Legal

Privacy Policy

Version 2026-10-04 · last updated 4 October 2026

This explains exactly what TradeMann ("we", "TradeMann") collects about you, why, who else sees it, how long we keep it and what you can do about it. It is written to follow India's Digital Personal Data Protection Act, 2023 and the IT Act, 2000. If something here is unclear, ask us - contact details are at the end.

1. Who we are

TradeMann is a web platform that lets you build rule-based trading strategies, test them on a simulated (paper) account and, on a paid plan, run them against your own broker account. The data controller (the "Data Fiduciary" under the DPDP Act) is TradeMann.

This policy applies to everyone who creates an account or signs in. By accepting it you agree to the processing described here.

2. What we collect

Data	What exactly	Where it comes from	Why
Account	Name, email address, a hashed (Argon2) password - we never store the password itself.	You, at sign-up	To create and secure your account and send service messages.
Mobile number	The mobile number registered on your broker account (see section 3).	Your broker, when you connect it	To identify and contact you, support, and prevent duplicate/referral abuse.
Broker credentials	Whatever your broker needs: API key and secret, client code, MPIN, TOTP secret, login id and password, and the daily access token.	You, on the Brokers page; your broker for tokens	To log in to your broker and trade on your instructions (section 4).
Broker account data	Positions, funds and margin, orders, instrument lists and market prices read through your broker connection.	Your broker	To run your strategies and show your portfolio.
Strategy and trading data	Strategy rules, deployments, every order placed (symbol, buy/sell, quantity, price, time, outcome, profit/loss), equity history and the indicator readings behind each decision.	You and the trading engine	To run strategies, keep your records and show analytics.
Plan and payment	Plan, renewal date, referral points, and Razorpay order/payment identifiers and status. We do not receive or store your card, UPI or bank details - Razorpay handles those.	You, Razorpay	To provide the plan, issue invoices and prevent double-charging.
Invoices	The name, email and plan on each tax invoice we email you.	Your account	Legal and accounting obligations.
Referrals	Your referral code, who referred you (if anyone), people you referred and the reward points earned.	You and the referral link	To run the referral programme.
Support	Tickets and messages you send, the strategy or broker connection you link to a ticket and, only if you tick the box, a snapshot of live indicator/candle readings.	You	To help you and resolve problems.
Dedicated IP	If you enable live trading: the IP address and technical details of the server created for you (section 6).	Our hosting provider, when it is created	So your broker sees one fixed address that belongs to you.
Consent record	The version of these documents you accepted, when, and the IP address you accepted from.	Your browser	Proof that you gave consent.
Sign-in and security	Last sign-in time; one-time sign-in codes (sent to your email, held only as a hash and expiring within minutes); session information.	Your browser, our servers	Security and to count active accounts.
Usage	Which pages are viewed (the page type only, not full addresses with personal values), your account id if you were signed in, and a random visitor id (section 7). No IP address or device/browser details are stored in this count.	Your browser	To understand traffic and improve the product.
Technical logs	Standard server and hosting logs: IP address, time, request, errors.	Our servers and hosting provider	Security, debugging and keeping the service running.

We do not collect your contacts, location, photos, microphone, camera, device identifiers, Aadhaar, PAN or bank-account numbers, and we do not use advertising or cross-site tracking.

3. Your mobile number from your broker

We fetch the mobile number linked to your broker account. You do not type it in - it is read automatically when you connect a live broker, and by accepting this policy you consent to that.

Angel One: we read the registered mobile number from your Angel One profile, which Angel One returns when we log in with your credentials.
m.Stock: your m.Stock login id is your registered mobile number, so we take it from the login id you entered.
Zerodha, Upstox and Groww: these brokers do not give us a mobile number, so nothing is fetched and your profile number stays empty.
Paper trading is not a real broker account, so no mobile number is read for it. It may still use market prices from your connected live broker, if you have one - see section 10.

What we do with it

Save it on your profile (only the last 10 digits are kept) and show it to you there.
Use it to identify you, to contact you about your account or support tickets, and as a signal to catch one person opening several accounts to claim referral rewards more than once.
Let our administrators see it and search accounts by it.

What we do not do

We do not sell it, rent it, share it for marketing, or send marketing SMS/calls with it.
We do not use it to log in or as a password.

It is read again each time you reconnect, so it follows whatever your broker has on file. To remove it, ask us (section 13). You can withdraw consent to this at any time by removing your broker connection and writing to us; the number is then deleted unless the law requires us to keep it.

4. Broker credentials and access

Credentials you enter on the Brokers page are stored encrypted at rest (Fernet/AES) using a secret key that is kept outside the database. They are never displayed back to you or to staff in readable form.
They are decrypted in memory only to log in to your broker, read your positions, funds and prices, and place the orders your own strategies generate. We cannot and do not move money, withdraw funds or change your broker account settings.
Daily access tokens (m.Stock, Zerodha, Upstox, Groww) expire at the broker's cut-off and you are asked to sign in again.
When you remove a broker connection, its stored credentials are deleted.
Use a broker API key with only the permissions you need, and rotate it if you suspect it was exposed.

5. Your trading data

We keep your strategies, deployments, orders, positions, equity history and indicator readings so your strategies can run, so you can review them, and so we can investigate a problem you report. They are linked to your account and visible to you and to our administrators (for support and operations). Aggregate figures such as total users, plans and strategy counts are shown to administrators without trading detail.

