Privacy Policy
What MFD Central collects, why, and what you can ask us to do about it.
Version 2026-08-13 · effective 13 August 2026
Who we are
MFD Central is a set of financial calculation and presentation tools for Indian mutual fund distributors and investors, operated by Srikanth Dindakurti from Bengaluru, Karnataka, India.
For the purposes of the Digital Personal Data Protection Act, 2023, we are the Data Fiduciary for the personal data described below, and you are the Data Principal.
All questions about your data go to sreekanth25041990@gmail.com.
What we collect
If you create a distributor account
| What | Why |
|---|---|
| Email address | To identify your account, verify it, and send password resets |
| Password | Stored only as a bcrypt hash. We cannot read it or recover it for you |
| Your name and firm name | Printed on the reports you generate |
| ARN and EUIN | Printed on your reports. ARN must be unique to one account |
| Mobile, contact email, website, address | Printed on your reports, if you supply them |
| Logo image | Printed on your reports. Stored outside the public web folder |
| Your disclaimer wording | Printed at the end of your reports |
Only the email, password and your name are required. Everything else is optional, and reports simply fall back to generic MFD Central branding without it.
Automatically, when you use the site
| What | Why |
|---|---|
| IP address and browser identification | To rate-limit sign-in, signup and password reset, and to detect abuse |
| Sign-in attempts, successful and failed | To lock an account after repeated failures and to show you when it was last used |
| An activity record of account actions | So that a disputed change to an account can be traced |
| A session cookie | To keep you signed in. See Cookies below |
| An anonymous page-view count | A single running total. It is not tied to any individual |
If you use the contact form
Your name if given, your email address, your message, and the IP address and browser identification the message was sent from.
What we never collect
Nothing you type into a calculator ever reaches our server. Every calculator on this site runs entirely inside your own browser, and the PDF is built on your device. Your income, your goals, your portfolio, your client's figures — none of it is transmitted to us, and none of it is stored anywhere by us. Close the tab and it is gone.
We also do not collect, and have no way to obtain:
- Your clients' names, PANs, folio numbers or holdings
- Any bank account, card or payment information
- Your Aadhaar, PAN or any KYC document
- Your precise location
The pre-investment checklist on this site links out to official portals operated by others. Anything you enter on those sites is governed by their policies, not ours, and never passes through us.
Why we collect it
Each item is collected for one specified purpose, and is not used for anything else:
- To run your account — signing in, verifying your email, resetting a password.
- To brand your reports — your profile details exist solely to be placed on the PDFs you generate.
- To keep the site secure — rate limits and lockouts need the IP address and the record of attempts.
- To answer you — a contact message is kept so it can be read and replied to.
We do not profile you, do not run advertising, do not sell data, and do not use your data to train any machine learning model.
Consent, and withdrawing it
We ask for your consent when you create an account, by an unticked box you have to tick yourself. We record the date, time, IP address and the version of this policy you agreed to, so that both of us have a clear record of what was consented to and when.
You can withdraw consent at any time by emailing sreekanth25041990@gmail.com from your registered address, or by asking us to delete your account. Withdrawing consent means we can no longer keep your account, so the account and profile are deleted. Reports you have already generated and saved are on your own device and are unaffected.
Withdrawal does not undo anything lawfully done before it, and it does not apply to records we are separately required to retain.
How long we keep it
| What | Kept for |
|---|---|
| Account and profile | As long as the account is open. Deleted on request |
| Email verification and password reset tokens | 24 hours and 60 minutes respectively, then unusable |
| Sign-in attempt records | Rolling, for rate limiting |
| Contact messages | Until the matter is resolved and no longer needed |
| Account activity records | While the account exists, for dispute resolution |
When an account is deleted, the profile, logo file, tokens and activity records tied to it are removed with it.
Your rights
Under the DPDP Act you may:
- Ask what we hold about you, and what we have done with it.
- Correct or complete it — most of it you can edit yourself on your profile page at any time.
- Have it erased, where we are not required to keep it.
- Withdraw consent, as described above.
- Nominate someone to exercise these rights on your behalf if you die or become incapacitated.
- Complain to us, and then to the Data Protection Board of India.
Write to sreekanth25041990@gmail.com from your registered email address. We aim to respond within 30 days.
Please make requests from the email address on the account. It is the only way we can be reasonably sure we are not handing your data to someone else.
How it is protected
- The whole site is served over HTTPS.
- Passwords are stored as bcrypt hashes and are never readable, by us or anyone else.
- Verification and reset links are stored only as hashes, so a copy of the database yields no working link.
- Uploaded logos are stored outside the public web folder and served only to the account that owns them.
- Database credentials are stored outside the public web folder.
- Sign-in is rate-limited per account and per network, with escalating lockouts.
No system is perfectly secure. If we become aware of a breach affecting your personal data, we will notify you and the Data Protection Board as required.
Children
Accounts are for mutual fund distributors and are not intended for anyone under 18. We do not knowingly collect personal data from children. If you believe a child has created an account, tell us and we will remove it.
The calculators are open to everyone, but as explained above they collect nothing at all.
Changes to this policy
If we change this policy in a way that materially affects you, we will raise the version number and ask account holders to review and consent again. The version and effective date are shown at the top of this page.
Complaints
Please raise it with us first, at sreekanth25041990@gmail.com. Most things are a misunderstanding and are quicker to fix directly.
If we do not resolve it to your satisfaction, you may complain to the Data Protection Board of India under the Digital Personal Data Protection Act, 2023.
Write to sreekanth25041990@gmail.com, or use the contact form. We answer data questions from the address the account was opened with.