Privacy Policy

Aster is operated by [COMPANY LEGAL NAME], [REGISTERED ADDRESS] (“Aster”, “we”, “us”). For your personal data we are the Data Fiduciary under India's Digital Personal Data Protection Act, 2023 (the “DPDP Act”).

Questions about this policy or your data: [CONTACT EMAIL].

Account details

Your email address and password (stored as a secure hash by our authentication provider), and when you signed up and last signed in.

Your questionnaire answers

What you tell us during onboarding: your experience, the markets and style you trade, your strategy in your own words, how well you follow it, what you struggle with, your goals and your timezone.

Trade files and imported trades

The broker statements you upload (MetaTrader 5, Zerodha, South Asian Stocks and similar) and the trades we read from them or import from a connected account: instrument, side, size, prices, times, profit or loss, currency and any strategy you tag them with. Trades you add by hand are stored the same way.

Broker connection details

When you connect a MetaTrader account: the platform, account number, broker server, the account's currency, its connection status and when it last synced.

We never store broker passwords. Aster only accepts a read-only investor password, which cannot place trades or move money. When you enter it, it is passed straight to our connection provider (MetaApi, see below) to open the read-only connection, and is not saved in our database or logs. Never give Aster your master (trading) password; we reject it if we recognise it.

What Aster creates from your data

Your rules, discipline score, streaks, rule violations, analyses and insights, your watchlist, and the strategies you set up.

Technical data

Sign-in session cookies, needed to keep you signed in, and small preferences kept in your browser (such as the width of the app's sidebar). Our hosting providers keep standard server logs (IP address, browser, pages requested, errors) for security and troubleshooting. We don't use advertising cookies or sell your data.

We process your personal data on the basis of your consent, given when you create an account, and only to:

• run your account and sign you in;
• read your trade history, propose rules from your own patterns, and check each trade against the rules you approve;
• show your dashboard, scores, insights and live rule status;
• send you service emails, such as sign-up confirmation and password resets;
• keep Aster secure, prevent abuse and fix problems;
• meet our legal obligations.

Some analysis is done by an AI model (see processors below). It sees your trades, questionnaire answers and the figures we compute from them; it does not see your email address or password. We do not use your personal data to train AI models.

We use these service providers (Data Processors) to run Aster. Each processes your data only on our instructions and to provide their service to us.

• Supabase — sign-in and our database, where your account, answers, trades and rules are stored.
• OpenAI — the AI model that writes your analysis, findings and rule wording.
• MetaApi — the read-only connection to MetaTrader 5 / 4 accounts you choose to connect.
• Render — hosts Aster's server (API).
• Netlify — hosts Aster's website.
• Resend — sends our service emails.

Some of these providers process data outside India. We only transfer data to countries the Government of India has not restricted under the DPDP Act, and we require each provider to protect it.

The live charts on Aster are an embedded TradingView widget, which TradingView serves directly to your browser under its own privacy policy.

We keep your data while your account is open. Uploaded statement files are read when you upload them; we keep the trades taken from them, not the files. If you disconnect a broker account, its connection details are removed and the trades already imported stay in your account until you delete them or your account.

When you delete your account, or ask us to, we erase your personal data within [NUMBER] days, except where the law requires us to keep something for longer. Copies in our providers' backups are removed as those backups expire, within [NUMBER] days. Server logs are kept for up to [NUMBER] days.

You can delete individual trades and rules in the app at any time. To delete your whole account and its data, email [CONTACT EMAIL] from the address you signed up with. We'll confirm once it's done. Deletion can't be undone.

As a Data Principal under the DPDP Act, 2023, you have the right to:

• Access — a summary of the personal data we process about you, what we do with it, and who we've shared it with;
• Correction and completion — fix data that is inaccurate or incomplete, and update it;
• Erasure — have your personal data deleted once it's no longer needed, unless the law requires us to keep it;
• Withdraw consent — at any time, as easily as you gave it. We'll then stop processing your data, which means closing your account; it doesn't affect processing already done;
• Grievance redressal — complain to our Grievance Officer (below) and get a response;
• Nominate — name someone to exercise these rights for you in the event of your death or incapacity.

To use any of these rights, email [CONTACT EMAIL]. We may ask you to confirm your identity first. If you're not satisfied with how we handle your complaint, you can complain to the Data Protection Board of India.

Data is encrypted in transit (HTTPS) and at rest by our database provider. Access to your data is limited to your own account and to the people at Aster who need it to run the service. No system is perfectly secure; if a breach affects your personal data, we'll tell you and the Data Protection Board of India as the DPDP Act requires.

Aster is for adults. You must be 18 or older to use it, and we don't knowingly process the personal data of anyone under 18. If you believe a child has signed up, contact us and we'll delete the account.

For any complaint about how we handle your personal data:

[GRIEVANCE OFFICER NAME]
Grievance Officer, [COMPANY LEGAL NAME]
[REGISTERED ADDRESS]
[CONTACT EMAIL]

We'll acknowledge your complaint within [NUMBER] days and aim to resolve it within [NUMBER] days.

If we change this policy, we'll update the date at the top. If a change affects how we use your data in a meaningful way, we'll tell you by email or in the app before it takes effect.