Privacy Policy

ProdigiAI ("we"), Mumbai, Maharashtra, India, operates MyTradeDesk and is the Data Fiduciary for the personal data described here. This policy explains what personal data we collect, why we collect it, how we use it, and the rights you have under the Digital Personal Data Protection Act, 2023 ("DPDP Act").

1. Data we collect

• Account data: email address, display name, hashed password (or OAuth identifier), timezone.
• Trading data you enter: trades, journal entries, strategies, tags, attachments and screenshots.
• Payment data: name, email and state supplied at checkout, plus the Razorpay order and payment reference. Card / UPI / net-banking details are processed entirely by Razorpay; we never see or store them.
• Technical data: IP address, user agent, audit-log timestamps for security events.

2. Purpose of processing

• To deliver the Service, authenticate you, and prevent fraud or abuse.
• To issue payment receipts and comply with Indian tax and accounting laws.
• To provide AI-generated insights you explicitly request.
• To send transactional emails (verification, payment receipts, security alerts).

3. Legal basis

We process data on the basis of (a) your consent at sign-up; (b) the performance of our contract with you (these Terms); and (c) our legitimate interest in operating and securing the Service.

4. Sharing and processors

We share data only with the following processors, under contract:

• Cloud hosting & database — for application data and backups.
• Razorpay — to process payments and issue refunds.
• Email provider — to deliver transactional emails.
• Lovable AI Gateway — for AI insight generation you trigger.

We do not sell your personal data. We do not share it for advertising.

5. Retention

We keep each category only as long as we need it:

• Trades, journal entries, strategies and attachments — until you delete them or close your account.
• Account data — until you close your account; erased within 7 days of a deletion request.
• Payment and receipt records — 8 years, as required by Indian tax and company law. After account deletion these are retained in a minimised form (amount, date, document number and payment reference).
• Security, audit and error logs — up to 180 days, then deleted.
• Content reports — up to 3 years, to evidence how we handled a complaint.

6. Your rights under the DPDP Act

You have the right to:

• Access a copy of your personal data (Settings → Data safety → Export everything).
• Correct inaccurate data (editable from Settings).
• Erase your data (Settings → Security → Delete account).
• Withdraw consent and opt out of optional processing.
• Grievance redressal — contact our Data Protection Officer (see DPDP notice).

7. Security

Data is encrypted in transit (TLS) and at rest. Access is gated by row-level security so each user can only access their own data. Passwords are checked against the Have-I-Been-Pwned database. Optional two-factor authentication is available.

8. Cookies

We use essential cookies and browser localStorage to keep you signed in and remember UI preferences. We do not use third-party advertising cookies.

9. Public content you choose to publish

Share links, public profiles and the leaderboard are opt-in. When you enable them, the specific fields shown on those pages become visible to anyone with the link — including search engines. You can revoke a share link or turn off your public profile at any time from Settings. Anyone can report a public page for review.

10. Grievance redressal and contact

Privacy questions: support@mytradedesk.in

Varun Chatlani — Grievance Officer & Data Protection Officer
ProdigiAI, Mumbai, Maharashtra, India
Email: varun@prodigiai.org
Phone: +91 93217 27752

We acknowledge grievances within 24 hours and resolve them within 15 days. If you remain unsatisfied you may complain to the Data Protection Board of India.