Privacy Policy
Version 1 · in effect from 14 August 2026
This policy explains what personal data thepapertrade collects, why, who else sees it, how long we keep it, and what you can do about it. It uses the vocabulary of the Digital Personal Data Protection Act, 2023 ("DPDP Act"): you are the Data Principal, we are the Data Fiduciary.
1. Who is responsible for your data
Equantra Tech LLP, Etah, UP, India, is the Data Fiduciary for the personal data described here.
- General privacy queries: rahul@thepapertrade.com
- Grievances, and requests to exercise your rights: Rahul Rajput, rahul@thepapertrade.com
2. What we collect
You give us:
| Data | Why we have it |
|---|---|
| Email address | It is your login identity, and how we send you confirmation, sign-in codes and password resets. |
| Password | Stored only as a bcrypt hash. We never store, and cannot recover, your actual password. |
| Public handle, if you claim one | The address of your public profile and your referral link. |
| Trade notes you type | Shown back to you on your own records. |
| Anything you write to us | Answering you, and keeping a record of the exchange. |
The service generates as you use it:
| Data | Why we have it |
|---|---|
| Simulated positions, orders, prices, charges, profit and loss | This is the service. |
| Daily statistics, season scores, leaderboard entries | Your record and, if you publish it, the leaderboard. |
| Watchlist, chart and option-chain preferences | So your screen is where you left it. |
| Referral code you arrived with, and referrals you make | Attributing referral credit. |
We collect automatically:
| Data | Why we have it |
|---|---|
| IP address | Security, abuse prevention, rate limiting, and as part of the record of a legal agreement you accept. |
| Browser user agent | The same, plus recognising a device you have already verified. |
| Device identifier we set | Recognising a trusted device so you are not asked for an emailed code every time. |
| Sign-in codes (hashed), sign-in attempts and their timing | Verifying it is you, and blunting brute force. |
| Which version of our Terms and Privacy Policy you accepted, when, and from what IP and browser | Evidence of the agreement between us. Section 14 of the Terms. |
| Server logs | Diagnosing faults and detecting abuse. |
We do not collect your PAN, bank account, demat account, Aadhaar, address, phone number, date of birth or any payment instrument, because we do not need them: no real money passes through thepapertrade and we are not a broker. Please do not send them to us.
3. Why we process it, and on what basis
We process your data:
- to create and run your account and provide the simulator;
- to authenticate you and protect your account and our systems;
- to compute your statistics, scores and — only if you publish — your public profile and leaderboard entry;
- to send you service email (confirmation, sign-in codes, password resets, important notices about your account or these policies);
- to keep a record of the legal agreements you have accepted;
- to detect, investigate and prevent abuse, fraud and breaches of our Terms;
- to serve and measure advertising (Section 5);
- to comply with law and to establish, exercise or defend legal claims.
Under the DPDP Act our basis is your consent, given when you register and accept these policies, except where a certain legitimate use applies — most obviously where you have voluntarily given us data for a purpose and have not indicated you object, and where processing is necessary to comply with a law or a court order.
We do not sell your personal data. We do not use your data to make automated decisions producing legal effects for you.
4. Cookies and similar technologies
| What | Type | Purpose | Lifetime |
|---|---|---|---|
| Session cookie | Essential, first party | Keeps you signed in and protects forms against cross-site request forgery. | Browser session |
ptr |
Functional, first party | Remembers the referral link you arrived through so credit reaches the right person. Signed; contains only a referral code. | 30 days |
| Trusted-device cookie | Essential, first party | Lets us recognise a device you have already verified by email, so we do not challenge you every time. | Up to 30 days |
phx:theme (browser storage, not a cookie) |
Functional, first party | Remembers light or dark mode. | Until you clear it |
| Google advertising cookies and identifiers | Advertising, third party | Selecting, capping, and measuring the ads described in Section 5. | Set by Google |
Essential cookies are necessary for the service to work, and you cannot use an account without them. You can delete or block any cookie in your browser, but blocking the essential ones will sign you out and keep you out.
