Privacy Policy

Effective date: 26 September 2026 Last updated: 29 September 2026

This Privacy Policy describes how Ask AI Trade, Raipur, Chhattisgarh, India ("we", "us", "our") collects, uses, discloses, and protects personal information when you use Diehard Trader (the "Service") through diehardtrade.com, diehardtrader.com, the dashboard, the MetaTrader 5 expert advisor ("EA"), and any related API.

We are the data controller (under GDPR / UK GDPR) and data fiduciary (under India's Digital Personal Data Protection Act 2023, "DPDP Act") for the personal data described below.

By using the Service you confirm that you have read and understood this Policy. If you do not agree, do not use the Service.

1. What personal data we collect

We deliberately collect the minimum data needed to run the Service. We do not sell personal data, we do not use it for behavioural advertising, and we do not run third-party advertising or marketing trackers on the dashboard.

1.1 Data you give us directly

Account data. Email address and a password (stored only as a one-way hash by Supabase, our authentication provider — we never see your plaintext password).
Billing data. Subscription plan you select (monthly or yearly), preferred payment provider (Razorpay or PayPal), and any billing details you choose to share with us by email. Card numbers, bank details, UPI IDs, and PayPal credentials are entered directly with the payment provider and are never transmitted to or stored on our servers. We only receive a provider-side customer reference, a subscription ID, payment status, and the amount charged.
Support correspondence. Anything you send to [email protected], including any details voluntarily included in support messages.

1.2 Data the Service generates while you use it

License data. A license key and an API key used by the EA to authenticate to our backend.
Connected terminals. Identifiers of the MT5 terminals you connect (broker name, account login number, terminal build, last-seen timestamp). We do not receive your broker password.
Alerts and executions. Each webhook alert you send through the Service is logged with a timestamp, target license, payload metadata, and a record of whether the EA executed it, including order ticket, symbol, side, volume, requested price, executed price (if any), broker response code, and any error message returned by the broker.
Failures and diagnostic events. Errors and rejections returned by the broker or generated inside the EA, including stack traces and timestamps.
Journal. What you choose to add to your trades and days: notes, tags, how you felt, whether you followed your plan, a mood, and screenshots you upload.
AI notes. If AI notes are on (they are by default; turn them off in Settings), we send each closed trade's details and what you wrote about it in your journal to Anthropic, our AI provider, and store the short note it returns. We also record how much AI each account uses, to apply your plan's monthly allowance.
Chat. When you use the chat, we store your messages and the replies, and send each message to Anthropic with the recent conversation and a summary of your last 30 days of trades and journal entries. You can clear the chat at any time.
Audit log. Security- and billing-relevant events — for example, login, subscription start/cancel/renewal, license rotation, password change, suspicious access — along with the IP address of the actor and minimal metadata about the event.

1.3 Data collected automatically

Network metadata. When you visit the website or the dashboard, our reverse proxy (nginx, behind Cloudflare) logs the request IP address, user agent, requested path, response status, and timestamp. This is standard server logging used for security, abuse prevention, and debugging.
Authentication cookies. A Supabase session cookie is set after sign-in. It is required to keep you signed in and to enforce access controls. We do not use marketing, advertising, or analytics cookies. See section 8 for details.
Error telemetry. Application errors (both browser and server) are forwarded to Sentry, our error-monitoring provider. Telemetry can include stack traces, the requested route, the browser type, and an internal user identifier; it can incidentally include the IP address of the request. We have configured Sentry to scrub obvious secrets (auth tokens, cookies, passwords, API keys) before they are stored.

1.4 What we do not collect

We do not collect your broker password.
We do not read or store your TradingView account credentials.
We do not collect bank account numbers, card numbers, UPI IDs, or PayPal credentials.
We do not collect government identification (Aadhaar, PAN, passport, driver licence) from end users. Payment providers may collect these directly during their own KYC; that data is governed by their privacy policies, not this one.
We do not collect biometric data, precise GPS location, health data, or any data about minors (the Service is restricted to adults — see section 11).

