Privacy notice
Version 1 · effective 17 October 2026
Draft for review by your compliance or legal adviser before UPXALE opens to the public.
UPXALE is a trading information app. This notice explains what personal data we collect, why, how long we keep it and what you can do about it, under India's Digital Personal Data Protection Act, 2023.
What we collect
| Data | Why we need it |
|---|---|
| Your name and mobile number | To create your account, let you sign in, and contact you about it. |
| Your password | To sign you in. We store only a one-way scrambled form (a hash); nobody, including us, can read your password. |
| Sign-in records: date, time and internet address | To keep your account safe and spot misuse. |
| Alert settings and a device token, if you turn on alerts | To send trade alerts to your phone. |
| Complaint details you send us (name, mobile, optional email, what happened) | To resolve your complaint and keep the records the regulator requires. |
| Basic app settings, such as theme | Kept on your own phone, not on our server. |
We do not collect your bank, card, PAN or Aadhaar details. You never give UPXALE a trading password.
How we use it
- Only to run UPXALE for you: your account, sign-in, security and alerts.
- We never sell or rent your data, and we do not use it for advertising.
- We share it only with the services that run the app: our hosting provider (servers in India) and the phone's own push service (Google or Apple) for alerts. They may use it only to provide that service.
- We disclose data to authorities only when the law requires it.
How long we keep it
- Your account data: until you delete your account.
- Sign-in and security records: up to 1 year.
- Backups: kept up to 60 days, then deleted. A deleted account disappears from backups within that time.
- Records of trade calls published in the app contain no personal data and are kept as required by regulation.
Your rights
- See your data: in the app, ⚙ → Your data → Download my data.
- Correct it: contact us below.
- Delete it: ⚙ → Your data → Delete my account. Your account and personal data are removed at once.
- Withdraw consent: deleting your account withdraws it. Turning off alerts stops the device token being used.
- Complain: use the complaints page first; if you're not satisfied you may approach the Data Protection Board of India.
Security
Data is sent only over encrypted connections, passwords are hashed, and access to the server is limited and logged. No system is perfectly secure; if a breach affects you, we will tell you and the authorities as the law requires.
Contact
For any privacy question or request: the support contact shown in the app (being set up)
We may update this notice. If we make a material change, we will tell you in the app before it applies.