Privacy Policy

1. Scope and who we are

This Privacy Policy explains how Tristack Technologies LLP ("we", "us") handles personal data when you visit quantgrid.in, create an account, link a broker account, use QuantGrid AlgoTrader or ask us about it, or contact us. It applies to the marketing website, to the QuantGrid trade replication platform, and to AlgoTrader, the trading software you install and run on your own computer, on Windows, macOS or Linux.

QuantGrid is the brand and the product. Tristack Technologies LLP is the limited liability partnership that operates it, contracts with you, issues your invoice and answers for the personal data described here. Where this policy says QuantGrid does or does not do something, it is Tristack Technologies LLP making that commitment.

Under the Digital Personal Data Protection Act, 2023 (the DPDP Act), we are the Data Fiduciary for the personal data described here, and you are the Data Principal. We are also an intermediary for the purposes of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, and we publish the Grievance Officer details those rules require in section 14. If you are in the European Economic Area or the United Kingdom, we act as the controller of your data, and section 9 sets out the equivalent rights we honour.

QuantGrid is a technology platform for order replication; its second product, QuantGrid AlgoTrader, is trading software that runs on your own computer; and its third, QuantGrid Static IP, is a static IP address and proxy for software you run yourself. QuantGrid is not registered with SEBI, does not provide investment advice, and never holds your funds or securities. Your money, your holdings and your trading account remain with your own SEBI-registered broker at all times. See Compliance for the full position.

The Data Fiduciary, and how to reach it

Write to privacy@quantgrid.in for anything about your personal data, and to the Grievance Officer in section 14 if a request is not handled to your satisfaction. We answer email Monday to Friday, 8:00 AM to 5:00 PM IST.

2. What we collect

We collect only what the service needs. The table below is the complete list of categories, what each one contains, and where it comes from.

We do not collect special-category data, we do not run credit checks, and we do not buy personal data from data brokers or list vendors.

3. Why we process it, and on what basis

The DPDP Act allows processing either with your consent or for certain legitimate uses. Each purpose below names the categories from section 2 that it draws on, and the basis we rely on. Where we rely on consent, you can withdraw it, and section 9 explains how.

We do not use your data for automated decisions that produce a legal effect on you, and we do not profile you for advertising. Replication itself is automated, but it executes the rules you set: your chosen parent account, your copy factor, your maximum quantity.

QuantGrid AlgoTrader is automated too, on your own computer, and acts only on the rules, strategies and limits you write or configure in it. Those stay on that computer, and we neither see them nor use them for anything.

4. Broker API data

This is the most sensitive thing you entrust to us, so we will be exact about it.

The first three parts of this section describe trade replication, which reads and trades your broker accounts through their APIs from our servers. QuantGrid AlgoTrader reaches your broker from your own computer instead, and the last part sets out what that means for your data.

What we fetch

Once you authorise QuantGrid on your broker consent screen, we hold the access token that broker issues. Using it, we subscribe to the order-update stream for the accounts you have linked and read the order book over REST as a fallback when a socket drops. From those sources we take order and execution events: symbol, exchange, side, quantity, filled quantity, price, product type, order status, broker order id and timestamps. We read positions and holdings when you open a positions view or use square-off. We place child orders on the accounts you have designated as children, at the quantity your configuration produces.

What we do with it

Broker API data is used for exactly three things: running replication for your own linked accounts, showing you your own trade log and positions, and writing the audit trail that lets you reconstruct what happened and when. Nothing else.

What we never do with it

• We never sell it. Not to data buyers, not to brokers, not to research firms, not to anyone.
• We never trade on it. QuantGrid does not operate a proprietary trading book. Your orders are not a signal we act on, front-run or hedge against.
• We never aggregate and sell it as market data. Your order flow is not packaged, anonymised and resold as sentiment, flow or analytics products.
• We never use it to trade for anyone else. One subscriber's order events reach only that subscriber's replication engine, enforced by tenant isolation at the point the broker stream is opened.

