Privacy Policy

Who we are

PapsDigital (https://www.papsdigital.com) runs an AI market-intelligence and trading-research workspace from India. For the personal data described here we are the Data Fiduciary under the Digital Personal Data Protection Act, 2023 ("the Act") and the Digital Personal Data Protection Rules, 2025.

Grievance Officer

Dax Panara, Grievance Officer. Email support@papsdigital.com. This is the person who answers every question about how we process personal data, and every request under the Act.

support@papsdigital.com · Data Rights page

What we collect, form by form

• Enquiry form (/contact, /pricing and IPO pages): your name and email address; your phone or WhatsApp number, if you give one; the product you are interested in and your message; the page you sent it from, the time, and a one-way hash of your IP address (used to stop spam).
• Newsletter (footer of every public page): your email address; when you subscribed and confirmed, and a one-way hash of your IP address.
• Account (sign-up, sign-in and everything you do signed in): your name, email address and password (stored only as a salted hash); your WhatsApp number, if you give one (needed for paid plans by the payment provider); a referral code and the plan you chose, if any; what you do in the product: credits used, price alerts, journal notes, and a Telegram chat ID if you add one; text you type into Copilot, AI Studio or the scanner (sent to the AI provider to answer you, not stored by us); sign-in times and, for password resets, a one-way hash of your IP address.
• Data-rights request form (/legal/data-rights): your name and email address; the kind of request and the details you write; when you sent and confirmed it, and a one-way hash of your IP address.

What we do not collect

No analytics, advertising or tracking scripts run on this site, and it sets no cookies. Card and UPI details go straight to the payment provider and never reach us. We do not buy data about you from anyone.

Third-party connections from your browser

Live market data on some pages is loaded by your browser directly from Binance (crypto prices) and gold-api.com (metal prices), and the checkout loads Cashfree's payment script. Your browser therefore connects to those services, which lets them see your IP address and browser details. We send them nothing about you. IPO grey-market data is served through our own systems.

Why we use it

• Enquiry form: To reply to your enquiry and, if you ask, help you choose a plan. We do not add you to any mailing list and do not use this for marketing.
• Newsletter: To send you market notes, product updates and what changed in the workspace. You confirm by clicking a link we email you, and every email has a one-click unsubscribe link.
• Account: To create and secure your account, provide the plan you chose, meter credits, deliver alerts you set, take payment for paid plans, and send you service emails (confirmation, password reset). We do not use it for marketing unless you separately subscribe to the newsletter.
• Data-rights request form: To confirm the request comes from you (we email a link to the address you give), find your data, act on the request, and keep a record that we answered it.

The basis we rely on

Your consent, given by ticking an unticked box beside each form after reading that form's notice (s. 6 of the Act). We record which notice version you saw, when, and in which language. Newsletter consent is separate from every other form and never bundled with it.

Who processes it for us

• Vercel Inc.: website hosting and page delivery (India (Mumbai) and United States). Receives IP address and browser details of every page request.
• Render Services, Inc.: application hosting (United States). Receives everything you submit, while it is being processed.
• Neon (Databricks, Inc.): database (United States). Receives everything you submit and everything we store about you.
• GitHub, Inc.: encrypted nightly database backups, kept 30 days (United States). Receives an encrypted copy of the database (unreadable without our key).
• Resend, Inc.: email delivery (United States). Receives your email address, name and the content of the email we send you.
• Hostinger International Ltd.: our support@papsdigital.com mailbox: your emails to us, and a copy of each enquiry or paid-plan signup so we can reply (may be outside India). Receives what you write to us; for an enquiry or paid-plan signup, your name, email, phone, the product you chose and your message.
• Cashfree Payments India Pvt. Ltd.: payment processing (India). Receives name, email, phone and payment details (card and UPI details go to Cashfree only).
• Anthropic, PBC: AI answers in Copilot, AI Studio and the scanner (United States). Receives the text you type into those tools (no name or email is sent).
• Telegram: price-alert delivery, only if you add a Telegram chat ID (outside India). Receives your Telegram chat ID and the alert text.

