Privacy Policy

This Privacy Policy describes how PAI (paitrade.in), operated by the PAI Trade team (based in India), collects, uses, and protects your information when you use our subscription analytics platform.

We follow a data-minimisation principle: we collect only what we need to deliver the Service. We do not sell your data and we do not run third-party advertising on PAI.

1. What we collect

You provide directly

• Email address — for account identification, login, and transactional emails (verification, password resets, billing receipts).
• Password — stored only as an Argon2 hash; we never see your plaintext password.
• Subscription preferences — your tier (Free / Pro / Elite) and current period.
• Optional: first name, last name (if you set these). We do not require them.

Automatically collected

• Authentication session cookie — to keep you signed in.
• CSRF token cookie — to prevent cross-site request forgery on form submissions.
• Server access logs — IP address, user-agent, URL, and timestamp of each request, retained for up to 30 days for security and debugging.
• Email confirmation state — whether your address has been verified.

From payment processors

• Razorpay payment metadata — payment ID, order ID, amount, status, and method (UPI/card/netbanking). We do NOT collect or store card numbers, CVVs, UPI handles, or bank-account information; all sensitive payment data is handled directly by Razorpay under PCI DSS compliance.

2. What we explicitly do NOT collect

• Broker credentials (Free / Pro tiers) — never collected or stored. Broker credentials are only collected from Elite subscribers who opt to use the PAI execution panel; in that case they are encrypted at rest with a key separate from the application secret, and decrypted only in memory at the moment you authorise an order. See Disclaimer and Terms for the full credential-handling scope.
• Portfolio holdings — we don't see what you own across your trading account.
• Order history outside PAI — orders you place directly in your broker's own app or web portal are not observed by PAI; only orders initiated through the PAI execution panel are recorded.
• PAN, Aadhaar, bank account, or KYC documents — we don't require these.
• Phone numbers, address — not collected unless you voluntarily provide them in an email to us.
• Browser fingerprints or third-party analytics cookies — none currently deployed.

3. How we use your data

• Account management — let you log in, see your tier, manage your subscription.
• Transactional email — sign-up verification, password reset, billing receipts, expiry warnings.
• Service delivery — show you tier-appropriate analytics in the dashboard.
• Security — detect abuse (e.g., excessive failed logins, scraping) and protect the platform.
• Compliance — respond to lawful requests from courts, regulators, or law enforcement under Indian law.

We do not use your data for advertising, profiling for third-party marketing, or training third-party AI models.

4. Third parties we use

Razorpay	Payment processing. razorpay.com/privacy/
Cloudflare	DNS, HTTPS termination, DDoS protection. cloudflare.com/privacypolicy/
Gmail (Google)	Outgoing transactional email delivery. policies.google.com/privacy

Each third party handles data per its own privacy policy. We share only the minimum information necessary (email address for delivery; payment metadata for processing). We do not sell your data to any party.

5. Where your data lives

• Origin server: physically located in India
• HTTPS edge: terminated at Cloudflare's Mumbai (BOM) data centre
• Backups: stored encrypted on the same Indian server

We aim to keep data in India. Cloudflare may proxy traffic via other global edges based on routing, but origin storage is India-only.

6. How long we keep it

• Account data: retained while your account is active and for up to 12 months after deletion (for tax and dispute records).
• Server access logs: up to 30 days, then automatically purged.
• Payment records: retained for 7 years per Indian Income Tax / GST rules.
• Email delivery logs: up to 90 days at the SMTP provider.

7. Your rights

You may, at any time:

• Access — request a copy of the personal data we hold about you
• Correct — update your email or other profile details from your account page
• Delete — request full account deletion (data anonymised; payment records retained for tax compliance)
• Withdraw consent — stop using PAI; we'll suspend all data processing within 30 days
• Object — to any specific use of your data; we'll address within 30 days

To exercise any of these rights, email [email protected] from your registered email address.

8. Security

• Passwords stored as Argon2 hashes (not reversible).
• All traffic transmitted over TLS 1.2+ (HTTPS).
• Session cookies marked Secure + HttpOnly.
• CSRF protection on all form submissions.
• Rate-limiting on login attempts (5 failures / 5 min).
• HMAC-SHA256 verification on payment webhooks.

No system is ever 100% secure. If you suspect a breach, email us immediately. We will notify affected users within 72 hours of confirming a personal-data breach, per Indian Digital Personal Data Protection Act, 2023.

9. Children

PAI is intended for users 18 years and older. We do not knowingly collect data from minors. If you believe we have such data, email us and we will delete it.

10. Cookies

We use only essential cookies for authentication and security:

• sessionid — your login session
• csrftoken — anti-forgery token

No tracking cookies, no advertising cookies, no third-party analytics cookies are set by PAI. Cloudflare may set its own bot-protection cookies on edge requests — see their privacy policy.

11. Changes

We may update this Privacy Policy. Material changes will be emailed to your registered address. Continued use of the Service after the effective date of an update constitutes acceptance.

12. Grievance Officer (under IT Act 2000 + DPDP Act 2023)

• Designation: PAI Trade — Grievance Officer
• Email: [email protected]
• Response window: 7 working days

13. Contact

Email [email protected] for any privacy-related questions.