Access tokens are encrypted at rest and are never written to application logs. You can revoke our access from your broker console at any time, and the connection stops immediately. You can also disconnect a broker account inside QuantGrid, which deletes the stored token straight away. Historical order records for orders already placed are kept for the retention period in section 7, because they are the audit trail for trades that really happened in your account.

What QuantGrid AlgoTrader shares with us, and what it does not

QuantGrid AlgoTrader connects to your broker from the computer it runs on, with the broker API key and secret you enter in the app and the session from your daily broker login. Those credentials, your strategies and the app's local database stay on that computer, and we never receive them. Market data goes from your broker to the app directly.

Its orders take one route through us. SEBI's framework for retail algorithmic trading requires every order sent through a broker API to come from a static IP address registered with the broker. So the app sends its order traffic to your broker through a QuantGrid relay, which forwards it from your Licence's dedicated static IP address. The connection is encrypted end to end between the app and your broker, so the relay carries your orders without being able to read them or anything else inside the connection. What it sees, and records, is each connection's metadata: the IP address your computer connects to the relay from, the broker host the connection goes to, the dedicated static IP address it leaves from, when it was made, how long it lasted and why it closed, how many bytes passed, how long it took to set up and how quickly your broker answered each request, and the Licence and device it belongs to. It also records each connection it refuses once its secure connection has been set up, with the reason and the IP address the attempt came from; a connection refused before that, including every one from an address blocked after repeated failed sign-ins to the relay, is only counted.

The app also signs in to your QuantGrid account, and checks your Licence and its expiry with us every time it starts and every hour while it runs. When it signs in, it tells us the name the computer's operating system reports for it (the computer name on Windows and on a Mac, the host name on Linux), an identifier the app creates for that computer and a one-way hash of the machine identifier the operating system keeps for it (the MachineGuid on Windows, the hardware UUID on a Mac, the machine-id on Linux). Every request it makes to us, each check included, tells us the app's version, the IP address that computer reaches us from, and the time. Section 7 says how long we keep these records and the relay's, and the commitments under “What we never do with it” apply to them too: we never sell them, never trade on them and never package them as market data.

On the computer, the app keeps its sign-in to your QuantGrid account protected by the operating system. On Windows it is encrypted with Windows' own data protection (DPAPI), so another Windows user, or another computer, cannot read it. On a Mac and on Linux it is encrypted with a key that the system's own key store holds: the macOS Keychain, or on Linux the Secret Service, such as GNOME Keyring or KWallet. Where no key store is available, it is kept instead in a file that only your user account on that computer can read. It is sent to nobody but us.

If the same broker account is also linked to trade replication, the replication platform reads that account through its API as the first part of this section describes, and that includes the orders AlgoTrader places in it.

5. Sharing and processors

We do not sell personal data, and we do not share it for anyone else's marketing. We share it with service providers who process it on our behalf, among them the processors below, each bound by contract to process it only on our instructions, and only for the function named.

Beyond the service providers who process it for us, we disclose personal data only when:

• you tell us to, for example by connecting a Telegram chat or asking us to talk to your broker about a connection problem;
• a law, a court order, a regulator, or a lawful request from a government agency requires it, in which case we disclose the minimum the request covers and, unless we are legally barred, we tell you;
• it is needed to establish, exercise or defend a legal claim, or to investigate fraud or abuse of the platform;
• the business is merged, acquired or reorganised, in which case data moves to the successor under this same policy and we notify you before it takes effect.

Your broker also receives data from us: the orders we place on your instruction. That is the whole point of the service, and your relationship with your broker is governed by the broker agreement and the broker privacy policy, not by this one.

The orders QuantGrid AlgoTrader sends go from the app on your computer to your broker, through our relay and encrypted end to end, so we carry them without being able to read them. Section 4 sets out what the relay does see.

