Privacy Policy
In short: we keep your email, an encrypted Zerodha session token, and the watchers your AI sets up. Programs your AI sends are kept for a day; what they print goes back to your AI, not into our database. We never see your Zerodha password. We do not sell data or run ads. You can disconnect, cancel watchers or delete your account whenever you like.
The full policy below is what actually applies.
1. Who this policy covers
This policy explains how Certus Innovations Private Limited (“we”, “us”) handles personal data when you use markets (the “Service”): the website at https://slash.markets, the account application at https://app.slash.markets, the connector used by AI assistants, and the emails we send. It is written to meet the Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000. We are the data fiduciary for the data described here.
The policy does not cover Zerodha, Anthropic, OpenAI or any other company whose products you use alongside the Service. Their own policies apply to what they collect.
2. What we collect
Account
- Your email address, and the date you created the account.
- A one-way hash of each sign-in code we send you, with its expiry and the time it was used. We never store the code itself.
Zerodha connection
- Your Zerodha client ID and the display name Zerodha returns, the time you connected, and when the session is expected to end.
- The Kite Connect session token Zerodha issues for your account, stored encrypted (AES-256-GCM). It is decrypted only inside our server at the moment a request is made to Zerodha on your behalf. We never receive your Zerodha password, PIN, two-factor code, bank details or PAN.
Use of the Service through an AI assistant
- The programs your AI assistant sends to run. We keep each one on the server for up to 24 hours so failures can be diagnosed, then delete it. We do not store the data those programs fetch from Zerodha, nor what they print, beyond returning it to the assistant.
- Files a program chooses to save in your private workspace on our server, until you delete them or your account is deleted.
- The connector registration your AI assistant creates (its name and redirect addresses) and one-way hashes of the access and refresh tokens we issue to it.
Watchers
- Each watcher’s symbol, description, the program that evaluates it, its schedule and market, the latest value it reported, and the history of alerts it raised.
Technical
- Server logs with the IP address, request path, timestamp and user agent of requests to the Service, kept for up to 30 days for security and troubleshooting.
- Email delivery metadata (address, subject, delivery status) held by our email provider.
We use no advertising trackers and no third-party analytics on the account application. The application keeps your sign-in session in your browser’s local storage; it does not set tracking cookies.
3. Why we use it and on what basis
| Purpose | Data | Basis |
|---|---|---|
| Signing you in and securing your account | Email, sign-in code hashes, server logs | Performance of our agreement with you; legitimate security interest |
| Reading your Zerodha account and market data for you | Zerodha client ID, encrypted session token | Your consent, given when you log in to Zerodha through the Service |
| Running the programs your AI assistant sends | Programs, workspace files, connector tokens | Performance of our agreement with you |
| Checking watchers and emailing alerts | Watcher definitions and results, email address | Your consent, given when you ask the assistant to create a watcher |
| Telling you when your Zerodha session has ended | Email address, connection status | Performance of our agreement with you |
| Preventing abuse and keeping the Service available | Server logs, request counts | Legitimate interest; legal obligation |
We do not sell personal data and we do not use it for advertising.
5. Where your data is stored
Account, connection and watcher records are stored in a database in Singapore. The connector and watcher servers that run programs and hold the encrypted session token in memory are in Bangalore, India. The website and account application are served from the United States and from edge locations near you. Emails are sent from the United States. By using the Service you consent to this processing outside India, which we carry out under contracts that require our providers to protect your data.
6. How long we keep it
| Data | Retention |
|---|---|
| Account (email) | Until you ask us to delete your account, or 12 months after your last sign-in |
| Sign-in code hashes | Deleted within 7 days of expiry |
| Zerodha session token | Replaced on each login; erased when you disconnect, when Zerodha reports the session ended, or when your account is deleted |
| Programs sent by your AI assistant | Up to 24 hours |
| Workspace files | Until you delete them or your account is deleted |
| Connector tokens | Access tokens 1 hour, refresh tokens 30 days; records purged a day after expiry |
| Watchers and alert history | Until you cancel the watcher and we purge finished watchers, or account deletion |
| Server logs | Up to 30 days |
7. How we protect it
- All traffic to the Service is encrypted in transit (TLS).
- Zerodha session tokens are encrypted at rest with AES-256-GCM under a key held only on our servers; sign-in codes and connector tokens are stored as one-way hashes.
- Programs run in a separate process with no access to your Zerodha token, other users’ data or our configuration; they reach Zerodha only through a gateway that enforces read-only access and rate limits.
- Servers are hardened (least-privilege service accounts, restricted filesystem, firewalled ports) and access to production data is limited to the people who operate the Service.
- The Service is open source, so its handling of your data can be inspected at https://github.com/MADHAN-CJ/zap-kite-mcp.
8. Your rights and choices
Under the Digital Personal Data Protection Act, 2023 you may:
- ask for a summary of the personal data we hold about you and how it is used;
- ask us to correct or update it;
- ask us to erase it, subject to any record we must keep by law, by asking us to delete your account;
- withdraw consent at any time, with effect for the future;
- nominate a person to exercise these rights on your behalf if you cannot;
- complain to us through the Grievance Officer below and, if unresolved, to the Data Protection Board of India.
You can act on most of these yourself:
- Stop Zerodha access: choose Disconnect on your account page. The stored token is erased immediately.
- Stop watchers: pause or cancel them on your account page.
- Stop the AI connector: remove the connector in your AI assistant’s settings; its tokens expire and are purged.
- Delete your account: email support@revise.network from your account email. We delete your account, connection, watchers and workspace within 30 days and confirm by email.
9. Children
The Service is for adults who hold a trading account. We do not knowingly collect data from anyone under 18. If you believe a minor has created an account, contact us and we will delete it.
10. Changes to this policy
We may update this policy as the Service changes. The “last updated” date above shows the current version. For material changes we will notify you by email or on the account page before they take effect.
11. Contact and grievance officer
Privacy questions and requests: support@revise.network
Grievance Officer under the Information Technology Act, 2000 and the Digital Personal Data Protection Act, 2023:
Mehul Parmar
Certus Innovations Private Limited, 412 2nd, 3rd, and 4th Floors, Duru House, Juhu Tara Road (Next to JW Marriott), Juhu, Vile Parle West, Mumbai, Maharashtra 400049
mehul@revise.network
We acknowledge grievances within 24 hours and aim to resolve them within 15 days.