Privacy policy

Your firm's client data.When a mutual fund distributor or wealth management firm (our “customer”) uses Spire, it stores data about its own leads and clients — names, contact details, PAN, addresses, portfolio holdings and notes. For that data the customer firm is the Data Fiduciary and Spire is its Data Processor: we process it only to provide the service, on the firm's instructions. If you are a client of a firm that uses Spire, please contact that firm about your data; we will help them respond.

Data about our own users and visitors. For the people who sign in to Spire and for visitors to this website, Spire decides how the data is used and this policy applies directly.

• Sign-in details from Google: your name and email address. We never see your Google password.
• Your role and workspace, and a record of actions you take in Spire (the activity timeline your firm sees).
• Notification settings, and — if you allow browser notifications — a push subscription for your device.
• Basic technical data needed to run and secure the service, such as error reports (with personal identifiers removed) and server logs.
• Anything you send us when you contact us on WhatsApp or by email.

This website does not use advertising or third-party tracking cookies. Spire uses only the cookies needed to keep you signed in.

• To provide the service your firm subscribed to: sign-in, permissions, notifications and reports.
• To keep the service secure, investigate errors and prevent misuse.
• To reply to you when you contact us.
• To meet legal obligations.

We do not sell personal data, and we do not use client data for advertising.

Some features (such as Spire Saathi and drafted review notes) send the relevant text to Google's Gemini service using an API key that your firm provides. AI output is always a draft: a person at your firm reviews it, and nothing is sent to a client automatically. Before sending, Spire removes PAN, Aadhaar, phone numbers, email addresses and bank, folio and card numbers, and replaces the client's name with a placeholder that is swapped back once the draft returns. Other names typed into a note or a Saathi question are sent as typed. How Google uses the rest depends on your firm's key: on the free tier Google may use requests to improve its services; with billing turned on, it doesn't.

When a Saathi answer shows client records, Spire logs who asked, what they typed and which clients came back. Your firm's Owner can see this log, and is alerted when one person looks up an unusually large number of clients in a day.

We rely on a small number of providers to run Spire, each bound to protect the data:

• Vercel — application hosting (our servers run in Mumbai).
• Supabase — the database where workspace data is stored.
• Google — sign-in, and the Gemini AI service through your firm's own key.
• Resend — transactional email such as digest emails.
• Sentry — error monitoring, with personal identifiers redacted.

Workspace data is kept for as long as the customer firm's subscription is active. After a subscription ends, the firm can ask for an export of its data, and we then delete it from our systems, except for minimal records the law requires us to keep.

Under the DPDP Act you can ask to access, correct or erase your personal data, withdraw consent where processing relies on it, and nominate someone to exercise these rights for you. For client data held by a firm, please contact the firm first; we will support them.

Each firm's data is isolated at the database level, encrypted in transit and at rest, and backed up daily. Read more on our security page. If a personal-data breach affects a customer firm's data, we will tell that firm without undue delay.

For any privacy question or grievance, email hello@spirewm.com. We aim to acknowledge within 2 working days and resolve as quickly as possible. If you are not satisfied, you may approach the Data Protection Board of India.

We will update this page if our practices change and show the date above.