What Sahi keeps, and why.

Two kinds of people. Advisors, who sign in and use Sahi. Clients, the people whose money an advisor looks after, whose details an advisor enters or imports. A client signs in only if a firm gives them access. They then read their own portfolio, and a family member’s where that member agreed. What they change is their own marginal tax rate and the colour of their charts, and whether a second firm’s book joins their sign-in.

• About an advisor: an email address, a name, the firm they belong to and their role in it. When they sign in, the device and browser, the network address and the city it resolves to, so that Settings can list where they are signed in and let them end any session. Those records go when the session does.
• About a client: a name, an email address if the advisor records one, the household they belong to, notes the advisor writes after a meeting, the principles the advisor declares for them, and the dates they were last reviewed and last spoken to. No PAN, no date of birth, no bank account.
• When a firm gives a client access: the client’s email address as their sign-in, which firm gave the access and when, the tax rate and chart colour they set themselves, and, while they are signed in, the same session records an advisor’s sign-in keeps. They see their holdings, transactions, tax estimates and capital gains statement, what was declared for them and what was agreed with them; never the advisor’s notes. When a second firm gives the same address access, its book joins the sign-in only once the client accepts it, and no firm sees another’s. A firm’s book leaves the sign-in the moment that firm removes the access, archives the client or deletes them, and the sign-in is deleted with the last of them.
• When a family shares its book: a firm can let a member of a household see the other members’ books, but only the books of members it has recorded as agreeing, and only while they are in the household. The firm records that agreement on the member’s behalf. Each member is told by email when someone can see their book, and each viewer when a book joins their view; nothing is sent when it stops. A member who signs in stops sharing from their own Settings, or through their advisor, and their book leaves the view at once.
• The book: the holdings and transactions that a statement contains, read out of a CAS statement or a broker transaction summary. The rows are kept. The file itself is not: it is read once and discarded, and only its name and how many rows it carried are recorded. The one exception is a registrar feed: when CAMS or KFintech emails a firm’s daily file to Sahi, the registrar’s own password-protected zip is kept, still locked, for 30 days and then deleted.
• Prices and fund holdings from public sources, which belong to nobody.
• When something goes wrong: which page it happened on, when, and the error itself, with names, ids and email addresses taken out, and whose sign-in met it, so it can be fixed. Kept for 30 days, then deleted. Nothing of the kind is kept for a visitor who is not signed in.
• What is used: which pages and features each member of a firm opens, counted by day, so Sahi learns what a firm reaches for and what it never finds. A client’s sign-in is counted by role only, never by person. No page address, no client, no figure and no query is kept with the count. When somebody answers “Was this useful?”, the yes or no and the sentence they wrote, with names, ids and email addresses taken out. Kept for 90 days, then deleted, and read only by whoever runs Sahi.
• When you ask for an invitation: the firm, your name, your email and what you wrote, sent as an email to hello@sahicapital.com, and kept nowhere else.

To do the one thing the product does: value each client’s book against what that client declared, and show the advisor what needs attention. Nothing is kept for any other purpose. Inside the product there is no advertising, no analytics script and no tracking pixel, and nothing is sold or shared with anyone for their own use.

Each firm’s data is sealed from every other firm by rules in the database itself, not by a filter in the app. Within a firm, a partner sees the firm’s clients and a relationship manager sees their own. A client sees only their own books, and a family member’s where that member agreed. Sahi’s operator can reach the database to run and support the service, and does not look at a firm’s data except to fix a problem that firm has raised.

The application runs on Vercel, served from Mumbai. The database and the sign-in service are provided by Supabase. Sign-in codes, invitations, each advisor’s morning note, and the notes that tell a client they have access or that a family member can see their book are sent by email through Resend. The nightly jobs that fetch prices and fund holdings run on GitHub and write them to the same database. Each night an encrypted copy of the database is kept on GitHub, which only the operator’s passphrase opens: every night’s copy for fourteen days, then one copy a week until it is ninety days old, then none; once a month the newest is restored into a temporary database there to prove it can be, and discarded. These four are the only companies that handle the data, and each handles it to run the service and for nothing else.

There is no password. Advisors and clients sign in with a code sent to their email. The cookies are the ones that keep that sign-in: the session itself, which no script on the page can read, and a marker that tells the public pages you are signed in so they measure nothing. A session ends after eight hours idle or twelve hours in all; that is judged on the server, from when the session began and when it was last used, not from a cookie. Three more cookies remember choices on this device: light or dark, the size of the text, and how the cards on a page are arranged. Before a code is sent, Cloudflare Turnstile checks that a person is asking, from the browser and its network address.

The pages a visitor can read without signing in (the front page, Product, Security, FAQ, Contact, Guides, Sample review, and this notice and the terms) use three measurement services: Vercel Analytics, which counts visits without cookies; Google Analytics, which counts visits; and Microsoft Clarity, which records how a page is scrolled and tapped. Google Analytics and Clarity set their own cookies, and all three see the pages viewed, the device and browser, and a rough location from the network address. What is typed into the invitation form is masked from Clarity. None runs inside the product, and none measures a visitor who is signed in.

For as long as the firm uses Sahi. A partner can download the firm’s data at any time, as one Excel file made in their own browser and locked with a password they choose; Sahi keeps no copy of the file, only a record of who downloaded it and when. When a firm leaves, its clients, notes, principles and book are deleted with it. A client’s record can be removed by their advisor at any time, and their sign-in with it when no other firm’s record uses it. A record the firm must keep by law after a client asked for it to be erased is erased on the date the firm gave. Anything deleted leaves the nightly backups within fourteen days, and the last weekly copy that could hold it within ninety. The record of errors and the count of what is used are the exceptions: an error is deleted after 30 days, a count after 90.

A client who signs in decides these from their own Settings, at once: to stop sharing their portfolio with their family, to stop seeing their family’s, to take a firm’s book off their login, and to delete their login. They can also ask a firm there to erase their records. The firm holds those records, so the firm answers: it erases them, or records which law requires keeping them and until when (the rules for fund distributors, investment advisers and money laundering can each require that). The client sees the answer, and Sahi erases the records on that date.

Anyone whose details are held, an advisor or a client, can ask what is held about them, have it corrected, or have it erased. Write to hello@sahicapital.com and say who you are; a client should write through, or with, their advisor, since it is the firm that holds their record. This is also the address for any grievance about how data has been handled. If a grievance is not resolved, the Data Protection Board of India can be approached under the Digital Personal Data Protection Act, 2023.

If what Sahi keeps or does with it changes, this page changes first, and the date at the top with it.