Privacy Policy

1. Scope

This Policy applies to all users of the StoXify investor app, the StoXify Analyst dashboard, and stoxify.in. It does not apply to third-party websites or services linked from the Platform, including any Analyst's external channels (e.g. Telegram), which are governed by their own privacy practices.

2. Information We Collect

2.1 Information you provide directly

• Account information: name, email address, phone number, password (stored as a salted hash, never in plain text)
• KYC information: Aadhaar-linked identity data obtained via DigiLocker, submitted only when you choose to unlock trade-alert delivery
• Analyst professional information: SEBI Research Analyst registration number, registration certificate, specialization, experience
• Payment information: processed directly by Razorpay/RazorpayX; StoXify does not store your card, UPI or bank credentials
• Communications: messages you send to support, grievance submissions, survey responses

2.2 Information collected automatically

• Device information: device ID, device type, OS version, app version, IP address
• Usage data: screens viewed, trades viewed, subscription and interaction history, session duration
• Security metadata: request signatures, timestamps and nonces used to authenticate app requests (see Section 6)
• Push notification tokens (Firebase Cloud Messaging) for delivering trade alerts

2.3 Information we do not collect

StoXify does not collect your trading account credentials, demat account passwords, or brokerage login details. StoXify does not itself execute trades on your behalf.

3. How We Use Your Information

• To create and manage your account and verify your identity
• To deliver trade alerts and Analyst communications you have subscribed to
• To process subscription payments and manage billing cycles
• To gate trade-alert delivery behind KYC as required for regulatory traceability (KYC is not required to browse, subscribe to, or pay for a plan - only to receive alert delivery)
• To detect and prevent fraud, unauthorised access, and abuse of the Platform
• To comply with SEBI regulations, PaRRVA verification requirements, and applicable law
• To send service updates, renewal reminders, and (where you have opted in) product communications
• To improve Platform performance and reliability

4. How We Share Your Information

We share information only as necessary to operate the Platform, and never sell personal information to third parties.

4.1 With Analysts

An Analyst you subscribe to receives only the minimum information necessary to identify you as a valid subscriber (e.g. subscriber count, aggregate engagement). Analysts do not receive your KYC documents, payment details, or contact information unless you separately and explicitly choose to share them.

4.2 With service providers

We share data with vendors strictly to operate the Platform, under contractual confidentiality obligations:

• Razorpay / RazorpayX - payment processing and payouts
• Firebase (FCM) - push notifications

4.3 Regulatory and legal disclosure

We may disclose information to SEBI, NSE, CareEdge (as the PaRRVA verification agency), law enforcement, or courts where required by law, regulation, or a valid legal process.

4.4 Business transfers

If StoXify is involved in a merger, acquisition, or sale of assets, user information may be transferred as part of that transaction, subject to equivalent privacy protections.

5. Data Retention

We retain personal data for as long as your account is active and as required to comply with legal, regulatory, accounting, or reporting obligations. KYC records and transaction data relevant to SEBI/PaRRVA compliance are retained for the periods mandated by applicable regulation. You may request deletion of your account data, subject to these regulatory retention requirements (see Section 7).

6. Data Security

We apply industry-standard safeguards, including:

• TLS 1.3 encryption for all data in transit
• Encryption at rest for sensitive fields (KYC data, license numbers)
• Role-based access control (RBAC) restricting internal access on a need-to-know basis
• Cryptographically signed API requests (ECDSA) and short-lived, revocable session tokens (JWT RS256)
• Continuous security logging and anomaly monitoring

No system is completely secure. If we become aware of a data breach materially affecting your personal information, we will notify you and the appropriate regulator as required by law.

7. Your Rights

Subject to applicable law, you may:

• Access and request a copy of the personal data we hold about you
• Request correction of inaccurate or incomplete data
• Request deletion of your account and associated personal data, subject to regulatory retention requirements
• Withdraw consent for non-essential communications at any time
• Raise a grievance with our Grievance Officer (Section 11)

8. Cookies and Tracking

The StoXify website and web-based dashboards use cookies and similar technologies to keep you signed in, remember preferences, and understand aggregate usage patterns. Full detail on the categories of cookies we use, their purpose, and how to control them is set out in our separate Cookie Policy.

9. Children's Privacy

The Platform is not directed at, and must not be used by, individuals under 18 years of age. We do not knowingly collect personal information from minors. If we learn that we have collected data from a minor, we will delete it promptly.

10. Changes to This Policy

We may update this Policy from time to time to reflect changes in our practices or legal requirements. Material changes will be notified via the Platform or email, with the "Last Updated" date revised accordingly. Continued use of the Platform after such changes constitutes acceptance.

11. Grievance Officer & Contact

For privacy-related queries, complaints, or data requests, please contact:

Grievance :

We aim to acknowledge grievances within 48 hours and resolve them within 30 days, consistent with applicable Indian data protection and SEBI grievance-redressal timelines.

12. Governing Law

This Policy is governed by the laws of India. Any disputes arising in connection with this Policy shall be subject to the exclusive jurisdiction of the courts at Ghaziabad, Uttar Pradesh.