Privacy Policy

Privacy Policy

Last updated: October 17, 2026

Who We Are And How To Reach Us

XMarketRadar decides why and how the personal data described in this policy is processed. Our Grievance Officer handles privacy questions, requests and complaints, and is our contact point for data protection matters, including under India's Digital Personal Data Protection Act, 2023.

To reach the Grievance Officer, use the Contact page and choose the Privacy request category, so your message is handled as a privacy request.

We may ask you to verify your identity before we act on a request, and we respond within the period applicable law requires.

Information We Collect

Depending on the features you use, we may process:

• Account identifiers and authentication metadata, such as Firebase user IDs and email addresses.
• Watchlists, saved screens, chart settings, drawings, templates, alerts, and dashboard preferences.
• Portfolio records, holdings, risk-profile answers, broker names, sync status, and read-only broker tokens when you connect a broker.
• Alert delivery settings, such as email, SMS, webhook URLs, delivery logs, and opt-in preferences.
• Usage, diagnostic, device, browser, IP, and log data used for reliability, security, abuse prevention, and product improvement.
• Billing and subscription metadata. Payment card details, where applicable, are handled by the payment provider and are not stored by XMarketRadar.

How We Use Information

• To provide market research, portfolio, watchlist, broker sync, alert, and account features.
• To save user settings, templates, screeners, layouts, and preferences across sessions or devices where enabled.
• To send alerts, service messages, subscription notices, and support responses.
• To monitor data freshness, broker sync health, service reliability, fraud, abuse, and security issues.
• To improve product quality, performance, and user experience.

Legal Bases For Processing

We process personal data only where one of these grounds applies:

• Consent: you give it when you create an account and accept these policies, and separately for optional items such as the email newsletter, WhatsApp messages and analytics and advertising cookies when we ask. You can withdraw it at any time; withdrawal does not affect processing already carried out.
• Our agreement with you: providing the account, saved research, portfolio, alert and subscription features you ask for under the Terms and Conditions.
• Legitimate uses and interests permitted by law: keeping the service secure and reliable, preventing fraud and abuse, and understanding in aggregate how the product is used.
• Legal obligations: for example, tax and accounting rules for payments, and lawful requests from public authorities.

Broker And Portfolio Data

Broker integrations are designed to be read-only. XMarketRadar does not place trades or submit orders. If you connect a broker, access tokens and holdings data may be stored or processed so the platform can show holdings, sync health, portfolio risk, and related alerts.

Cookies And Local Storage

We may use cookies, local storage, and similar browser technologies for sign-in state, theme, exchange preferences, selected columns, chart settings, saved local layouts, and security.

Sharing And Service Providers

We may use service providers for hosting, authentication, analytics, email, SMS, webhooks, payments, broker connectivity, and market data. We do not sell personal portfolio data. We may disclose information when required by law, to protect rights and security, or to operate the service.

Service Providers We Use

We do not sell personal data. We share it only with providers that process it on our behalf to run the service, or with services you choose to connect. They currently are:

• Hetzner Online: the dedicated server that runs the website, the API and the database.
• Cloudflare: network delivery, security filtering and bot protection, including the Turnstile check on sign-up and support forms. It processes IP addresses and request details.
• Google Firebase Authentication: sign-in, email verification, password reset and account deletion. It processes your email address and sign-in identifiers.
• Google Analytics and Google Tag Manager, and Microsoft Clarity loaded through Tag Manager: product analytics, according to your cookie choice.
• Meta Platforms (Meta Pixel and Conversions API): measuring our Facebook and Instagram advertising, only if you allow analytics and advertising cookies. With that choice the Meta Pixel in your browser reports page views and steps such as sign-up, a first saved screen, watchlist or Radar item, a trial and a completed payment (its amount and currency); for sign-up and payment our server sends the same event with a SHA-256 hash of your email address (never the address itself), your IP address and browser user agent, Meta's _fbp and _fbc cookie identifiers, the page address without its query string and the campaign source and name of the ad that brought you. We share no name, phone number, portfolio, holdings or messages. Meta uses this to tell us which ads lead to sign-ups and to deliver our ads, under its own terms for businesses.
• Twilio: delivery of account, alert and newsletter emails and of SMS alerts. It processes your email address or phone number and the message. If Twilio email is unavailable, email may be sent through the SMTP relay we configure as a fallback.
• Meta (WhatsApp Business Platform): WhatsApp alerts, only to a number you have opted in.
• PayPal, Google Play and any other payment provider shown at checkout: payment processing for paid plans. Card and bank details are handled by them and are not stored by XMarketRadar.
• Providers of AI language models: the text of requests you make to AI research features and the public market data used to answer them. Briefings built from your own portfolio or watchlist are generated only by models running on our own servers.
• Brokers you connect: read-only access to your holdings with the permission you grant, and the webhook, Telegram, Discord or Slack destinations you configure for your alerts.

