Privacy Policy

1. Introduction & Data Fiduciary

This Privacy Policy explains how Blue Whale Charting ("we", "our", or "us") collects, uses, stores, and protects personal data when you access or interact with our website, charting terminal, educational content, and subscription services.

Under India's Digital Personal Data Protection Act, 2023 ("DPDP Act"), the data fiduciary responsible for processing your personal information is:

2. Data We Collect

We collect personal information through direct interactions and automated telemetry:

• Account & Profile Data: Email address, encrypted authentication tokens, password hash, and TradingView username (provided by you to activate invite-only indicator scripts).
• Payment & Billing Data: Transaction IDs, billing email, subscription status, and payment timestamps. We do not store credit card, debit card, or UPI credentials; all payment transactions are tokenized and processed securely by our certified payment gateway.
• Terminal & Usage Data: Selected charting symbols, timeframe settings, indicator overlay configurations, course progress milestones, and technical diagnostic telemetry.
• Network & Device Identifiers: IP address, browser type and version, operating system, device screen resolution, referring URL, and session timestamps.

3. Analytics, Tracking Technologies & Pixels

We deploy tags and analytics scripts exclusively after user consent is granted via our Cookie Consent banner. Non-essential tracking is blocked by default until explicit acceptance:

4. Legal Grounds for Processing

We process your data under the following legitimate legal bases:

• Consent: For marketing communications, cookies, and conversion tracking (Meta Pixel and Google Tag Manager).
• Contractual Necessity: To create and manage your account, deliver active TradingView script access, unlock purchased courses, and fulfill subscription commitments.
• Legal Obligation: To maintain accounting books, comply with tax laws (including GST filings), and prevent fraud.
• Legitimate Uses: As recognized under Section 4 and Section 7 of the DPDP Act 2023 for platform security, server stability, and network defense.

5. Third-Party Data Processors

We share minimal necessary data with vetted third-party data processors bound by confidentiality and data protection obligations:

• Razorpay Software Private Limited: Handles subscription billing, card tokenization, and UPI routing. PCI-DSS Level 1 compliant.
• TradingView, Inc.: Receives your TradingView username strictly to grant server-side invite access to proprietary indicator Pine scripts.
• Google LLC & Meta Platforms, Inc.: Analytics and conversion telemetry (subject to your cookie consent).
• Cloud Infrastructure Providers: Managed database hosting, SSL termination, and serverless compute located in compliant global and Indian data center regions.

6. Data Retention Schedules

We retain personal data only for as long as necessary to fulfill the stated purposes:

• Account Data: Retained for the duration of your active subscription and deleted within 90 days following account closure requests, except where statutory retention applies.
• Tax & Financial Invoices: Retained for 7 (seven) years from the end of the relevant financial year as mandated under Indian tax laws.
• Analytics Logs: Automatically aggregated or deleted after 14 months.

7. Your Rights Under the DPDP Act 2023

As a Data Principal under the Digital Personal Data Protection Act, 2023, you hold the following rights:

• Right to Access: You can request a summary of the personal data being processed and the identities of data fiduciaries or processors with whom your data has been shared.
• Right to Correction & Erasure: You can update inaccurate data or request deletion of data that is no longer required for the purpose for which it was collected.
• Right of Grievance Redressal: You have the right to register a grievance with our designated Grievance Officer and receive an expeditious resolution.
• Right to Nominate: You have the right to designate an individual who, in the event of your death or incapacity, shall exercise your rights as a Data Principal.
• Withdrawal of Consent: You may revoke cookie consent at any time via the consent settings or by emailing our privacy team.