Privacy Notice
Draft 0.1, 24 October 2026
Draft for legal review. Not yet in force.
This notice explains what personal data TradeDFine collects, why, where it is kept, who it is shared with, how long it is kept, and your rights. It is written for the Digital Personal Data Protection Act, 2023 and its Rules ("DPDP law"). TradeDFine is the Data Fiduciary for the personal data described here.
1. Who we are and how to reach us
TradeDFine provides risk-control software for individual traders (see the Terms of Use).
- Privacy requests and complaints: privacy@tradedfine.in
- Grievance Officer: [name], privacy@tradedfine.in, +91 70301 95178
- General support: support@tradedfine.in
2. What we collect and why
| Data | Why we use it | Basis |
|---|---|---|
| Waitlist: name, email, optional mobile number, main broker, segments traded | To contact you about the beta and plan which brokers to support | Your consent on the waitlist form |
| Account: email address, an account identifier from our sign-in provider | To let you sign in and to contact you about your account | Your consent at sign-up; needed to provide the Service |
| Sign-in security: your authenticator secret (encrypted), one-way hashes of your recovery codes, sign-in and reset events | To protect your account with a second step | Needed to provide the Service securely |
| Onboarding answers: age confirmation, risk acknowledgement, data consent, main broker | To confirm you may use the Service and record your consents | Your consent; legal record of consent |
| Your rules and every change to them | To apply your limits and show you their history | Needed to provide the Service |
| Activity log: what the Service saw and did, with times | To show you and us exactly what happened | Needed to provide the Service; evidence in disputes |
| Broker data (when you connect): positions, order and trade status, profit and loss, margin and funds needed for your limits | To monitor your limits and, if you choose, act on them | Your separate consent when you connect; needed for the Service |
| Payments (paid plans): plan, amount, date, payment and order references from our payment partner | To give you access to what you paid for, and for tax and accounting | Needed to provide the Service; legal obligation |
| Alerts: your Telegram chat identifier, if you link Telegram | To send you limit alerts | Your consent when you link it |
| Support messages | To answer you | Your request |
| Technical records: times and types of requests, error records | To keep the Service working and secure | Legitimate use for security; legal obligation (CERT-In) |
We do not collect or store your broker password, PIN, OTP, TOTP code or API secret, or your card, UPI or bank credentials. Payments are handled by our payment partner. We do not use your data for advertising, and we do not sell it.
We do not keep your raw IP address in our records. Rate limiting uses a short-lived, salted one-way value instead.
3. Where your data is kept
Our databases, files and logs are kept in India (Google Cloud, Mumbai region, asia-south1). Some providers process data outside India as part of their service:
- Google Identity Platform sends sign-in emails and may process your email address outside India.
- Telegram, if you choose Telegram alerts, delivers messages through its own servers.
- Google Fonts: the website loads fonts from Google's servers, which see your device's IP address.
We do not transfer personal data to any country restricted by the Government of India under the DPDP law.
4. Who we share data with
We share personal data only with providers who process it for us under contract, and only what they need:
| Provider | What for | Data |
|---|---|---|
| Google Cloud (Google India / Google LLC) | Hosting, databases, encryption keys, logs, sign-in | All Service data, stored encrypted |
| Zoho (India) | Our email | Messages you send us and our replies |
| Razorpay | Payments (when paid plans start) | Payment amount, references; Razorpay collects card or UPI details directly under its own privacy policy |
| Your broker | Connecting your account | Your broker sees that you authorised TradeDFine |
| Telegram | Alerts, if you link it | Alert text and your chat identifier |
We may also disclose data if the law requires it, for example to a regulator, court or law-enforcement agency acting under law.
5. How long we keep it
| Data | Kept for |
|---|---|
| Waitlist details | Until 12 months after the beta opens, or until you ask us to delete them |
| Account, rules, activity log, consents | While your account is open, then [period] after closure, unless the law requires longer |
| Payment records | As long as tax and accounting law requires (currently 8 years for books of account) |
| Security and request logs | 365 days, in India |
| Backups | Expire on their own schedule (monthly to yearly copies), even after deletion from live systems |
6. How we protect it
- Data stored in India, encrypted at rest; the most sensitive items (such as your authenticator secret and any broker access tokens) are encrypted again with keys held in Google Cloud KMS.
- Sign-in needs your email link and an authenticator code.
- Each service has only the permissions it needs; secrets are never written to logs.
- Every rule change and action is recorded in a tamper-evident log.
- If a personal data breach occurs, we will inform you and the Data Protection Board of India as the DPDP law requires.
7. Your rights
Under the DPDP law you may:
- access a summary of your personal data and how it is used;
- correct, complete or update it;
- erase it, except where we must keep it by law;
- withdraw consent at any time, as easily as you gave it. Withdrawal does not affect what was done before, and some features stop working without it (for example, broker monitoring stops if you withdraw broker consent);
- nominate a person to exercise your rights if you die or become unable to;
- complain to us (section 1). If you are not satisfied, you may complain to the Data Protection Board of India.
Write to privacy@tradedfine.in from your registered email address. We respond within [30] days.
8. Children
The Service is only for people aged 18 or over. We do not knowingly collect data about children.
9. Cookies
The website does not use advertising or analytics cookies. The app uses only cookies that are strictly necessary: one that keeps you signed in, and one that remembers your email address for an hour while you sign in.
10. Changes to this notice
We will tell you about material changes by email and in the app before they take effect, and ask for fresh consent where the law requires.