Privacy Policy
Who this policy covers
This Privacy Policy explains what personal data Stockrita collects when you use stockrita.com, why we collect it, who processes it on our behalf, and the rights you have. It is a notice — we ask you to acknowledge it at signup, but you do not "accept" it as a contract. Stockrita is operated by Praroop Innovations, which is the data fiduciary for your account data under India's Digital Personal Data Protection Act, 2023 (DPDP), and the controller where the GDPR applies.
Data we collect
| Data | What it is | Why we collect it |
|---|---|---|
| Account identity | Your email, name, and (via Google) your Google account id and avatar | To create and secure your account and sign you in |
| Authentication records | Password hash (email signups), OAuth tokens, sessions | To authenticate you and keep you logged in |
| IP address & application logs | Your network address and request/error logs | Security, abuse prevention, and rate limiting |
| Usage & interaction data | Pages and entities you view, searches, saved items | To operate the product and improve it |
| Support communications | Messages you send us | To respond to and resolve your requests |
| Cookies | First-party session/preference cookies, and — only with your consent — Google Analytics cookies | To keep you signed in, remember choices, and (with consent) measure usage |
| Analytics data | Usage analytics collected by Google Analytics, only if you consent | To understand and improve the Service |
We collect only what we need to run your account and the Service. We always use first-party cookies
for your session and preferences. In addition, if you consent, we use Google Analytics, which sets
Google's own third-party analytics cookies (_ga and _gid) to measure how the Service is used. We
do not use cookies for advertising, and we do not sell your data. You can accept or decline analytics
cookies when you first visit, and change your choice at any time from Cookie settings (see
"Cookies and analytics" below).
How we use your data
We use your data to provide and secure the Service, to authenticate you, to prevent abuse and enforce our Terms, to respond to your requests, to comply with law, and to improve Stockrita. Where we rely on analytics, we do so only on the basis of your consent. We do not sell your personal data.
Cookies and analytics
We use two kinds of cookies:
- Essential cookies (always on) — first-party cookies needed to sign you in, keep your session, and remember your preferences (including your cookie choice). The Service cannot function without these, so they are not subject to consent.
- Analytics cookies (only with your consent) — if you accept, we load Google Analytics, which
sets Google's third-party cookies (
_ga,_gid) to measure page views and usage so we can improve the Service. Analytics runs only after you opt in; if you decline, Google Analytics is not loaded and no analytics cookies are set.
The lawful basis for analytics is your consent. You can withdraw consent at any time using the Cookie settings control (available in the site footer), which turns Google Analytics off immediately. Withdrawing is as easy as granting.
Who processes your data (sub-processors)
We use a limited set of processors to run the Service:
- Google — Google Sign-In (OAuth) for authentication, and Google Analytics for consent-based, cookie-based usage analytics (see "Cookies and analytics" above).
- Hosting and infrastructure — the servers and databases that run Stockrita.
- Stockrita's own user data store and API — where your account and usage data live.
- Email relay — to send verification and account emails.
- Language-model (LLM) providers — used only to process public company documents (see the LLM-providers section below).
Each processor handles data only for these purposes and under contract.
LLM providers — your personal data is not sent to them
Stockrita uses language-model providers (for example, Google Vertex/Gemini, DeepSeek, and MiniMax) to analyze already-public, already-filed company documents — regulatory filings such as RHP/DRHP, SEC 10-K and 20-F, and similar public disclosures. Your personal data — your email, authentication records, and IP/logs — is never sent to these LLM providers. They process public company documents, not your account data. Because we do not send your personal data across borders to these providers, DPDP cross-border-transfer and GDPR international-transfer rules are not triggered by this processing.
Retention
We keep your account data while your account is active and for as long as needed to provide the Service, meet legal obligations, and resolve disputes. Network identifiers tied to legal-acceptance records (IP address and user agent) are removed once no longer needed. When you delete your account, we remove or de-identify your personal data, retaining only minimized records we are required to keep.
Your rights
Subject to applicable law, you may request access to, correction of, or deletion of your personal data, and you may withdraw consent where processing relies on it. To exercise these rights, contact our Grievance Officer (see the Grievance Officer section below). We aim to respond to and act on verified requests within 30 days, or sooner where the law requires. You can close your account at any time from your account settings.
Security
We protect your data with access controls, encryption in transit, and the least-privilege handling of credentials. No system is perfectly secure, but we work to protect your data and to respond to incidents responsibly.
Grievance Officer
If you have a question, concern, or complaint about how we handle your personal data — or wish to exercise your rights under the DPDP Act — contact our Grievance Officer:
- Grievance Officer, Stockrita (Praroop Innovations)
- Email: grievance[at]stockrita[dot]com
We respond to data-principal requests within the timelines required by law.
Children
Stockrita is not intended for anyone under 18 years of age. We do not knowingly collect personal data from children, and creating an account requires you to confirm you are 18 or older. If we learn that we have collected data from someone under 18, we will delete it.
Changes to this policy
We may update this Privacy Policy. When we make a material change we publish a new version with a new effective date and show a notice in the app so you can review what changed. Prior versions are kept on record.