If you sign in with Google, you authenticate on Google's own page and Google tells us your email address and account identifier. That is data flowing from Google to us, not from us to Google, and your use of Google is governed by Google's privacy policy. Sign in with an email address and password instead and Google is not involved at all.

If you sign in with WhatsApp, or add a WhatsApp number to your account, your six-digit code reaches you as a WhatsApp message that Meta delivers for us. Meta receives your mobile number and that message, and tells us whether it was delivered, and your use of WhatsApp is governed by WhatsApp's own terms and Meta's privacy policy. We send you nothing else through WhatsApp on our own initiative: no alerts and no marketing. If you choose to message our support on WhatsApp, Meta carries that conversation too. Sign in with an email address and password, or with Google, and Meta receives nothing about you from us.

6. Cookies and local storage

We keep cookies to a minimum. The public website at quantgrid.in can run two analytics tools, Google Analytics and Microsoft Clarity, which set cookies on our domain (Clarity also sets its own on Microsoft's domains) and are described item by item in the Cookie Policy, but only if you allow them. Neither loads until you choose Allow when the website asks, on your first visit; until then, and if you decline, Google Tag Manager, which loads them, is not loaded either. You can change your choice at any time on the Cookie Policy page. Beyond those two we run no advertising cookies, no cross-site tracking pixels, no retargeting tags and no social-media trackers, the dashboard carries no analytics at all, and we do not sell or share cookie data with anyone. Neither tool is strictly necessary and neither is given anything about your trading. The Cookie Policy sets the same position out in full, item by item, including how your choice is kept and how to change it. This section is the summary, and the two are revised together.

Beyond those two tools, we count traffic from the requests made to serve each page. Those counts are pages and volumes, not people, and section 2 describes what the underlying request metadata contains.

You can block or delete cookies in your browser settings at any time. Clearing site data signs you out of the application. Nothing else changes: every page, price and document stays fully readable. If we add any further optional cookie or third-party script, we will ask for your consent before it runs and revise this section under section 13. If you have a question about a specific cookie, write to privacy@quantgrid.in and we will tell you precisely what it does.

7. How long we keep it

We keep personal data only as long as the purpose in section 3 lasts, or as long as a law requires, whichever is longer. When a period ends, data is deleted or irreversibly aggregated.

Audit and financial records are the exception to erasure. Where Indian tax, company or information-technology law obliges us to retain a record, we retain it for the statutory period even if you close your account and ask for deletion. In that case we restrict the record so it is used for nothing except meeting that obligation, and we delete it when the period expires.

8. How we protect it

We apply reasonable security safeguards appropriate to the sensitivity of the data, as the DPDP Act requires. In concrete terms:

• Encryption in transit and at rest. All traffic runs over TLS. Broker tokens and account secrets are encrypted at rest.
• Tokens are never logged. Access tokens and secrets are excluded from application logs, error traces and telemetry, including the WebSocket handshake URLs that would otherwise carry a token.
• Tenant isolation. Each account's data is bound to its own tenant where the broker stream is opened, so one subscriber's order events cannot reach another subscriber's replication engine.
• A dedicated static IP per account. Your broker API traffic for trade replication leaves from an address reserved to you and never shared with another customer.
• QuantGrid AlgoTrader's broker credentials never reach us. Its broker API key and secret and your daily broker session stay on your computer, and its orders leave from your Licence's own dedicated static IP address, through our relay, encrypted end to end between the app and your broker. Keeping that computer secure is yours, as clause 18.6 of the Terms of Service says.
• Backups that stay in India. Database backups are encrypted, versioned so a bad write cannot overwrite the good copies, and stored in the same Indian AWS region as the database itself.
• Access control. Passwords are stored only as one-way hashes. Production access is limited to the people who need it to operate the service, over authenticated sessions, and administrative actions are logged.
• Append-only audit trail. Every event received, decision taken and broker response is recorded, which is also how we detect anything anomalous.

