Privacy Policy

1. Data Fiduciary Status and Data Collected

SageAlpha acts as a "Data Fiduciary" in relation to your personal data within the meaning of the DPDPA. We collect the minimum personal data necessary to deliver our stock risk intelligence tools:

• Primary Identifiers: your mobile phone number, collected for OTP-based authentication, onboarding, and alerts.
• Behavioural Telemetry: stock symbols (tickers) searched, transparency-score queries, and usage timestamps.
• System Data: IP address, browser type, and device telemetry, collected to prevent scraping and API abuse.

2. Where Your Data Is Processed

Your personal data is processed and stored using cloud infrastructure operated by SageAlpha and its contracted service providers. Where any processing occurs outside India — for example, through third-party AI model inference providers — such transfer is carried out in accordance with Section 16 of the DPDPA, and is limited to jurisdictions not restricted by the Central Government of India. We will update this disclosure if our processing locations change materially.

3. Explicit Purpose of Processing

Your personal data is processed strictly for the following lawful purposes under the DPDPA:

• to deliver requested AI-powered risk analysis Outputs to your device;
• to send SMS or WhatsApp alerts regarding high-risk signals for your tracked tickers;
• to prevent systemic abuse, automated scraping, or denial-of-service attacks; and
• to train and calibrate our NLP sentiment models, strictly using anonymised, aggregated search-frequency data.

Search-frequency data used to calibrate our NLP sentiment models is subjected to irreversible aggregation and hashing prior to use, such that it is not reasonably capable of being linked back to your mobile number or individual account through any process available to SageAlpha.

4. Consent and Withdrawal

Prior to collecting your mobile number or any other personal data, we present a clear, itemised notice describing the personal data to be collected and the specific purpose of processing, in accordance with Section 5 of the DPDPA. Your consent is recorded through an unambiguous affirmative action (such as an OTP-verification checkbox) and is not bundled with consent for unrelated processing purposes.

You may withdraw your consent at any time through your account settings or by emailing gajanan@sagealpha.ai, and the process for withdrawal shall be no more difficult than the process by which consent was originally given. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal, and SageAlpha may continue to retain certain data where required for legal compliance under Clause 6.

5. Children's Data

The Platform is not directed at, and must not be used by, individuals under the age of eighteen (18). We do not knowingly collect personal data from children within the meaning of Section 9 of the DPDPA, and we do not undertake tracking, behavioural monitoring, or targeted advertising directed at children. If we become aware that we have inadvertently collected a child's personal data without verifiable parental consent, we will delete such data promptly.

6. Data Retention and Erasure

We retain your mobile number and ticker history only for so long as you maintain an active profile and such retention remains necessary for the purposes set out in Clause 3, in accordance with Section 8(7) of the DPDPA. If your account is inactive for twenty-four (24) months, or upon receipt of a verifiable deletion request, we will permanently purge your phone number and identifiable telemetry from our production databases within seventy-two (72) hours, save where a longer retention period is separately mandated by law — including the requirement under Rule 3(1)(j) of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 to retain registration information for one hundred and eighty (180) days following any account cancellation or withdrawal, for the purpose of assisting law-enforcement authorities where lawfully required.

7. Data Breach Notification

In the event of a personal data breach, SageAlpha will, without delay, notify the Data Protection Board of India in accordance with Rule 7 of the DPDP Rules, including a description of the breach, the categories and approximate number of affected Data Principals, its likely consequences, and the remedial measures taken or proposed. SageAlpha will further notify affected Data Principals within seventy-two (72) hours of becoming aware of the breach, in plain language, describing the nature of the breach, the personal data affected, protective measures available to the Data Principal, and SageAlpha's contact details for further queries.

8. Exercising Your Data Principal Rights

As a Data Principal under the DPDPA, you have the right to:

• Right to Access: request a summary of the personal data we hold about you and the processing activities undertaken in respect of it.
• Right to Correction and Erasure: request correction of inaccurate or incomplete data, and permanent deletion of your mobile number and ticker history.
• Right to Grievance Redressal: escalate privacy concerns to our Grievance Officer under Clause 10, and, if unresolved within fifteen (15) days or if you remain dissatisfied, escalate your complaint to the Data Protection Board of India through its designated online complaints portal.
• Right to Nominate: nominate another individual to exercise these rights on your behalf in the event of your death or incapacity, by writing to gajanan@sagealpha.ai with the subject line "Nomination Request."

To exercise any of these rights, email gajanan@sagealpha.ai with the subject line "Data Principal Request." We will respond within the timelines prescribed under the DPDPA and the DPDP Rules.

9. Information Sharing and Security

We never sell, trade, or rent your mobile number to third-party marketers. Personal data is shared only with: (a) trusted infrastructure and processing providers, including cloud hosting providers, SMS/WhatsApp gateway providers, and AI/LLM inference providers, each bound by contractual confidentiality and data-processing obligations consistent with the DPDPA; or (b) regulatory or law-enforcement authorities (including SEBI and CERT-In), where legally mandated by a valid subpoena, order, or other lawful process. We utilise TLS 1.3 encryption in transit and AES-256 encryption at rest.

10. Grievance Officer and Data Protection Officer

In accordance with the DPDPA and the Information Technology Rules, 2021, the contact details of our Grievance Officer are as follows: Designation: Grievance Officer, SageAlpha Analytics Private Limited; Name: Gajanan Dusane; Email: gajanan@sagealpha.ai; Address: Pune, Maharashtra, India. We will acknowledge all privacy grievances within twenty-four (24) hours and endeavour to resolve them within fifteen (15) days.

A dedicated Data Protection Officer, based in India, is mandatory only for entities designated "Significant Data Fiduciaries" under the DPDPA. SageAlpha will appoint and separately identify a Data Protection Officer if and when it is so designated by the Central Government.