Privacy Policy
Last updated and effective: 25 September 2026
1. Operator and scope
IndiaPulse is currently a personally operated Indian equity-research and analytics service. IndiaPulse is the data fiduciary for personal data handled through the website and associated applications. Questions and grievances can be sent to [email protected].
2. Data we collect
- Account details: name, email, password hash, role, profile picture, and Google OAuth identifier where used.
- Consent evidence: accepted legal-document versions, method, and timestamp.
- Workspace data: research layouts and selected tickers, watchlists, portfolios, holdings, journal notes, paper-trade plans, saved screens, alerts, calendar preferences, and delivery history.
- Feedback data: category, message, optional rating and page context, review status, and any versioned public-display permission and attribution choice. An access-problem report can include an optional reply email but is never eligible for public display.
- Security and operations data: IP address, user agent, request identifiers, timestamps, error events, and authentication-attempt counters.
- First-party operational analytics: a random browser identifier, its one-way hash, normalized page path, page-view time, recent heartbeat time, and fixed research-action type. For signed-in sessions, an account identifier is attached so administrators can distinguish active accounts from anonymous browsers; entered searches, holdings, notes, IP addresses, and user agents are not stored in these analytics records.
- Optional mobile data: an Apple push token only after push permission is granted.
We do not request broker, demat, bank passwords, trading PINs, or OTPs. Do not enter them anywhere on the Platform.
3. Why we use it
We process personal data only to:
- create and secure accounts, authenticate sessions, and prevent abuse;
- provide saved research, portfolios, paper trades, alerts, and requested communications;
- operate, diagnose, measure, and improve reliability and accessibility;
- review suggestions and corrections, track their resolution, and display a faithful feedback excerpt only when the submitting user explicitly permits it;
- respond to support, privacy, security, and legal requests; and
- meet applicable legal, regulatory, tax, and security obligations.
IndiaPulse does not sell personal data and does not use third-party advertising or behavioural-tracking cookies.
4. Hosting and processors
Primary production services and the production database run in cloud infrastructure located in India, currently Oracle Cloud in Mumbai. Google Cloud may retain restricted legacy, backup, or disaster-recovery workloads. Google and Oracle process infrastructure data under their service terms. Google also processes data when you choose Google OAuth; Apple processes push-token delivery when you enable mobile notifications.
We do not intentionally transfer account or portfolio data outside India. A provider may process limited support or security metadata according to its own global operations and contractual safeguards.
6. Retention
- Account and workspace data remain while the account is active and are erased when account deletion completes, subject to required exceptions.
- Feedback remains until you delete it, delete the account, or ask for erasure. Withdrawing public-display permission removes the testimonial from future public responses while retaining the private submission unless you delete it.
- Consent evidence and records needed to establish legal compliance may be retained after deletion for the applicable limitation period.
- Cybersecurity and access logs are retained for at least 180 days in India where CERT-In directions apply. Selected security evidence may be retained for up to one year or longer where law or an active investigation requires it.
- Backups follow provider rotation schedules. Deleted records can remain in protected backups until those backups expire and are not restored except for disaster recovery.
- OAuth flow cookies expire after 10 minutes; expired rate-limit records are periodically removed.
- Operational page-view records are retained for 35 days; inactive browser-presence rows are removed after one day.
- Fixed-vocabulary research-action records are retained for 90 days.
7. Your choices and rights
Signed-in users can export a machine-readable copy of their account and workspace data or permanently delete their account from Account settings. Feedback and its public-display permission can be managed separately from the feedback workspace. You may also ask us to provide access, correct inaccurate data, erase data, withdraw optional communications, or resolve a grievance by emailing the address below.
Withdrawal does not invalidate processing already performed and may prevent us from providing features that require the data. We may verify identity before fulfilling a request and may retain information where law requires it.
8. Security and incidents
Controls include encryption in transit and at rest, HTTP-only session cookies, bcrypt password hashing, least-privilege service identities, authentication throttling, restricted administrative access, backups, and security logging. No system is completely secure, and IndiaPulse has not claimed SOC 2 or ISO 27001 certification.
We will investigate suspected personal-data breaches and notify affected users and competent authorities when and as applicable law requires. Report security concerns under the Security Policy.
9. Children
IndiaPulse is for users aged 18 or older. We do not knowingly create accounts for children. Contact us if you believe a child supplied personal data so we can investigate and delete it where required.
10. Policy changes
We may update this policy when products, providers, or law change. Material changes will be presented in the Platform or by email where practicable. If renewed consent is required, the Platform will request it before issuing a new authenticated session.