Privacy policy
What we collect, why, who we share it with, and the rights you have under India's Digital Personal Data Protection Act, 2023.
1. Who is responsible
QNTMHRZN Analytics and Technologies, 4/2 Vasant Kunj 2, Vasant Vihar, Dehradun 248006, Uttarakhand, is the data fiduciary for personal data processed through imbalance. Questions and requests go to support@imbalance.co.in.
2. What we collect
- Account: email address, username, display name, and a salted, peppered hash of your password (never the password itself). Two-factor settings, passkey public keys and session records.
- Trading: your paper orders, positions, journal, alerts, watchlists, chart layouts and strategy settings.
- Live mode: the Delta Exchange India API key and secret you add, stored encrypted, and the account details and orders Delta returns for it.
- Community: ideas, posts, follows and your public profile.
- Notifications: your Telegram chat ID if you link Telegram, and a browser push subscription if you turn on notifications.
- AI features: the question you ask and the market context sent with it.
- Technical: IP address (for security and rate limiting), browser and device type, and pages viewed.
- Payments: when paid plans are offered, the payment partner gives us the plan, amount and status. Card, UPI and bank details stay with the payment partner.
3. Why we use it
- To run your account and the features you use, including sending login and security codes.
- To carry out the Live-mode orders you confirm.
- To keep the service secure: detecting bots, abuse and account takeover.
- To understand how the site is used and improve it.
- To meet legal obligations, such as tax records for payments and responding to lawful requests.
We process your data on the basis of the consent you give when you sign up, and for the legitimate uses the DPDP Act allows. We do not sell personal data and do not use it for third-party advertising.
4. Cookies and analytics
We use first-party cookies only. Session cookies keep you logged in. Two analytics cookies, imb_cid (a random visitor ID) and imb_sid (session start), let us count visits. Page views are sent from our server to Google Analytics 4 and Amplitude without your IP address, and with only the page path. If your browser sends Global Privacy Control or Do Not Track, we do not count you at all. The site loads no third-party advertising or tracking scripts.
5. Who we share it with
Only the service providers that run the service, each bound to use the data only for us:
- Cloudflare: hosting, database, email delivery and bot protection (Turnstile).
- Google Analytics and Amplitude: usage analytics, as described above.
- OpenRouter and the AI model providers it routes to: answering AI requests.
- Telegram: delivering alerts, if you link it.
- Delta Exchange India: carrying out your Live-mode requests, through a relay server we operate.
- Our payment partner, once paid plans are offered.
We may also disclose data when the law requires it. Some providers process data outside India; we use providers who protect it to the standards Indian law requires.
6. How long we keep it
Account and trading data are kept while your account is open. When you ask us to delete your account, we delete or anonymise your personal data within 30 days, except records we must keep by law (for example, payment and tax records, usually for 8 years). Security logs are kept for a short period.
7. Security
Passwords are hashed, Delta API secrets are encrypted at rest, all traffic uses HTTPS, and sensitive actions need a fresh login or a second factor. No system is perfectly secure; if a breach affects your data, we will tell you and the Data Protection Board as the law requires.
8. Your rights
Under the DPDP Act you can ask us to: tell you what personal data we hold and how it is used; correct, complete or update it; erase it; withdraw your consent (which may mean closing your account); and nominate someone to exercise these rights if you die or become unable to. You can also raise a grievance with us and, if it is not resolved, with the Data Protection Board of India.
Write to support@imbalance.co.in from your account email. We reply within the timelines on the Grievance redressal page.
9. Children
The service is for adults. We do not knowingly collect data from anyone under 18; if we learn that we have, we delete it.
10. Changes
We will post changes here and, if they are significant, tell you by email before they take effect.