Privacy Policy

1. Introduction

TradeLossMD ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our trading analysis platform.

2. Information We Collect

2.1 Personal Information

When you register for an account, we collect:

• Email address (required for account creation)
• Full name (optional)
• Password (encrypted and never stored in plain text)

2.2 Trading Data

When you upload your tradebook, we collect and process:

• Trade details (symbol, date, time, quantity, price)
• P&L information
• Broker transaction data (from CSV/Excel uploads)

2.3 Automatically Collected Information

• IP address and browser type
• Login timestamps and access logs
• Device information (for security)

3. How We Use Your Information

We use your information to:

• Provide Services: Analyze your trading data and generate behavioral insights
• Account Management: Manage your subscription and authentication
• Communication: Send you service updates, reports, and support responses
• Platform Improvement: Use aggregated, anonymized data to improve our algorithms
• Security: Detect and prevent fraud, abuse, and security incidents

4. Data Storage and Security

4.1 Where We Store Data

Your data is stored on secure servers. We use industry-standard PostgreSQL databases with encryption at rest. All API communications use HTTPS/TLS encryption.

4.2 Security Measures

• JWT-based authentication with secure token expiration
• Password hashing using industry-standard algorithms
• Regular security audits and vulnerability assessments
• Access controls and role-based permissions

5. Data Sharing and Disclosure

5.1 We DO NOT Sell Your Data

We do not sell, rent, or trade your personal information or trading data to third parties for marketing purposes.

5.2 When We May Share Data

• Service Providers: Third-party services that help us operate the platform (e.g., payment processors like Razorpay)
• Legal Compliance: When required by law or to respond to legal process
• Business Transfers: In the event of a merger, acquisition, or sale of assets
• With Your Consent: When you explicitly authorize data sharing

5.3 Anonymized Data

We may use and share aggregated, anonymized data that cannot identify you personally for:

• Platform analytics and improvement
• Research and development
• Peer benchmarking features (e.g., "Top 10% traders win 42% of trades")

6. Your Rights and Choices

6.1 Access and Correction

You can access and update your account information from the Account page at any time.

6.2 Data Deletion

You have the right to request deletion of your account and data. To delete your account:

• Email us at [email protected] with subject "Account Deletion Request"
• Include your registered email address
• We will process the request within 30 days

Note: Some data may be retained for legal compliance or legitimate business purposes (e.g., transaction records, backups).

6.3 Marketing Communications

You can opt out of marketing emails by clicking the "unsubscribe" link in any promotional email. We will still send you essential service communications (e.g., account notifications, security alerts).

7. Cookies and Tracking

We use cookies and similar technologies to:

• Essential Cookies: Required for authentication and core functionality
• Analytics: Understand how you use the platform (anonymized)

You can control cookies through your browser settings, but disabling essential cookies may affect platform functionality.

8. Data Retention

We retain your data for as long as your account is active or as needed to provide services. After account deletion, we may retain certain information for:

• Legal compliance (e.g., tax records for 7 years)
• Dispute resolution
• Fraud prevention

9. Children's Privacy

TradeLossMD is not intended for users under the age of 18. We do not knowingly collect information from children. If you believe a child has provided us with personal information, please contact us immediately.

10. International Users

If you are accessing TradeLossMD from outside India, please note that your information may be transferred to, stored, and processed in India. By using our platform, you consent to this transfer.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by:

• Posting the updated policy on this page
• Updating the "Last updated" date
• Sending you an email notification (for significant changes)

12. Contact Us

If you have questions about this Privacy Policy or our data practices, contact us at:

13. Your California Privacy Rights (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA), including the right to request disclosure of information we collect and share, and the right to request deletion of your personal information. Contact us to exercise these rights.

14. GDPR Compliance (EU Users)

If you are in the European Economic Area (EEA), you have rights under the General Data Protection Regulation (GDPR), including:

• Right to access your personal data
• Right to rectification of inaccurate data
• Right to erasure ("right to be forgotten")
• Right to restrict processing
• Right to data portability
• Right to object to processing

To exercise these rights, contact us at [email protected].

15. DPDPA Compliance (Indian Users)

TradeLossMD is committed to compliance with the Digital Personal Data Protection Act, 2023 (DPDPA) enacted by the Government of India. Under the DPDPA, you have the following rights as a Data Principal:

• Right to Access: You may request a summary of your personal data being processed and the processing activities undertaken
• Right to Correction and Erasure: You may request correction of inaccurate or misleading data, and completion of incomplete data. You may also request erasure of personal data that is no longer necessary for the purpose it was collected
• Right to Grievance Redressal: You may raise grievances regarding the processing of your personal data. We will address your grievance within 30 days
• Right to Nominate: You may nominate another individual to exercise your rights in case of death or incapacity
• Right to Withdraw Consent: Where processing is based on your consent, you may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing before withdrawal

Data Fiduciary Information:

To exercise any of these rights, email us at [email protected] with the subject line "DPDPA Rights Request". We will respond within 30 days as mandated by the Act.