Privacy Policy
01Overview
Shoprush Technologies Pvt. Ltd. ("Shoprush", "we") operates the Shoprush Terminal web and mobile application ("the Service") providing real-time NSE market data, AI-generated trading signals, and portfolio analytics to registered users in India. This policy explains what personal data we collect, why, how it's stored, and the rights you hold under India's Digital Personal Data Protection Act, 2023.
By creating an account you consent to the practices described here. If you disagree with any section, do not use the Service.
02Data we collect
Account data
- Full name, email address, mobile number (mandatory for KYC/2FA)
- Hashed password (bcrypt, cost 12) — we never see your plain-text credentials
- PAN number (optional, used only if you opt into GST-compliant invoicing)
- Residential address (optional, editable from your profile)
Usage & device data
- IP address, user-agent, device model, timezone, language
- Pages viewed, features used, signals clicked, session duration
- Referrer URL on first sign-up (to measure acquisition channels)
Trading activity
- Watchlists, portfolio holdings you manually enter, alert rules
- Signals you've viewed, dismissed, or favourited
- AI Market Chat conversation history (retained 90 days, then purged)
03How we use it
- Provide the Service — serve live quotes, generate signals, store your watchlists
- Personalise — rank signals against your risk profile and sector preferences
- Notify — send email/Telegram alerts you explicitly subscribed to
- Improve — aggregate, anonymised analytics to refine signal quality
- Billing — process subscription payments through Razorpay
- Comply — respond to lawful requests from Indian regulators (SEBI, CERT-In, RBI)
04Market data sources
Live prices, indices, and derivatives data on the Service are sourced from authorised NSE data vendors under commercial licence. The data is streamed to your browser via WebSocket and is not stored on Shoprush servers beyond the duration of your session. AI signals are computed on our servers using proprietary models and publicly available market data — they are informational, not investment advice.
05Cookies & local storage
We use a single essential session cookie (sr_session) plus browser localStorage for your preferences (theme tweaks, last-selected tab, etc.). We do not use third-party advertising or tracking cookies. Analytics are first-party, self-hosted (Plausible), and respect Do-Not-Track.
06Third parties we share with
- Razorpay — payment processing (PCI-DSS Level 1)
- AWS Mumbai (ap-south-1) — primary hosting & database
- Anthropic — AI Market Chat inference (queries only, never your identity or portfolio)
- Twilio / MSG91 — OTP & transactional SMS
- Telegram Bot API — only if you opt into Telegram alerts
We do not sell, rent, or trade your personal data. Ever.
07Data retention
- Account data — until you delete your account, then 30-day grace period
- Financial & tax records — 8 years (Income Tax Act, §44AA)
- AI Chat logs — 90 days rolling
- Server access logs — 180 days
08Your rights under DPDP 2023
As a Data Principal in India you have the right to:
- Access a copy of the personal data we hold about you
- Correct or update inaccurate information
- Erase your account and associated data (subject to legal retention)
- Withdraw consent for optional processing at any time
- Nominate a successor in case of death or incapacity
- File a grievance with our DPO and escalate to the Data Protection Board of India
Submit requests via privacy@shoprush.co — we respond within 7 working days.
09Security
TLS 1.3 end-to-end, AES-256 at rest, bcrypt password hashing, role-based access control, quarterly penetration tests by CERT-In empanelled auditors. We notify affected users and CERT-In within 72 hours of any confirmed data breach.
10Children
Shoprush is not for users under 18. Trading on Indian exchanges requires a PAN, which is only issued to adults. We do not knowingly collect data from minors; if discovered, the account is terminated and data deleted within 24 hours.
11Changes to this policy
We'll email all active users at least 14 days before any material change takes effect. The current version and its revision date are always visible at the top of this page.