Transfers outside India

Several of the providers above store or process data outside India, mainly in the United States. The Act permits this unless the Government restricts a country (s. 16, Rule 15); we check for such notifications and will move data if one applies.

How long we keep it

• Enquiry form: 12 months from the day you send it, then it is deleted.
• Newsletter: Until you unsubscribe. The address is then deleted (after the one-year minimum the law sets), and only a one-way hash is kept so we never add you again by mistake.
• Account: While your account is open. When you close it, sign-in stops at once and your data is held restricted for the one-year minimum the law sets, then deleted. Payment records are kept, without your name or email, for as long as tax law requires (up to 8 years).
• Data-rights request form: 12 months after we close the request, then it is deleted.
• Security and access logs: 12 months. Rule 8(3) requires personal data, traffic data and logs to be kept for at least one year from processing; nothing is deleted before that, and everything is deleted after it unless another law needs it longer.

How deletion works

When you close your account or ask us to delete your data, we stop using it at once: sign-in ends, and it leaves every system the product reads. An encrypted copy is held, restricted, only until the one-year legal minimum passes, and a daily job then deletes it permanently. We keep a one-way hash of your email address so we never add you to a list again by mistake. Encrypted database backups are kept for 30 days and then replaced, so a deleted record also leaves the backups within 30 days.

How we protect it

Passwords are stored only as salted PBKDF2 hashes. IP addresses are kept only as keyed one-way hashes and email addresses are masked in our logs. Every staff view, export, correction and deletion of personal data is recorded in an audit log, and exporting needs a separate permission. The database is encrypted at rest by its host and backed up nightly as an encrypted copy.

Your rights

• Access: a summary of the personal data we hold about you, what we do with it, and every provider it was shared with (s. 11).
• Correction, completion and updating of inaccurate or incomplete data (s. 12).
• Erasure of data we no longer need or that you withdraw consent for, unless a law requires us to keep it (s. 12).
• Withdrawal of consent at any time, as easily as you gave it (s. 6(4)). Withdrawing does not affect what was lawfully done before.
• Nomination of another person to exercise these rights if you die or become incapable (s. 14).
• Grievance redressal: a complaint to our Grievance Officer, answered within the period below (s. 13).

How to exercise them

Use the Data Rights page or email support@papsdigital.com from the address you used with us: that email address is the identifier we need (Rule 14). We confirm the request by emailing a link to that address, then reply within 30 days, and never later than the 90 days the Rules allow.

Data Rights page

Complaints

Write to the Grievance Officer first (support@papsdigital.com). If you are not satisfied with the answer, you can complain to the Data Protection Board of India (s. 13(3)); appeals from the Board go to the Telecom Disputes Settlement and Appellate Tribunal.

Children

PapsDigital is intended for adults (18 and over). Under the Act a child is anyone under 18. We do not knowingly collect data about children and do not track or target them; if we learn we hold such data we delete it. A parent or guardian can ask us to do so.

Data breaches

If a breach affects your personal data we will tell you without delay, in plain language: what happened, what it may mean for you, what we are doing about it and what you can do. We will also report it to the Data Protection Board of India as Rule 7 requires, including a full report within 72 hours.

Browser storage

To keep you signed in, the site stores your session token and basic account details in your browser's local storage (or session storage if you untick "Keep me signed in"). Signing out removes them. Chart settings and draft journal notes are stored the same way. None of this is a cookie and none of it is shared with anyone.

Your duties

The Act asks you not to impersonate anyone, not to suppress material information, not to file false or frivolous complaints, and to give accurate information when you ask for a correction (s. 15).

Languages

This policy and every notice are in English. They are available in Hindi, Gujarati or any other language in the Eighth Schedule to the Constitution on request (s. 5(3)): email support@papsdigital.com.

Changes

Notice version 2026-10-04.2, effective 4 October 2026. When the notice changes we update this page, keep the earlier text on file, and ask for consent again on the next form you send.