Privacy Policy

This Privacy Policy outlines how Wealthcrop E Services (OPC) Pvt. Ltd. ("Company", "We", "Us") collects, stores, processes, and protects personal and operational telemetry data on the CropX SaaS Platform (https://cropx.app). This policy complies with the Digital Personal Data Protection Act, 2023 (DPDP Act), SEBI Cybersecurity and Cyber Resilience Framework (CSCRF) advisories, and Indian data localization mandates.

1. Information We Collect

• Account & Billing Profile: Full name, registered email address, mobile number, business entity details, GSTIN (if applicable), and subscription transaction references processed via authorized payment gateways (e.g., Razorpay).
• Broker Integration Details: Unique Client Code (UCC), API Consumer Keys, whitelisted static IP logs, and session tokens. Note: Broker API authentication keys are encrypted using bank-grade AES-256 standards and stored in isolated tenant database instances.
• System & Audit Logs: System IP addresses, login timestamps, user-agent telemetry, rate-limiting counters (OPS monitoring), and order signal transmission logs retained for technical auditing and system security.

2. Purpose of Data Processing

• To provision, maintain, and secure dedicated tenant cloud compute instances (`{client}.cropx.app`).
• To route user-configured algorithmic signals to authorized broker API endpoints (such as Kotak Securities Neo API).
• To monitor system health, prevent cybersecurity threats, and enforce SEBI-mandated API rate-limiting guardrails.
• To process recurring SaaS subscription payments and issue legal tax invoices.

3. Data Security & Sovereign Cloud Residency (CERT-In / SEBI SaaS Advisory Compliance)

In accordance with CERT-In and SEBI advisories regarding Software-as-a-Service (SaaS) applications, all critical system configurations, database logs, and client telemetry reside exclusively on high-security servers located within the jurisdictional boundary of India (AWS Asia Pacific - Mumbai Region). We do not transfer GRC or operational data to foreign jurisdictions. Data is protected using TLS 1.3 in transit and AES-256 encryption at rest.

CropX does NOT sell, trade, rent, or monetize client trading logs, strategy rules, or personal data to third-party data brokers, market participants, or institutional desks.

4. Data Principal Rights under DPDP Act, 2023

As a Data Principal, you have the right to request access to your personal data, request corrections, or request account erasure upon subscription cancellation. Please note that statutory technical logs and billing audit entries required by law will be retained for the minimum statutory retention periods.

5. Grievance Officer & Data Protection Desk

For privacy queries, data requests, or statutory grievances under the DPDP Act 2023, please contact our designated Grievance Officer:

Grievance Officer: Sanjib Debnath

Entity: Wealthcrop E Services (OPC) Pvt. Ltd.

Email: [email protected]

Jurisdiction: Kolkata, West Bengal, India