Privacy Policy

• Email address — collected at registration. Used for your account and essential service communications (receipts, password resets, important product updates).
• Password — stored as a one-way hash (bcrypt). We cannot read your password. Even we don't know what it is.
• Watchlist, portfolio, and saved filters — stored in your account so they sync across devices and survive logouts.

• Server logs — IP address, pages visited, API calls. Used for security, debugging, and rate limiting. Retained for 30 days.
• Session token — a random string stored in your browser to keep you logged in. Not used for tracking.
• API watermarks — an identifier in API responses tied to your account. Used to detect if data is being scraped or redistributed in violation of our Terms.

We do not store your card or UPI details. All payments are processed by Razorpay, subject to their privacy policy. We store only your subscription tier, your plan, and your renewal date.

Your data is used for exactly four things: to operate your account, to deliver the service you've paid for, to send essential service emails, and to enforce our Terms of Use.

We do not sell your data. We do not run ads. We do not build advertising profiles. We do not use Google Analytics, Facebook Pixel, or any third-party tracking. We do not share your trading patterns, watchlist, or portfolio with anyone — not brokers, not data aggregators, not "trading insights" companies. Not anyone.

If we ever change this policy, we'll tell you in the most direct way possible — by email — and you'll have a chance to delete your account before any change takes effect.

We share minimal data with the small set of services required to run the platform:

• Razorpay — payment processing (handles all card and UPI data on their PCI-compliant infrastructure)
• Hetzner Cloud — server infrastructure (Nuremberg, Germany)
• Cloudflare — DNS and DDoS protection
• DeepSeek — AI processing for Sanjaya questions (your question text is sent for inference, but no account identifier is shared)

No other third parties receive your data. If required by Indian law, court order, or government authority, we may disclose information to the extent legally required — but only that, and only after careful review.

Your data is stored on Hetzner Cloud servers in Nuremberg, Germany. We protect it with bcrypt password hashing, HTTPS encryption, server-side firewall restrictions, and regular automated backups. No system is perfectly secure — if you discover a vulnerability, please report it responsibly to info@kasauti.in.

Account data is retained while your account is active. If you cancel and stop logging in, your data stays in the database for 12 months in case you change your mind, then it's permanently deleted. Payment records are retained for 7 years as required by Indian tax law. If you want your account deleted immediately, email us and we will handle it within 7 days.

Kasauti stores a session token in your browser's localStorage to keep you logged in across visits. We also store your last-used filter settings locally so the screener remembers your preferences. That's it.

We do not use advertising cookies. We do not use tracking cookies. We do not use third-party analytics cookies. There is no cookie banner because there are no cookies that need consent.

You can:

• Access your data — log in and see everything we have about you
• Export your data — email us and we'll send you a JSON export of your account, watchlist, and portfolio
• Correct your data — change your email, password, or other details from your account settings
• Delete your account — email us and we'll permanently delete everything within 7 days
• Object to processing — write to us and we'll work it out

If we make material changes to this policy, we will update this page and revise the "Last updated" date. For significant changes, we will notify all registered users by email at least 14 days before the change takes effect. Continued use of Kasauti after notification constitutes acceptance.