₹ LEGAL · PRIVACY POLICY

Privacy Policy

Effective date: 23 May 2026 · Version 1.0 · Compliant with the Digital Personal Data Protection Act, 2023 (India)

Chakravala collects only what we need to operate your account and execute the strategies you enable. We never sell your personal data. This policy explains what we collect, why, and what rights you have under Indian law.

01Data we collect

When you create and use an account, we collect:

Account data — name, email, phone number, hashed password.
Broker linkage — your Zerodha user ID and short-lived API access token, stored encrypted at rest.
Trading data — strategies you create, backtest jobs, paper and live positions, P&L history.
Payment data — subscription plan, billing status, UTR / Razorpay reference. We do not store full credit card or bank account numbers; those are handled by Razorpay.
Technical data — IP address, user-agent, device type, login timestamps, session tokens. Used for security and abuse prevention.
Communications — emails, Telegram chat IDs (if you opt-in to notifications), support tickets.

02How we use your data

To operate your account, execute the strategies and signals you enable, and display your dashboards.
To process subscription payments and apply plan-level access controls.
To send transactional emails — trade confirmations, payment receipts, security alerts, and product updates you have opted into.
To detect, prevent and respond to abuse, fraud and security incidents.
To comply with applicable Indian law, including responses to lawful requests from SEBI, the Income Tax Department, and law-enforcement authorities.
To improve the platform through aggregated, non-identifying analytics.

03Third parties we share data with

Only when necessary for the service:

Zerodha — to authenticate your broker account and place/modify/cancel orders on your behalf.
Razorpay — to process online subscription payments.
Cloud infrastructure providers — for hosting, database and email delivery (e.g. AWS, Cloudflare). Data may be processed on infrastructure located in India and abroad.
Telegram — only if you explicitly enable Telegram notifications and connect your Telegram chat.
Legal & regulatory authorities — only when required by valid Indian legal process.

We do not sell, rent or trade your personal data to anyone for marketing purposes.

04Data retention

We retain your account, trading and payment data for as long as your account is active and for a reasonable period after closure to comply with our legal, accounting and audit obligations (typically up to 7 years for financial records, as required by Indian tax law). You can request earlier deletion subject to those obligations.

05Security

We use industry-standard safeguards including HTTPS/TLS for transport, bcrypt for password hashing, encryption at rest for broker API tokens, role-based access controls, audit logs and continuous monitoring. No system is perfectly secure, however; if we become aware of a breach affecting your personal data we will notify you and the Data Protection Board of India as required by the DPDP Act, 2023.

06Your rights under the DPDP Act

You may, at any time:

Access the personal data we hold about you.
Correct or update inaccurate or incomplete data.
Request erasure of personal data that we no longer need to retain.
Withdraw consent for any processing that was based on your consent (e.g. marketing emails, Telegram alerts).
Nominate another person to exercise these rights in the event of your death or incapacity.
File a grievance with our Grievance Officer (see Section 10) and, if unsatisfied, with the Data Protection Board of India.

07Cookies and analytics

We use first-party cookies and localStorage strictly for authentication, session management, and remembering your UI preferences (theme, font size). We do not use third-party advertising trackers. Aggregated, non-identifying usage analytics are used to improve the product.

08Children

Chakravala is not intended for, and may not be used by, anyone under 18. We do not knowingly collect personal data from minors. If you believe a minor has registered, contact us and we will delete the account.

09Changes to this Policy

We may update this Privacy Policy from time to time. Material changes will be notified to you by email and an in-app notice. The "Effective date" at the top of this page reflects the latest revision.

10Grievance Officer & contact

For any concern about your personal data, including the exercise of your DPDP Act rights, please write to our Grievance Officer at privacy@chakravala.com. We will acknowledge within 24 hours and resolve within 15 working days as required by Indian law.