Privacy Policy

Effective date: 12 October 2026

Zensibly is a product of BINARIFY LLP, No. 16, Kammanahalli Main Road, St. Thomas Town, Bengaluru, Karnataka 560084, India ("Zensibly", "we", "us"). We are the data fiduciary for the personal data described here. This Policy is issued under the Information Technology Act, 2000 and the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and is written to meet the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025. It applies to zensibly.com and the Zensibly web and mobile apps (the "Service").

In plain language

We collect what we need to run your account, connect to your broker and enforce the rules you set — and nothing we don't. Your broker API keys are encrypted and are used only to read your account and to place the orders you initiate or your rules trigger. We never sell your data. Payment card and bank details go to our payment gateway, not to us. You can see, correct, export or delete your data from Settings or by emailing privacy@zensibly.com.

1. What we collect, why, and for how long

We do not collect your broker login password, bank account numbers, full card numbers, PAN, Aadhaar or other government IDs. We do not use automated decision-making about you other than executing the rules you set yourself.

2. Where the data comes from

From you (sign-up, settings, uploads, support); from your broker's API (only after you connect it); from our payment gateway (transaction status); and from your device (technical data). We do not buy data about you or combine it with data from data brokers.

3. How we use broker credentials — precisely

Your API key and secret are used to obtain a daily access token and to call your broker's API for: reading positions, orders, holdings, funds and P&L; streaming market data and order updates; placing, modifying and cancelling orders you initiate in Zensibly; placing exit orders, cancelling orders or invoking your broker's kill-switch when a rule you set triggers; and nothing else. We never use your credentials to place orders you did not initiate or that your rules did not trigger, and we never use them for any other user or purpose.

4. Who we share data with

We share personal data only with:

• Your broker(s) — the API calls above, under your credentials. Your broker is an independent data fiduciary under its own policy.
• Payment gateways — Razorpay Software Private Limited and Cashfree Payments India Private Limited, who process payments and mandates under their own policies and RBI rules. They receive your name, email, phone, plan and amount; card and bank details are entered directly with them.
• Cloud hosting — Akamai Technologies (Linode), data centres in India, who store data on our behalf under contract.
• Email/notification providers — to send service emails, alerts and digests.
• Analytics and error-tracking providers — pseudonymised usage and crash data; you can change website analytics preferences using “Analytics preferences” in section 7 of this policy.
• Professional advisers — accountants, auditors, lawyers, under confidentiality, where needed.
• Authorities — SEBI, exchanges, courts, police or regulators where the law requires, or to establish or defend legal claims.
• A successor — if BINARIFY LLP is restructured or the Service is transferred, with notice to you and on the same terms.

We do not sell personal data, and we do not share it with advertisers.

5. Where data is stored and cross-border transfer

Data is stored on servers in India. Some service providers (for example email delivery, error tracking or website analytics) may process limited data outside India; where they do, we use providers that offer contractual safeguards and we transfer only what the function needs, in line with the DPDP Act.

6. Security

We use encryption in transit (TLS) and at rest; broker secrets are encrypted with keys separate from the database and are never written to logs; passwords are stored only as salted hashes; access to production systems is restricted, logged and reviewed; daily broker tokens expire automatically; each user's order-placement IP is dedicated to that user; backups are encrypted; and we monitor for unauthorised access. No system is perfectly secure; if a breach affecting your personal data occurs, we will inform you without undue delay and notify the Data Protection Board of India and CERT-In within the time the law requires, with what happened and what to do.

7. Cookies and similar technologies

We use strictly necessary cookies for sessions, security and preferences such as theme. On supported public website pages, Google Analytics starts automatically unless you have previously declined it. It uses cookies to measure visits, pages viewed and selected button clicks. You can turn analytics off or on using “Analytics preferences” in this section. We keep your saved choice and do not treat an automatic visit as an explicit consent choice. Advertising personalisation and Google signals are disabled. We exclude query strings and URL fragments from the page addresses sent to Analytics. Learn how Google uses information from sites that use its services. You can also control cookies in your browser; blocking necessary cookies may stop the app working.

