Last updated: September 2026 · Drafted with India's DPDP Act, 2023 in mind
What we collect, and why
Account data — email and a salted password hash (PBKDF2). Used to operate your login.
Broker access tokens — the daily OAuth token your broker issues after you log in on the
broker's own page. Stored encrypted (AES-256-GCM). Used exclusively to read positions/orders
and to fire kill-switch actions you configured. We never see or store your broker password
or PIN.
Trading telemetry — P&L numbers, order counts, and position/order metadata fetched
from your broker while monitoring is active, plus an audit log of every action the engine took.
Used to enforce your rules and show you what happened.
Payment data — handled entirely by Razorpay. We store only the order/payment identifiers
and plan purchased. Card/UPI details never touch our servers.
What we never do
No selling or sharing of personal data with advertisers or data brokers.
No placing of entry orders; API access is used for monitoring, cancellation, and square-off only.
No storage of broker passwords, PINs, TOTP secrets, card numbers, or UPI handles.
Retention & deletion
Broker tokens expire daily by SEBI norms and become useless after expiry; encrypted token blobs
are overwritten on every re-login. Audit logs are retained to provide your session history and for
dispute resolution. You may request deletion of your account and associated data at any time via
the support email; we delete within 30 days except records we must keep for legal/tax reasons
(e.g., payment records).
Security
Tokens are encrypted at rest, passwords are hashed, transport is TLS in production, and access
to production systems is limited to the operator. No system is perfectly secure; we notify affected
users of any breach as required by law.
Third parties
Your broker (Fyers/Upstox) — receives the API calls needed to monitor and protect your account.
Razorpay — processes payments under their own privacy policy.
Email provider — delivers verification codes and safety alerts to your address.
Your rights
You may access, correct, or erase your personal data, withdraw consent (which disables the
Service), and complain to the Data Protection Board of India. Email
info@kaatdo.com for any request.