Home › Legal centre › Privacy Policy
Privacy Policy
This policy explains how Tradetoday Multitrade Private Limited ("we") processes personal data when you use TradeToday Terminal (www.tradetoday.co.in). We act as the data fiduciary for this data under the Digital Personal Data Protection Act, 2023 (DPDP Act) and also follow the Information Technology Act, 2000 and rules under it, to the extent they apply.
1. Data we collect
- Account details: name, email address, mobile number, password (stored only as a salted one-way hash), sign-up date, account status and access period.
- Acceptance records: which version of our terms you accepted and when, at sign-up and at each login.
- Sign-up source: if you arrived through a link with campaign tags or from another website, the referring site and campaign tags, to understand how people find us.
- Broker connection (optional): if you connect your own broker, your Analytics Token or API key, secret and daily access token. These are encrypted with a key held on our server and are never shown again in the page.
- Two-factor login (administrators): an encrypted authenticator key and one-way hashes of backup codes.
- Paper-trading and learning data: virtual strategies, simulated orders and positions, exit rules, journal notes, tags and ratings, watchlists, price alerts, chart drawings, saved drafts, virtual capital choice, lesson and quiz progress.
- Usage data: which pages of the terminal you open and on which days you were active, and when you were last online.
- Technical data: security and error logs (sign-ins, administrator actions, errors). Our hosting provider may also record IP addresses and request details in its infrastructure logs.
2. Why we use it
- To create and manage your account, approve access and keep it secure (including two-factor login and login-attempt limits).
- To run the features you use, such as showing your own broker's prices on your screen and calculating your paper results.
- To record your acceptance of our terms and to handle grievances.
- To understand which features are useful and to improve the service (usage statistics, sign-up sources).
- To meet legal obligations and to protect the service, our members and the company.
We rely on your consent, given when you sign up and accept these terms, and on the legitimate uses permitted by the DPDP Act. You may withdraw consent at any time (see section 6); this does not affect processing already carried out.
3. What we do not do
- We do not sell or rent personal data and do not use it for advertising.
- We do not use third-party advertising or tracking cookies.
- We never use your broker connection to place, change or cancel orders, or to access funds; the platform has no order-placement function.
4. Who receives data
- Hosting provider: Render (our servers and data disk are hosted in its Singapore region). Data is therefore stored outside India, which the DPDP Act permits except to countries the Government restricts.
- Your broker (for example Upstox): when you connect it, requests for market data are sent to your broker using your own credentials.
- Coinbase: our server requests public crypto prices; no personal data is sent.
- Google Fonts: your browser may load fonts from Google, which receives your IP address under Google's own policy.
- WhatsApp (Meta): if you message us, the conversation is handled through WhatsApp under its terms.
- Authorities: where required by law, a court order or a lawful request.
5. How long we keep data
- Account and paper-trading data: while your account exists.
- Login sessions: expire after 7 days; expired sessions can be cleared by the administrator.
- Server logs: rotate automatically and are overwritten as new logs are written.
- Usage statistics: kept with your account and removed when it is deleted.
- Backups: the administrator may download backups of the data folder for disaster recovery and keeps them privately. Deleted data can remain in such backups and in the hosting provider's disk snapshots until they are deleted or expire under the provider's policy.
- See also the Data Retention and Deletion Policy.
6. Your rights
Subject to the DPDP Act, you may ask for a summary of the personal data we process about you, ask us to correct, complete or update it, ask us to erase it (we will delete your account and its paper-trading data unless we must keep something by law), withdraw consent, nominate another person to exercise your rights in case of death or incapacity, and raise a grievance. You may also remove your broker connection yourself at any time in Account. If you are not satisfied with our response, you may approach the Data Protection Board of India.
7. Security
Passwords are hashed; broker credentials and authenticator keys are encrypted; connections use HTTPS; sessions use secure, HttpOnly cookies; administrator actions are logged; and access to member data is limited to the administrator. No system is perfectly secure; see the Security Incident and Data Breach Policy.
8. Cookies and browser storage
See the Cookie Policy.
9. Children
The service is for adults only (18 years and over). We do not knowingly accept accounts from children; if we learn that a child has registered, we will delete the account.
10. Grievances and contact
Grievance Officer: Amit Kumar Jain, Director, Tradetoday Multitrade Private Limited. Contact: WhatsApp message to +91 93033 05959 (Monday to Friday, 10 AM to 6 PM (IST)). Address: Indore, Madhya Pradesh 452010, India. We aim to acknowledge a grievance within 2 working days and to resolve it within 15 days.
All legal documents · Next: Legal Disclaimer