We hold no security certification and we do not claim one. Security describes these controls in more detail. No system is perfectly secure, so please use a strong unique password, keep your broker 2FA to yourself, and disconnect broker accounts you no longer use. If you use QuantGrid AlgoTrader, keep the computer it runs on locked, updated and to yourself, because your broker API key and secret are stored there.

9. Your rights

As a Data Principal under the DPDP Act you have the following rights. Exercise any of them by emailing privacy@quantgrid.in from the address registered on your account, or by using the contact form at Contact. We acknowledge within 3 working days and respond substantively within 30 days of verifying who you are.

Right to access information

Ask for a summary of the personal data we hold about you, what we are doing with it, and which processors have received it. We return it in a readable format, and the decisions and orders in your trade log are on the Logs and Orders pages of the application at any time, without asking us. What QuantGrid AlgoTrader keeps on your computer is already in your hands, and we cannot read it.

Right to correction and erasure

Ask us to correct anything inaccurate, complete anything incomplete, update anything stale, or erase personal data that is no longer needed for the purpose it was collected for. Account and broker-connection details can be corrected directly in the application. Erasure is subject to the statutory retention in section 7. We cannot erase what QuantGrid AlgoTrader keeps on your computer, because it never reaches us: deleting it there is yours to do.

Right to withdraw consent

Where we rely on consent, you can withdraw it as easily as you gave it: disconnect a broker account to stop broker data processing, unlink your Telegram chat to stop alert delivery, remove your WhatsApp number under Profile in the dashboard to stop WhatsApp sign-in, decline analytics on the Cookie Policy page to stop Google Analytics and Microsoft Clarity loading, or write to us. Withdrawal takes effect going forward and does not make earlier processing unlawful. Withdrawing consent for broker access necessarily stops replication on that account.

For QuantGrid AlgoTrader, write to us to withdraw the consent you gave on the enquiry form, and we stop contacting you about it. The sign-in, the Licence checks and the relay rest on the contract rather than on consent. They continue while the app stays signed in on your computer, including an exit window of up to 24 hours after a Licence ends in which its exits still go through the relay, and they stop when you sign the app out or close your account. Clause 18.5 of the Terms of Service says how to cancel a Licence.

Right of grievance redressal

If any request is not handled to your satisfaction, escalate to our Grievance Officer in section 14 before approaching the Data Protection Board of India. You may complain to the Board if we fail to resolve it.

Right to nominate

You may nominate another individual to exercise these rights on your behalf if you die or become incapacitated. Send the nominee name, relationship and contact details to privacy@quantgrid.in and we will record it against your account. Note that a nomination here covers your personal data with us only. It has no effect on the funds or securities held at your broker, which follow the broker nomination process.

If you are in the EEA or the UK

We honour the equivalent GDPR rights for visitors in the European Economic Area and the United Kingdom: access, rectification, erasure, restriction of processing, data portability, objection to processing based on legitimate interests, and the right to lodge a complaint with your local supervisory authority. Where we rely on a legitimate interest, it is the operation and security of a service you asked for. QuantGrid is built for Indian markets and Indian brokers, and it is not offered to residents of jurisdictions where it would need a licence we do not hold.

Duties that come with these rights

The DPDP Act asks Data Principals not to file false or frivolous complaints, not to impersonate another person when providing data, and to give authentic information when exercising the right to correction. We may refuse a request that is manifestly unfounded or repetitive, and we will say why.

10. Children

QuantGrid is not for anyone under 18. You must be 18 or older to open an account, which matches the requirement to hold a trading account with an Indian broker. We do not knowingly collect personal data from a child, we do not profile children, and we do not direct advertising at them.

If we learn that an account belongs to someone under 18, or to a person with a disability who has a lawful guardian, we will suspend it and delete the associated personal data unless a law requires us to keep a record. If you believe a child has given us personal data, write to privacy@quantgrid.in and we will act on it promptly.

