This is a working template prepared for review by qualified counsel in the United States, India, the United Kingdom and the European Union. It is not yet in force and creates no rights or obligations until a final version is published.
- We collect what we need to run an investing service safely: your account, verification status, the broker data you authorise, your policy and how you use the product.
- We do not sell your personal information or share it for cross-context behavioural advertising without your opt-in.
- We never ask for or store your broker password. Broker tokens are encrypted with managed keys.
- You can access, correct, export and delete your data, subject to records the law requires us to keep.
- Regional sections explain your extra rights in the EU and UK, India and the US.
The summary helps you navigate; the sections below are the document.
1Who is responsible
The AlgoNexus entity that provides the Service in your country is the controller (in India, the “data fiduciary”) of your personal data.
| Legal entity | [AlgoNexus legal entity name], a company incorporated in [jurisdiction] |
| Company number | [registration number] |
| Registered office | [registered office address] |
| Website | www.algonexus.trade |
Data Protection Officer: [name], dpo@algonexus.trade. EU representative (GDPR Art. 27): [name and address]. UK representative (UK GDPR Art. 27): [name and address].
2What we collect
| Category | Examples | Source |
|---|---|---|
| Identity and contact | Name, email, phone, country, date of birth | You |
| Verification (KYC) | Verification status and reference; in India PAN-based status. We store the outcome, not copies of your documents, unless the law requires otherwise. | You, our KYC provider |
| Financial profile | Goals, horizon, risk-questionnaire answers, tax regime or account type, investment policy and its versions | You |
| Broker data | Holdings, cash, orders, fills and statements from accounts you connect; encrypted access tokens | Your broker, with your authorisation |
| Decisions and audit | Ideas shown, approvals, rejections, risk-gate results, orders and reports | Generated by the Service |
| Billing | Plan, invoices, payment status. Card details are handled by Stripe, Razorpay, Apple or Google — we never see full card numbers | You, payment providers |
| Support | Chat transcripts with Nexus Assist and our team, emails, call notes | You |
| Device and usage | IP address, device and browser type, security events, pages and features used (analytics only with consent where required) | Your device |
3How we use it, and our legal bases
| Purpose | EU / UK legal basis |
|---|---|
| Provide the Service: accounts, broker connections, ideas, Autopilot, reports | Contract |
| Identity verification, anti-money-laundering, sanctions screening, record-keeping | Legal obligation |
| Suitability and appropriateness (once regulated) | Legal obligation; contract |
| Security, fraud and account-takeover prevention | Legitimate interests; legal obligation |
| Improving models and the product using de-identified or aggregated data | Legitimate interests (you may object) |
| Product analytics via cookies or SDKs | Consent |
| Marketing emails and campaign measurement | Consent (or soft opt-in where permitted; you can always opt out) |
| Handling complaints and legal claims | Legitimate interests; legal obligation |
Where we rely on consent you can withdraw it at any time, without affecting earlier processing.
4Automated decisions and profiling
Our models profile your financial situation and preferences to generate ideas and, in Autopilot, to place orders within the policy you sign. You choose whether to use Autopilot, every order is bounded by your policy, and you can stop it at any time.
Where a decision based solely on automated processing would have a legal or similarly significant effect on you, you have the right to obtain human review, to express your view and to contest the decision. Ask at privacy@algonexus.trade. See also our AI Transparency Statement.
6International transfers
We and our providers process data in the countries listed on the sub-processors page. Transfers out of the EEA use the European Commission’s Standard Contractual Clauses or an adequacy decision; transfers out of the UK use the UK International Data Transfer Agreement or the UK Addendum to the SCCs, or UK adequacy regulations. Transfers out of India follow the DPDP Act and any restrictions notified by the Government of India. Copies of safeguards are available on request. [counsel to confirm hosting regions per market, including any data-localisation needs]
7How long we keep it
| Data | Retention |
|---|---|
| Orders, communications and audit records | 5–7 years after the record is created, depending on the market’s record-keeping rules [verify per market] |
| KYC and AML records | 5 years after the relationship ends (longer where the law requires) |
| Account and profile data | While your account is open, then up to 12 months unless needed for the records above |
| Support chats | 3 years |
| Security logs | Up to 13 months |
| Analytics data | Up to 14 months, pseudonymised |
8How we protect it
Encryption in transit and at rest, broker tokens encrypted with managed keys, least-privilege and time-boxed staff access with every support view shown to you, multi-factor authentication for staff, independent penetration testing and a tamper-evident audit log. More on our Security page. No system is perfectly secure; if a breach affects you, we will notify you and the relevant regulators as the law requires.
9Your rights
Depending on where you live, you can: access your data and get a copy; correct it; delete it; export it in a portable format; restrict or object to processing; withdraw consent; and opt out of marketing. In-app: Settings → Privacy. Or email privacy@algonexus.trade. We will verify your identity before acting and respond within the time the law sets (one month in the EU/UK, 45 days under the CCPA).
Manage cookies at any time: .
10EU and UK residentsEUUK
- The rights above are provided under the GDPR and the UK GDPR with the Data Protection Act 2018.
- You can complain to the supervisory authority where you live or work. In the UK this is the Information Commissioner’s Office (ico.org.uk). Our lead EU authority is [authority, if a main establishment exists].
- Non-essential cookies are set only with your prior consent (ePrivacy Directive; UK PECR).
11IndiaIN
- Under the Digital Personal Data Protection Act, 2023 and its Rules, you (the data principal) may access a summary of your data and its processing, correct and erase it, nominate another person to exercise your rights, and seek grievance redressal.
- Consent is requested in clear, itemised terms and can be withdrawn as easily as it was given, including through a registered consent manager where available.
- Grievance Officer: [name], grievance@algonexus.trade. We respond within the period prescribed by the Rules. If you are not satisfied, you may complain to the Data Protection Board of India.
- We will notify you and the Board of any personal-data breach as the Rules require, and report cyber incidents to CERT-In within its prescribed timelines.
12United States — including CaliforniaUS
- Categories collected in the last 12 months: identifiers; customer records; commercial and financial information; internet activity; geolocation (approximate, from IP); inferences (risk profile). Sensitive personal information (account log-in, government ID numbers used for verification) is used only for permitted purposes, and we do not use it to infer characteristics.
- No sale or sharing for cross-context behavioural advertising without opt-in. We honour Global Privacy Control signals as a valid opt-out request.
- Your rights under the CCPA/CPRA and other state laws: to know, delete, correct, opt out of sale/sharing, limit use of sensitive data, and not be discriminated against for exercising them. You may use an authorised agent.
- Some information we receive from brokers may also be subject to the Gramm-Leach-Bliley Act; where it is, that law and our GLBA notice apply instead. [counsel to confirm GLBA / Reg S-P status]
- Requests: privacy@algonexus.trade or toll-free [number].
13Children
The Service is not intended for anyone under 18. Custodial accounts for minors, where offered, are opened and controlled by a parent or guardian, and we process the minor’s data only as needed for that account.
14Changes and contact
We will tell you about material changes in the app or by email before they take effect. Contact our privacy team at privacy@algonexus.trade or the DPO at dpo@algonexus.trade.