5. Advertising
We display advertising supplied by Google and its partners on our blog and on our public pages. We do not, and will not, display advertising on the pages where you compose or manage a simulated trade.
- Google and its partners use cookies and similar identifiers to serve ads based on your prior visits to this and other websites, and to measure and limit how often you see them.
- Google's use of advertising cookies is described in Google's Privacy &
Terms site, at
policies.google.com/technologies/ads, and in its Advertising policies. - You can turn off personalised advertising from Google at
adssettings.google.com, and you can opt out of some third-party vendors' cookies atoptout.aboutads.infoandyouronlinechoices.eu. - Where the law requires it, a consent message managed through Google's own consent tooling is shown before advertising cookies are set, and your choice is recorded there.
We do not share your email address, your trading records, your statistics or your account identifiers with advertisers.
6. Who else sees your data
| Recipient | What they receive | Why |
|---|---|---|
| Our email provider | Your email address and the contents of service email we send you. | Delivering it. |
| Our market-data provider | Nothing about you. We ask for prices by instrument, never on your behalf. | Market data. |
| Our hosting and database infrastructure | Everything, as the systems on which the service runs. | Running the service. |
| Google and its advertising partners | The data described in Section 5. Not your account data. | Advertising. |
| Anyone at all | Your public handle, and your published statistics — only if you claimed a handle and then chose to publish, and monetary amounts only if you separately chose to show them. | You asked us to. |
| Law enforcement, regulators, courts | What we are lawfully required to disclose. | Compliance. |
We may disclose data to a successor if our business is transferred, subject to this policy continuing to apply.
7. Where your data is held
Our servers and our providers may process data in India or elsewhere. Where data is transferred outside India, we do so consistently with the DPDP Act and any restrictions the Central Government notifies.
8. How long we keep it
- Account data — for as long as your account exists.
- Trading records, statistics and scores — for as long as your account exists, because they are the record the service is for.
- Records of legal agreements you accepted — for as long as your account exists. They are deleted with it.
- Sign-in codes — minutes. Trusted devices — up to 30 days.
- Rate-limiting counters — minutes, in memory only.
- Server logs — a short operational period.
When you ask us to delete your account, we erase your personal data other than what we must keep for the reasons above or as the law requires.
9. Security
We hash passwords with bcrypt, transmit everything over TLS, verify new devices by emailing you a single-use code, rate-limit sign-in and mail sending, and restrict administrative access. Your trading records are readable only by you and, where strictly necessary, by an administrator.
No system is perfectly secure, and we cannot guarantee that yours or ours will never be compromised. If a personal data breach occurs, we will notify the Data Protection Board of India and affected users as the DPDP Act requires.
10. Your rights
As a Data Principal under the DPDP Act you have the right to:
- access a summary of the personal data we process about you and who we have shared it with;
- correct or complete inaccurate or incomplete data, and update it;
- erase your personal data where it is no longer needed for the purpose it was collected for and no law requires us to keep it;
- withdraw consent at any time — note that withdrawing consent to essential processing means we can no longer provide you an account;
- nominate another person to exercise these rights on your behalf if you die or become incapable of exercising them; and
- complain — to our Grievance Officer first, and to the Data Protection Board of India if you are not satisfied with our response.
To exercise any of these, write to rahul@thepapertrade.com from the email address on your account. We will respond within a reasonable period and in any case will acknowledge within 24 hours and endeavour to resolve within 15 days.
You also have a duty under the DPDP Act not to impersonate anyone else, not to suppress material information, and not to file a false or frivolous grievance.
11. Children
thepapertrade is for adults. You must be 18 or over to hold an account. We do not knowingly collect personal data from a child, do not knowingly track a child's behaviour, and do not direct advertising at children. If you believe a child has given us personal data, write to rahul@thepapertrade.com and we will delete it.
12. Changes to this policy
This policy is versioned. Each version has a version number and an effective date, and we record which version you accepted and when. When a new version takes effect, you will be shown its full text and asked to accept it before you continue to use your account.