International Transfers

Our server is rented from Hetzner, which operates its data centres outside India, and several providers above, including Google, Cloudflare, Twilio, Meta and PayPal, process data in the United States and other countries. Your personal data is therefore stored and processed outside India and outside the country where you live. We do not transfer personal data to a country the Government of India has restricted under the DPDP Act, and we use providers that offer contractual safeguards for international transfers, such as standard contractual clauses.

Data Retention And Security

We retain information for as long as needed to provide the service, satisfy legal or accounting requirements, resolve disputes, and protect the platform. We use reasonable technical and organizational safeguards, but no online service can guarantee absolute security.

Specific retention periods:

• Account and product data (profile, watchlists, portfolios, saved screens, alerts, settings, email preferences and your acceptance records): until you delete your account. Deletion erases it, except the disabled-account identifier described under Your Choices.
• Server log files, which can include IP addresses and request details: the API keeps general logs for no more than 14 days and error logs for no more than 30 days; the website keeps its logs for no more than 14 days.
• Campaign visit records used to measure sign-ups, collected only with your analytics consent: 90 days.
• Security audit records of sign-ins, data exports, account deletion and administrative actions, which include account identifiers and IP addresses: kept as tamper-evident security evidence, including after account deletion. They are not currently deleted on a fixed schedule.
• Support and contact requests: kept to handle the request and any follow-up; they are not currently deleted on a fixed schedule. Ask us through the Contact page if you want a request deleted.
• Backups: when taken, encrypted database backups keep point-in-time recovery data for up to 35 days and monthly archives for up to 12 months, in a Hetzner data centre separate from the production server. Data you delete can remain in these copies until they expire; they are used only to restore the service.
• Invoices and credit notes for payments you made: kept for as long as tax and accounting law requires, currently 8 years from the date of each document, including after you delete your account. They are kept exactly as issued, with the name, email address and any GSTIN printed on them, are used only to meet those legal obligations, and are then deleted. Your other billing records, such as saved billing details and billing emails, are erased with your account.

Your Choices

• You can remove watchlist, portfolio, alert, template, and saved-screen data where the product exposes those controls.
• You can disconnect broker access where supported by the broker integration or by removing the stored token.
• You can contact support for account or privacy requests, subject to identity verification and applicable law.

Account holders can permanently delete their account and associated product data from Profile, or submit an external request through the XMarketRadar account deletion page. A minimal disabled-account identifier may be retained for security, fraud prevention, and to prevent an erased account from being silently recreated. Payment providers may retain transaction records under their own legal obligations.

Your Rights

Subject to applicable law, including India's Digital Personal Data Protection Act, 2023 and, where it applies to you, the EU or UK General Data Protection Regulation, you can:

• Access and export: ask for a summary of the personal data we hold about you and how it is used. Signed-in users can download a copy of their account data from Profile at any time.
• Correct and complete: update inaccurate or incomplete data. Most account details can be edited in Profile; contact us for anything else.
• Erase: delete your account and associated product data from Profile or the account deletion page, subject to the retention described below.
• Withdraw consent: unsubscribe from emails, turn off SMS or WhatsApp alerts, change your analytics and advertising cookie choice, or delete your account. Some features cannot work without the data they need.
• Object and restrict: object to processing based on our legitimate interests, or ask us to limit processing while a request is being resolved.
• Nominate: under the DPDP Act, name another person to exercise your rights if you die or become unable to do so. Send the nomination through the Contact page.
• Complain: raise the issue with our Grievance Officer first. If you are not satisfied, you may complain to the Data Protection Board of India or, where the GDPR applies, to the data protection supervisory authority where you live or work.

Request Your Data Or Its Erasure

• If you have an account, sign in and use your Profile: download a copy of your data, correct it, or delete your account. Requests made there are verified by your sign-in and handled straight away.
• If you have no account or cannot sign in, send a privacy request from the Contact page. We email a confirmation link to the address you give, and act on the request only after you use it.

Children

XMarketRadar is intended only for people aged 18 or older, and you must be 18 or older to create an account. We do not knowingly collect personal data from anyone under 18. If you believe someone under 18 has created an account, contact us and we will delete it.

Changes To This Policy

We may update this policy as the product, legal requirements, or data practices change. The latest version will be posted on this page with an updated date.