Privacy Policy

1. Information We Collect

Account Information: Name, email address, phone number, PAN (last 4 digits for verification only), and password (hashed, never stored in plain text).

Broker Credentials: API keys and access tokens you provide to connect your broker accounts. These are encrypted at rest using AES-256-GCM and are never transmitted to third parties.

Usage Data: Pages visited, features used, click patterns, session duration — collected via anonymised analytics to improve the Platform.

Trading Data: Portfolio values, watchlist symbols, order history pulled from your broker APIs — stored securely to power portfolio tracking features.

Device & Technical Data: IP address, browser type, operating system — collected for security and fraud prevention.

2. How We Use Your Information

• To provide and maintain the Platform
• To authenticate your account securely
• To connect to your broker accounts on your behalf
• To generate AI-powered insights and personalised content
• To send you product updates and support communications (opt-out available)
• To detect and prevent fraud and abuse

3. Data Storage and Security

• All data is stored on servers within India (AWS ap-south-1, Mumbai)
• Broker API keys are encrypted with AES-256-GCM before storage
• Passwords are hashed with bcrypt (cost factor 12)
• Database access is restricted to application servers only
• We perform regular security audits

4. Data Sharing

We do not sell your personal data. We share data only with:

• Your Brokers: To route orders and fetch portfolio data on your behalf
• Service Providers: AWS (hosting), Supabase (database), Upstash (rate limiting) — all under data processing agreements
• Regulators: If required by SEBI, RBI, IRDAI or other Indian regulators under applicable law

5. Cookies and Tracking

We use strictly necessary cookies for authentication. We do not use third-party advertising cookies. Analytics are privacy-preserving and do not include personally identifiable information.

6. Your Rights

You have the right to:

• Access your personal data held by us
• Correct inaccurate personal data
• Delete your account and associated data
• Export your data in machine-readable format
• Opt out of non-essential communications

To exercise these rights: support@atomtrade.in

7. Data Retention

• Account data: retained for duration of account + 3 years post-deletion (regulatory requirement)
• Broker tokens: deleted immediately on account deletion or broker disconnection
• Analytics data: retained in anonymised form for 24 months

8. Children's Privacy

Atom Trade is not directed at persons under 18. We do not knowingly collect data from minors. If you believe a minor has registered, contact legal@atomtrade.in.

9. Changes to This Policy

We will notify registered users by email of material changes to this policy at least 14 days before they take effect.

10. Contact

Data Privacy Officer: legal@atomtrade.in