2. How we use personal data, and the legal basis

Purpose	Data used	Legal basis (GDPR / UK GDPR)
Create and authenticate your account	Email, password hash, session cookie	Contract (Art. 6(1)(b))
Issue licenses and route your alerts to your MT5 terminals	License key, API key, terminal identifiers, alert payloads, execution records	Contract
Process subscription payments and renewals	Email, plan, provider subscription/customer IDs, payment status	Contract
Send service emails (sign-in, password reset, billing receipts, security alerts)	Email	Contract
Prevent abuse, detect fraud, secure the Service, enforce these terms	IP, user agent, request logs, audit log, failures	Legitimate interest (Art. 6(1)(f)) — running a secure trading-adjacent platform
Debug and improve reliability	Error telemetry, failures, server logs	Legitimate interest
Comply with tax, payment-regulation, anti-money-laundering, and other legal requirements	Billing data, audit log	Legal obligation (Art. 6(1)(c))
Respond to your support requests	Support correspondence	Contract + Legitimate interest

We will only use your data for a different purpose if it is compatible with the original purpose, you have consented, or the law requires or permits it.

Under the DPDP Act (India), our processing is grounded in (i) the contract between us and (ii) the specified legitimate uses set out in section 7 of the Act (e.g., complying with law, responding to medical emergencies as required, employment-related — only the relevant ones apply here).

3. Who we share personal data with

We share data only with the third parties listed below, and only to the minimum extent needed for them to deliver their service. All are bound by their own terms and privacy/security obligations. We do not sell or rent personal data to anyone.

Sub-processor	What it processes	Where	Purpose
Supabase (Supabase, Inc.)	Account data, license data, subscription records, executions, failures, audit log	South Asia (Mumbai, India)	Database, authentication, transactional emails
Razorpay (Razorpay Software Pvt. Ltd.)	Email, billing details, payment data	India	Process card subscription payments
PayPal (PayPal Holdings, Inc.)	Email, billing details, payment data	US / global	Process USD subscription payments
Hostinger (Hostinger International Ltd.)	Server logs, all data stored on the VPS	EU (Mumbai region used here)	Hosting the backend and dashboard
Resend (Resend, Inc.)	Email address, email content	US	Sending account and transactional emails
Anthropic (Anthropic, PBC)	Closed-trade details and journal entries when AI notes are on; chat messages and a summary of your last 30 days when you use the chat	US	Writing the notes on your trades and the chat replies. Under its commercial terms, Anthropic does not train its models on this data
Cloudflare (Cloudflare, Inc.)	IP, request metadata, TLS termination	Global edge	DDoS protection, CDN, DNS
Sentry (Functional Software, Inc.)	Error telemetry, stack traces, route, user id, incidental IP	US / EU	Error monitoring and debugging
UptimeRobot (UptimeRobot Service Provider Ltd.)	Public health-check endpoint responses only — no personal data	Global	Uptime monitoring

We may also disclose personal data:

to comply with a lawful request from a court, regulator, tax authority, or law-enforcement body with jurisdiction over us;
to enforce our Terms of Service;
to protect the rights, property, or safety of Ask AI Trade, our users, or the public;
in connection with a merger, acquisition, or asset sale, in which case we will give notice before personal data is transferred and becomes subject to a different privacy policy.

4. International transfers

Some of our sub-processors are located outside India and outside the European Economic Area (in particular, the United States). Where we transfer personal data internationally:

For transfers from the EEA/UK to a country without an adequacy decision, we rely on the EU Standard Contractual Clauses (and UK equivalents) put in place by the sub-processor, supplemented by appropriate technical and organisational safeguards (encryption in transit, encryption at rest, access controls).
For transfers from India, we transfer only to countries that are not restricted by the Government of India under section 16 of the DPDP Act, and we apply equivalent contractual safeguards.

You can request a copy of the safeguards in place for any specific transfer by writing to us at [email protected].

5. How long we keep your data

We keep personal data only as long as needed for the purposes set out above, or as required by law.

Category	Retention
Account data	While your account is active, plus 30 days after deletion (to allow account recovery), unless you ask us to delete sooner.
License and connected-terminal data	While the license is active, plus 90 days, then deleted.
Alerts and executions	24 months rolling, then deleted. We keep this long enough to support customer dispute resolution.
Failures and diagnostic events	12 months, then deleted.
Audit log	7 years from the event — required for tax, anti-money-laundering, and dispute defence.
Server logs (nginx, fail2ban)	90 days rolling on the VPS.
Error telemetry (Sentry)	90 days rolling, per Sentry's default retention.
Billing records (invoices, payment status)	7 years from the financial year, as required by Indian tax law.
Support correspondence	24 months from the last contact.

When retention expires, data is either deleted or anonymised. Anonymised data may be kept indefinitely for aggregate analytics.