11. Cross-border transfer

Your data is stored in India. The application servers, the PostgreSQL database, the Redis cache and the encrypted backups all sit in the AWS ap-south-1 (Mumbai) region. Your account, your broker connections, your order records and the replication audit trail are held there and nowhere else. Payments run through Razorpay in India, and our transactional email is sent from the same AWS region.

The QuantGrid AlgoTrader sign-in, the Licence checks and the order relay run in the same region, and the records they produce are held there. What AlgoTrader keeps on your computer stays on your computer, wherever that is, and is never transferred to us.

Some processing does take place outside India, including:

• Telegram operates outside India. It receives an alert only where you have linked a Telegram chat to your account, and only the alert text and the chat identifier. Unlink the chat and that transfer stops.
• Meta, which runs WhatsApp, delivers sign-in codes from outside India. It receives your mobile number and the message carrying the code, and only when you sign in or sign up with WhatsApp or add a WhatsApp number. Remove the number and that transfer stops. It also carries any conversation you choose to have with our support on WhatsApp.
• Google Analytics and Microsoft Clarity, the two analytics tools on the public website named in section 2 and in the Cookie Policy, are run by Google and Microsoft outside India, and load only if you allow them. Neither runs in the dashboard or in the QuantGrid AlgoTrader app, and neither is given anything about your trading.

The DPDP Act permits transfer of personal data outside India except to countries the Central Government restricts by notification. We do not transfer personal data to any restricted territory, and if a territory becomes restricted we will move or stop that processing. Wherever data goes, the processor is bound by contract to the same confidentiality, security and purpose-limitation terms set out here, and the protections in this policy travel with your data.

12. Breach notification

If personal data in our care is breached, we will:

1. contain the incident, preserve evidence and begin an investigation as soon as we detect it;
2. notify the Indian Computer Emergency Response Team (CERT-In) within 6 hours of becoming aware, for incident classes the CERT-In directions cover;
3. notify the Data Protection Board of India and every affected Data Principal without undue delay, in the form and manner the DPDP Act and its rules prescribe;
4. tell you plainly what happened, which of your data was involved, what we have done, and what you should do, such as re-authorising broker connections or changing your password;
5. publish a post-incident summary and the fixes made.

We will not quietly absorb an incident that affected you. If you suspect a security problem with your account, write to support@quantgrid.in immediately and revoke API access at your broker console, which stops all replication on that account at once. If it is the computer that runs QuantGrid AlgoTrader you suspect, also regenerate your broker API key and secret at your broker, because they are kept on that computer.

13. Changes to this policy

We update this policy when the product, our processors or the law changes. The current version always carries a last-updated date at the top of this page. This version is effective 2 November 2026.

For a material change, meaning one that expands what we collect, adds a purpose, adds a category of recipient, or reduces your rights, we will give notice by email to your registered address and by a notice inside the application at least 14 days before it takes effect. Continuing to use QuantGrid after a change takes effect means you accept the updated policy. Where the change relies on consent, we will ask for consent again rather than assume it.

This policy sits alongside our Terms of Service, Refund and Cancellation Policy, Disclaimer and Risk Disclosure.

14. Grievance Officer

In accordance with the Information Technology Act, 2000, the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, and the Digital Personal Data Protection Act, 2023, the contact details of our Grievance Officer are published below. The Grievance Officer is the point of escalation for any complaint about how your personal data has been handled.

Email is the route to the Grievance Officer, and a complaint sent to grievance@quantgrid.in is on the record from the moment it arrives. A complaint sent by post to the registered address above is equally valid.

Statutory response window. The Grievance Officer acknowledges every complaint within 24 hours of receipt and resolves it within 15 days, as the IT Rules, 2021 require. Data-protection requests under section 9 are answered within 30 days. Please include your registered email address, the account or broker connection concerned, and what outcome you are asking for, so we can act without a round trip.

If we do not resolve your grievance, you may complain to the Data Protection Board of India under the DPDP Act.