provided at signup.
• Client portfolio data you upload — holdings, values, and portfolio details of your clients, entered manually or extracted from statements you upload. We collect only what is needed to generate briefs and do not seek client identifiers beyond what you choose to include.
• Usage data — logs of feature usage, brief generation, and technical events (timestamps, IP address, device/browser information) used for security and product improvement.

2. Why we process it

• to operate your account and provide the service;
• to generate portfolio-context briefs and summaries you request;
• to secure the platform, prevent misuse, and debug problems;
• to communicate with you about the service (including material changes to terms or this policy).

Where we send product or launch updates (for example, to the waitlist), you can opt out at any time via the unsubscribe link in any email or by writing to us. The service is intended for professionals; we do not knowingly collect personal data from anyone under 18, and will delete any such data we become aware of.

We do not use uploaded client portfolio data for advertising, for training general-purpose models, or for any purpose other than providing the service to you.

3. Your responsibility for client consent

Where you upload information about your clients, you act as the data fiduciary for that data under the DPDP Act, and we process it on your behalf. You must ensure you have given your clients appropriate notice and obtained the consent (or have another lawful basis) required to share their portfolio information with us for brief generation. Do not upload client data if you have not done so.

4. Where data is stored, and who processes it

Antidote runs on Supabase (database and authentication) and Vercel (application hosting; functions run in Vercel’s Mumbai region). Data is protected in transit (TLS) and at rest, and each advisor’s portfolios are isolated at the database layer to their own account. Access within Nine Spot Seven is restricted to what is necessary to operate and support the service.

A small number of additional providers process specific data on our behalf: Anthropic (AI extraction of holdings from statements you upload — files are processed in memory and not stored after extraction), OpenAI (AI drafting of certain narrative text, where that feature is enabled), and Brevo (waitlist and service email). Each is bound to confidentiality and security terms, and none may use your data for its own purposes, including AI model training.

5. No selling of data

We do not sell, rent, or trade your personal data or your clients’ portfolio data. We do not share it with third parties except the processors named above, or where required by law.

6. Retention

We retain account and portfolio data while your account is active. If you delete a portfolio, it is removed from the working system. If you close your account, we delete your uploaded portfolio data and account details within a reasonable period, except where a longer period is required by law. Routine backups age out on a rolling schedule.

7. Your rights

Under the DPDP Act you may request access to, correction of, or erasure of personal data we hold about you, and you may withdraw consent for processing. To exercise any of these rights, email team@ninespotseven.com from your registered address. We aim to acknowledge requests within 7 days and resolve them within 30 days. If your clients raise requests about data you uploaded, we will assist you in fulfilling them.

8. Breach notification

If a personal data breach affects your data or client data you have uploaded, we will notify you without undue delay with the facts known, the likely impact, and the steps taken, and we will make any notifications to the Data Protection Board of India and affected data principals that the DPDP Act and its rules require.

9. Changes to this policy

We may update this policy as the product and the law evolve. Material changes will be notified by email or in-product notice, with the “Last updated” date revised above.

10. Grievance Officer & contact

Grievance Officer, Nine Spot Seven, Mumbai, India: team@ninespotseven.com. Grievances are acknowledged within 7 days and resolved within 30 days.