Privacy Policy

1. Data Controller

Riskora, operated by Rishu (Sole Proprietor), Bihar, India. Contact: support@riskora.in.

2. Data We Collect

• Account data: Name, email address, password (hashed), Google OAuth token (if used).
• Transactional data: Subscription tier, payment history, Razorpay transaction IDs.
• Behavioural data: Trade simulation logs, ORA-1 Engine rule breaches, account lock events, session activity.
• Technical data: IP address, device type, browser type, access logs.

Mirror tradebook analysis

Your tradebook is not uploaded. When you use Mirror, the file you select is read and analysed entirely inside your own browser. No request carries your trades, and Riskora never receives or stores your trade rows, instruments, prices, quantities or profit and loss figures. You can verify this in your browser's developer tools: open the Network tab before selecting your file and watch what happens when you do.

Organisation pilots (opt in)

Some traders reach Mirror through a link from an educator, academy or trading community running a pilot with us. If that applies to you, Mirror will ask you explicitly whether to add a summary of your analysis to that organisation's cohort view. Nothing is shared unless you choose to, the choice is never pre-selected, and declining changes nothing about your own report.

If you do consent, what is sent is limited to derived behavioural figures: your Discipline Score, the pattern percentages already shown in your report, a bucketed range for how many trades were analysed, and an anonymous participant identifier generated in your browser. Your trades themselves are still never uploaded, and neither is your name, email or broker. The organisation sees you as an anonymous participant among others, and the cohort view contains no individual trade data of any kind.

3. Lawful Basis for Processing (DPDP Act 2023)

Under the Digital Personal Data Protection Act, 2023 ("DPDP Act"), we process your personal data on the following lawful bases:

• Contractual necessity: Processing required to deliver the subscription service you have paid for.
• Legitimate interests: Fraud prevention, platform security, and product improvement.

4. Data Storage & Third-Party Processors

• Supabase: Database (user accounts, trade logs). Data location: US (AWS). Safeguards: SOC 2 Type II; DPA available.
• Vercel: Frontend hosting & CDN. Data location: Global CDN. Safeguards: GDPR-compliant infrastructure.
• Razorpay: Payment processing. Data location: India (RBI compliant). Safeguards: PCI-DSS certified.
• Hostinger (SMTP): Transactional email delivery. Safeguards: TLS-encrypted transport.
• Google OAuth: Authentication. Data location: US (Google Cloud). Safeguards: Google DPA; GDPR-compliant.

Data Localisation (DPDP Act 2023): The DPDP Act does not yet prescribe sector-specific data localisation rules for EdTech/SaaS companies. No mandatory India-only storage requirement applies to Riskora at its current scale. This position must be reviewed when government notifies specific sectors under Section 16 of the DPDP Act. Payment data processed by Razorpay is already stored in India per RBI mandate.

5. Data Retention

• Account data: Retained for the duration of the subscription + 3 years post-termination for legal/tax compliance.
• Payment records: 7 years as required under Income Tax Act and GST regulations.
• Trade simulation logs: 2 years from last activity, then deleted.
• Server/access logs: 90 days, then auto-deleted.

6. User Rights Under DPDP Act 2023

• Right to access your personal data held by us.
• Right to correction of inaccurate personal data.
• Right to erasure: you may request deletion of your data (subject to legal retention requirements).
• Right to nominate: you may nominate a person to exercise rights on your behalf.
• Submit requests to: support@riskora.in. We will respond within 30 days.