Orders you place through a live broker are, of course, also held by that broker under its own terms and privacy policy.

6. Your dedicated IP address

Brokers will only accept orders from an IP address you have approved. When you press Enable live trading on a plan that allows it, we create a small dedicated server for you with our hosting provider. We store its IP address and technical identifiers against your account and show you the address to approve at your broker.

All traffic your broker connection makes (login, orders, positions, funds, prices) is relayed through that server so the broker sees only that address.
The server only forwards encrypted (HTTPS) traffic; it does not keep your credentials, orders or any content. It is locked so only our own servers can use it.
Our administrators may delete it when it is no longer needed - for example when your account is closed, your plan no longer allows live trading, or no live broker has been connected for a while. You would then need to enable live trading again and approve a new address.

7. Cookies and similar technology

Name	Purpose	Lasts
`session`	Keeps you signed in and protects forms (CSRF). Strictly necessary.	Your visit (longer if you tick "Keep me signed in")
`remember_token`	Only if you tick "Keep me signed in".	Until you sign out or it expires
`tm_vid`	A random id used to count unique visitors and page views. It is stored on our side only after being scrambled with a server secret and carries no IP address or device information.	Up to about a year

We do not use advertising cookies, analytics from third parties or social-media trackers. Your browser may, however, contact third parties to display the site: web fonts (fonts.googleapis.com, onlinewebfonts.com) and, on payment pages, Razorpay's checkout script. They can see your IP address and browser as any website you load would; their own policies apply. You can block cookies in your browser, but sign-in will not work without the session cookie.

8. How we use your data

To create your account, sign you in and keep it secure.
To run your strategies and place the orders they generate through your broker.
To provide your plan, take payment, issue invoices and send renewal reminders.
To send service emails: sign-in codes, a welcome message, invoices, renewal reminders, support replies. We do not send marketing email.
To give support, fix bugs and investigate suspected misuse or fraud.
To run the referral programme and detect duplicate accounts.
To measure usage and capacity so the service stays fast.
To meet legal, tax and regulatory duties and respond to lawful requests.

We do not make decisions about you by profiling, and we never sell personal data.

10. Who we share data with

Only with the services needed to run TradeMann, under their own obligations, and only the data they need:

Who	What for	What they receive
Your broker (Angel One, m.Stock, Zerodha, Upstox, Groww)	Executing your orders and reading your account	Your credentials, orders and requests - the same as if you had used their app or API yourself
Our hosting provider	Hosting: servers, database, Redis, and your dedicated-IP server	All data we hold, stored on their infrastructure (hosted in India)
Razorpay	Payments	Your name, email and the plan/amount; you give card/UPI details directly to Razorpay
Email provider	Delivering our emails	Your email address and the message
Market-data sources	Prices and candles to run strategies and show charts	Instrument symbols and price requests only - never personal data

The only external source of market data is your own connected broker. For a live strategy, and for a paper strategy too if you have a live broker connected, prices and candles come from that connected broker's own feed - the same data your broker's own app would show you. If you have no live broker connected, or its feed does not answer, we show a simulated feed generated by our own systems - nothing is fetched from any other outside party, and no third party receives your symbol searches or price requests besides your own connected broker. Whichever source is used, only the instrument symbol and the price request itself are sent to your broker - never your name, account, broker credentials or any other personal data.

We may also disclose data if the law or a court, regulator or exchange requires it, to protect our rights or users' safety, or as part of a merger or sale of the business (you would be told). Some of these providers may process data outside India.

11. How long we keep it

Broker credentials: until you remove the connection.
Account, trading, referral and support data: while your account is open, and afterwards for as long as needed to resolve disputes, prevent fraud and meet legal duties.
Invoices and payment records: for as long as tax and accounting law requires.
Technical logs: a limited period, then rotated out.
Dedicated-IP server: until an administrator deletes it.

When we no longer need data and the law does not require us to keep it, we delete or anonymise it.

12. How we protect it

Passwords are hashed with Argon2; broker credentials are encrypted at rest; traffic uses HTTPS.
Sign-in uses a one-time code emailed to you; forms are protected against cross-site request forgery.
Access to this information inside TradeMann is limited to the owner's staff.
Your dedicated-IP server accepts connections only from our own servers and requires a password.

No system is perfectly secure. If a personal-data breach affects you we will tell you and the authorities as the law requires. Keep your own password, email, phone and broker accounts secure.

13. Your rights

Under the DPDP Act you can:

Access a summary of the personal data we hold about you and how it is used;
Correct or update inaccurate data (your name can be edited in your profile; the mobile number follows your broker - change it there and reconnect);
Erase your data and close your account, subject to records we must legally keep;
Withdraw consent at any time, with the effect described in section 9;
Grievance redressal - complain to us first, and then to the Data Protection Board of India if you are not satisfied;
Nominate another person to exercise these rights if you die or become incapacitated.

To use any of them, raise a ticket from Support in the app or write to siddhantparik10@gmail.com. We may need to confirm it is you, and we aim to respond within 30 days.

14. Children

TradeMann is for people aged 18 or over. We do not knowingly collect data from anyone younger; if we learn we have, we will delete it.

15. Changes to this policy

When this policy or the Terms & Conditions change in a way that matters, we change the version number at the top and ask every user to review and accept again the next time they sign in. Old versions are not shown, but the version and time of each user's acceptance are kept.

16. Contact and grievances

TradeMann

Grievance Officer
Email: siddhantparik10@gmail.com