Last updated: May 2026
mcrux (“we”, “us”, “our”) is an AI-powered portfolio analysis service for Indian retail investors, operated by its founders and reachable at info@mcrux.com. mcrux is currently pre-incorporation. This policy applies to the website mcrux.com and all associated services.
Account information
When you sign in with Google, we receive your name, email address, and profile picture from Google. We do not collect passwords.
Portfolio data (CAS statements)
When you upload a Consolidated Account Statement (CAS) PDF, we extract and store your mutual fund holdings — fund names, ISIN codes, folios, units held, and current values. This is sensitive financial information and is treated accordingly. We do not collect your PAN number or any data that appears in the CAS beyond your mutual fund holdings.
Payment information
Payments are processed by Razorpay. We receive a confirmation of payment and your plan tier. We do not store card numbers, UPI IDs, or any payment instrument details.
Usage data
We may collect basic usage logs (pages visited, features used) to improve the product. We do not use third-party advertising trackers.
We do not sell your data to any third party. We do not use your portfolio data for advertising. We do not share your data with any financial institution, broker, AMC, or distributor.
We use the following sub-processors to operate the service. Several are hosted outside India (marked USA). By using mcrux you consent to this cross-border transfer of your data, which we carry out under contractual safeguards with each provider.
| Service | Purpose | Data shared |
|---|---|---|
| Supabase (USA) | Database & authentication | Account + portfolio data |
| Google OAuth | Sign-in | Name, email, profile picture |
| Anthropic Claude (USA) | AI analysis generation (primary) | Portfolio holdings (no PAN, no name) |
| Google Gemini (USA) | AI analysis generation (fallback) | Portfolio holdings (no PAN, no name) |
| Razorpay (India) | Payment processing | Email, payment amount |
| Resend (USA) | Transactional email | Name, email |
| Railway (USA) | API hosting | Request logs |
| Vercel (USA) | Frontend hosting | Request logs |
Portfolio data is stored in Supabase with row-level security — each user can only access their own data. API keys and secrets are stored as environment variables and never committed to source code. All traffic is encrypted via HTTPS/TLS. While we take reasonable measures to protect your data, no online system is completely secure. You transmit data to us at your own risk.
Under the Digital Personal Data Protection Act 2023 (DPDP Act), the Information Technology (Amendment) Act 2008, and applicable Indian privacy rules, you have the right to:
To exercise any of these rights, email info@mcrux.com. We will respond within 30 days. You may also raise a complaint with our Grievance Officer (see Section 10 below).
mcrux is not directed at anyone under 18 years of age. We do not knowingly collect data from minors.
We may update this policy from time to time. If we make material changes, we will notify you by email or by posting a notice on the website before the change takes effect. The “Last updated” date at the top will always reflect the current version. Continued use of the Service after the effective date of any change constitutes your acceptance of the revised policy.
As required under the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 and the Digital Personal Data Protection Act 2023, we have designated a Grievance Officer to address complaints related to the processing of your personal and financial data.
Name: Grievance Officer, mcrux
Email: info@mcrux.com
Response time: We will acknowledge your complaint within 48 hours and endeavour to resolve it within 30 days.
For any privacy-related questions or requests, contact us at info@mcrux.com.