Privacy Policy
Effective 4 November 2026
This policy explains what personal data Cupel collects, why, and what you can do about it. It is written to meet India’s Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000. Chirayu Shah ([Registered address]) is the Data Fiduciary responsible for your data.
1. What we collect
- Account: your email address, used to send your sign-in link and to identify your account, and your access level.
- What you save: your watchlists and the stocks in them, and when you last read your notifications.
- Sign-in session: cookies that keep you signed in. They are strictly necessary and expire when your session does.
- Technical logs: our hosting and database providers record requests (IP address, browser, time, page) to run and secure the Service.
- Payment: when paid plans are offered, payments are handled by our payment provider. We receive confirmation of the payment, not your card or bank details.
Saved screener views, your light or dark theme, and the grid’s scroll position are kept in your own browser’s storage and are never sent to us.
We do not collect your brokerage credentials, your holdings, or any sensitive personal data, and we do not use advertising or tracking cookies.
2. Why we use it
- to create your account, sign you in and keep it secure;
- to provide the features you use, such as watchlists and notifications;
- to send messages about your account, the Service or your subscription;
- to find and fix faults, and to prevent misuse;
- to meet our legal obligations.
We process your data with your consent, given when you create an account, and for the uses the law allows without it, such as meeting a legal obligation. We do not sell your data or use it to train AI models.
3. Who processes it for us
- Supabase: database, authentication and sign-in emails.
- Vercel: hosting of the website.
- Our payment provider, once paid plans are offered.
They process data only on our instructions. Our database and servers are in Tokyo, Japan, so your data is stored outside India. We transfer it only to countries the Government of India has not restricted. We may disclose data where the law, a court or a regulator requires it.
4. How long we keep it
We keep your account data while your account is open. When you delete your account we erase it within 30 days, except what the law requires us to keep, such as payment records. Technical logs are kept for a limited time by our providers.
5. Your rights
You may ask us to:
- tell you what personal data we hold about you and how we use it;
- correct or complete it;
- erase it, and close your account;
- withdraw your consent, which ends your use of the Service;
- name someone to exercise these rights for you in the event of your death or incapacity.
Write to [grievance email]. We answer within 30 days. If you are not satisfied with our answer you may complain to the Data Protection Board of India.
6. Security
Data is encrypted in transit, access to the database is restricted by row-level rules so each account reads only what it may, and administrative access is limited. No system is completely secure; we will tell you and the authorities about a breach as the law requires.
7. Children
The Service is for adults only. We do not knowingly collect data from anyone under 18.
8. Changes
We will post any change to this policy here with a new effective date, and tell you before a material change applies to you.
9. Grievance Officer
Chirayu Shah, [grievance email], [Registered address].