6. Your rights

Depending on where you live, you have the following rights. Some rights have conditions and exceptions — we will explain in our response if any apply.

6.1 Under GDPR / UK GDPR (EEA + UK residents)

Access the personal data we hold about you and receive a copy.
Rectify inaccurate or incomplete data.
Erase ("right to be forgotten") your data, subject to legal retention obligations (e.g., we cannot delete invoices we are required by tax law to keep).
Restrict processing while a dispute or correction is pending.
Object to processing carried out on the basis of legitimate interest.
Portability — receive your data in a structured, machine-readable format.
Withdraw consent at any time, where processing is based on consent (without affecting the lawfulness of earlier processing).
Lodge a complaint with your local supervisory authority. (You can find a list of EU authorities at edpb.europa.eu. The UK supervisory authority is the ICO at ico.org.uk.)

6.2 Under the DPDP Act 2023 (India residents)

Access a summary of the personal data we process about you and the identities of the data fiduciaries / processors we have shared it with.
Correction, completion, updating, or erasure of your personal data.
Grievance redressal — escalate any complaint to our Grievance Officer (section 12).
Nominate another person to exercise these rights on your behalf in case of death or incapacity.
Withdraw consent where processing is based on consent.

6.3 How to exercise your rights

Email [email protected] from the address registered on your account, describing your request. We will respond within:

30 days for GDPR / UK GDPR requests (extendable by up to 60 days for complex requests, with notice).
The timeframes set by the DPDP Act for India residents.

We may need to verify your identity before fulfilling a request that would expose personal data.

7. Security

We take security seriously and have put in place technical and organisational measures to protect personal data, including:

TLS encryption in transit for all dashboard and API traffic;
Encryption at rest at the database layer (Supabase / Postgres);
Row-Level Security policies so users only access their own data;
HMAC-signed transport of your alerts between the dashboard, backend, and EA;
API key rotation for licenses;
Key-only SSH and a firewall (ufw) on the production VPS, with fail2ban blocking brute-force attempts;
Auditing of security-relevant events;
Least-privilege access — only the operator (currently the sole proprietor) has administrative access.

No system is perfectly secure. If we become aware of a personal-data breach that is likely to result in a risk to your rights and freedoms, we will notify the appropriate supervisory authority within 72 hours (where GDPR applies) and notify you without undue delay where required.

8. Cookies

We use only strictly necessary cookies:

Supabase session cookies — keep you signed in and enforce access controls. Without them the dashboard cannot function.
CSRF / security cookies — protect form submissions and authentication flows.

We do not use marketing, advertising, retargeting, social-media tracking, or analytics cookies, and we do not embed third-party advertising tags. Because we only use strictly necessary cookies, we do not show a cookie consent banner — your continued use of the dashboard implies acceptance of cookies that are essential to the Service. You can clear cookies in your browser at any time; if you do, you will need to sign in again.

9. Automated decision-making

We do not make solely automated decisions about you that produce legal or similarly significant effects. Order execution is automated, but it is an instruction you give to a broker via the EA, not a decision we make about you.

10. Marketing

We may send you:

Service emails — sign-in, password reset, billing receipts, important security or policy notices. These are part of the contract and cannot be opted out of while your account is active.
Product updates about new features and material changes — sent infrequently and only to your registered email. You can opt out at any time by replying "unsubscribe" or by emailing [email protected]; we will continue to send transactional service emails.

We do not send unsolicited marketing to anyone other than our registered users.

11. Children

The Service is intended for adults only. We do not knowingly collect personal data from anyone under 18 (or the higher local age of majority, where applicable). Under the DPDP Act, processing data of children (under 18 in India) requires verifiable parental consent and we have chosen not to offer the Service to children. If you believe a child has provided personal data to us, contact [email protected] and we will delete it.

12. Grievance Officer (DPDP Act, India)

In compliance with section 8(10) of the DPDP Act 2023 and rule 11 of the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011:

Grievance Officer: Sandeep Pradhan, Ask AI Trade Address: Raipur, Chhattisgarh, India Email: [email protected]

We will acknowledge grievances within the timelines required by Indian law and aim to resolve them within 30 days.

13. Changes to this Policy

We may update this Policy from time to time. The "Last updated" date above will change accordingly. For material changes (for example, adding a new sub-processor that materially affects data processing, or expanding the purposes of processing), we will notify you by email and/or an in-dashboard notice at least 14 days before the change takes effect.

14. Contact

Privacy questions, data subject requests, or complaints: [email protected].