Scope, and who is responsible
Trade Craft Technologies, Surat, Gujarat, is the Data Fiduciary for personal data processed through TradeCraft X. This policy is written against the Digital Personal Data Protection Act, 2023 and applies to the website, the customer console and everything we do with data you give us.
What we collect
| Category | What it is | Where it comes from |
|---|---|---|
| Identity | Name and email address | Google, when you sign in |
| Broker connection | API key, access token, broker name, client code | You, when you link a broker |
| Trading activity | Orders we placed for you, fills, positions, risk-limit settings | Generated in use |
| Portfolio scan | Holdings read from your demat account when you run a scan | Your broker, on your instruction |
| Subscriptions | Pools and plans you hold, term dates, invoices | Generated in use |
| Technical | IP address, device and browser, timestamps, error logs | Collected automatically |
What we never collect
We also never receive your full card number — payments are handled by a PCI-compliant gateway, and we see only the last four digits and the outcome. Anyone claiming to be from TradeCraft X and asking for any of these is not from TradeCraft X.
Why we process it
- To run the service you asked for — placing orders, enforcing your risk limits, showing your performance, running a portfolio scan.
- To bill you and to keep the tax records Indian law requires.
- To keep the platform safe — fraud prevention, abuse detection, debugging.
- To meet legal and regulatory obligations, including responding to a lawful request.
- To contact you about your account, an incident, or a change to these documents.
We do not sell personal data. We do not use your holdings or your trading activity to train models for anyone else, and we do not share them with analysts.
Who we share it with
| Recipient | What they get | Why |
|---|---|---|
| Your broker | Orders, and the token you issued | To place orders in your account |
| Payment gateway | Name, email, amount | To take payment |
| Analysts | Subscriber counts only — never your identity or holdings | To pay them and report reach |
| Infrastructure providers | Encrypted data at rest, logs | Hosting, backups, monitoring |
| Regulators, courts | Whatever is lawfully required | Legal obligation |
Every processor is bound by contract to use the data only for the purpose we specify.
Where your data lives, and for how long
Primary storage and processing are in the Mumbai region, in India. Backups stay in India.
- Account and identity — kept while the account is open, then 90 days.
- Broker tokens — deleted immediately when you revoke the connection or close the account.
- Orders, fills and invoices — retained 8 years, as Indian tax and record-keeping rules require, even after you close the account.
- Portfolio scan results — 12 months, or until you delete them.
- Technical logs — 180 days.
How we protect it
Encryption in transit and at rest; broker tokens held in a dedicated secret store, not the application database; access limited to named operators; audit logging on every administrative action. No system is perfectly secure, and we will not pretend otherwise — but if a breach affects you, we will tell you and the Data Protection Board of India as the DPDP Act requires.
Your rights
You can ask what we hold, correct it, have it deleted, and nominate someone to act for you. Write to the Grievance Officer and we have 30 days.
- Access — a summary of the personal data we hold and who we shared it with.
- Correction — fix anything inaccurate, complete anything missing.
- Erasure — deletion, except records we are legally required to retain.
- Nomination — name someone to exercise these rights if you die or become incapacitated.
- Withdraw consent — at any time, for anything not necessary to run the service.
- Grievance — a complaint to our Grievance Officer, and onward to the Data Protection Board of India if you are not satisfied.
Requests go to grievance@tradecraftx.com. We acknowledge within 24 hours and respond within 30 days.
Cookies and local storage
We use a session cookie to keep you signed in, and browser local storage to remember your theme and interface preferences. We do not run third-party advertising or cross-site tracking, so there is no consent banner to dismiss.
Children
The platform is not available to anyone under 18, and we do not knowingly process a child’s personal data. If you believe we have, tell us and we will delete it.
Changes to this policy
Material changes are notified by email and shown in the console at least 14 days before they take effect. The version and effective date at the top of this page tell you which version applies.
Grievance Officer
Under the DPDP Act and the IT Rules, our designated officer is Priya Nandwani, reachable at grievance@tradecraftx.com or +91 261 200 0001, at Trade Craft Technologies, Surat, Gujarat. The full escalation path, with turnaround times, is published on the contact page.
Questions about this document
Write to us before you agree to something you are unsure about. We would rather answer a question now than argue about a clause later.
- Entity
- Trade Craft Technologies, Surat, Gujarat
- legal@tradecraftx.com
- Grievance Officer
- Priya Nandwani · grievance@tradecraftx.com