On the same public pages we also use Microsoft Clarity to understand how the pages are used: clicks, scrolling and mouse movement, shown to us as heatmaps and as replays of a visit. Anything you type into a form is hidden from Clarity. Clarity never runs inside your account, or on sign-in, sign-up or payment pages. It follows the same “Analytics preferences” choice as Google Analytics: if you turn analytics off, Clarity does not load and its cookies (_clck, _clsk) are removed. We tell Clarity you have agreed only if you chose “Allow analytics”; otherwise it runs without a consent signal, which in some regions means it uses no cookies at all. Microsoft processes this data for us and may store it outside India; see the Microsoft Privacy Statement.

On the same public pages we also use the Meta Pixel, and send the matching events from our server through Meta’s Conversions API, to measure whether our ads on Facebook and Instagram lead to people requesting a Trading Rule Check link or creating an account, and to show those ads to people more likely to find them useful. It follows the same “Analytics preferences” choice: if you turn analytics off, the Pixel stops, its cookies (_fbp, _fbc) are removed and our server sends Meta nothing about you. It never runs inside your account, or on sign-in, sign-up or payment pages, or on the page a Rule Check email link opens. When you request a Rule Check link or create an account, we send Meta that this happened, together with your email address in scrambled (hashed) form, your IP address and browser type, and Meta’s own cookie values, so Meta can match it to an ad you saw; Meta does not receive your name, your trades or any check results. Meta Platforms Ireland Limited and Meta Platforms, Inc. process this data and may store it outside India; see the Meta Privacy Policy.

Unless you have turned analytics off, opening a page on our website also sets a cookie called phx_vs. It holds a random value that lets us recognise the same visit for up to 24 hours, so that a visit and any survey answers from it can be read together. It is not made from your IP address, browser or account, and we keep only a scrambled (hashed) copy of it. With that visit we keep the first page you opened, where your browser said you came from (for example YouTube, a search engine, another website or a campaign link, and that link's campaign name, medium and ad label), and, once a page of the visit is recorded or a survey is shown, your approximate city and region and your type of device and browser. Visitors may be shown an optional survey of one or two questions on our homepage. We store the answers anonymously with a reference to that visit, the traffic source the browser reported (a search engine's name or another website's address, never the full link you followed), the survey version, and your approximate city and type of device. The survey never asks for your name, email address or phone number. If you turn analytics off, we stop collecting survey activity and request removal of this cookie and closure of the visit. It also expires within 24 hours. If you request a Trading Rule Check link or create an account during such a visit, we note where that visit came from (source, campaign and ad label, never the visit itself) against a scrambled copy of your email address or your account, so we can tell which of our ads and links bring people who sign up. Those notes for Rule Check links are deleted after 180 days without a new request.

When we switch it on, we may also record how a visit uses our public website pages, using our own copy of the open-source rrweb recorder: what appears on screen, scrolling, clicks and taps, which sections are visible and for how long, and which buttons lead where. We use these recordings to see where visitors stop and what is unclear. Anything you type is hidden, and recording never runs on sign-in, sign-up, payment pages, the rule-check upload or inside your account. Recordings are stored on our own servers in India, linked only to the anonymous visit reference above, and seen only by our admins. They follow the same “Analytics preferences” choice: if you turn analytics off, recording stops and what was already recorded for that visit is deleted.

When you open a page on our website, we send ourselves a short notice with the page, the site that linked you here, your approximate city and your type of device and browser. We may wait to send it until you have spent some time on the site: to know that, the page tells us every 10 seconds how long it has been on your screen, and we keep that running count for at most one hour. We don't store your IP address for this, and it stops if you turn analytics off. City data: IP Geolocation by DB-IP.

8. Your rights

Under the DPDP Act and applicable law you can, at any time, from Settings → Privacy or by emailing privacy@zensibly.com:

• Access a summary of the personal data we hold about you and how it is used;
• Correct or update inaccurate or incomplete data;
• Export your trade history and rules in a machine-readable format;
• Erase your data by deleting your account (we retain only what tax or other law requires, and delete the rest within 30 days);
• Withdraw consent — disconnect a broker (keys deleted immediately), turn off analytics, or unsubscribe from marketing — without affecting the lawfulness of processing before withdrawal; withdrawing consent for broker connections means the Service cannot operate for that broker;
• Nominate a person to exercise these rights for you if you are unable to;
• Complain to our Grievance Officer (below), and if unsatisfied, to the Data Protection Board of India.

We respond to requests within 30 days, sooner where we can. We may ask you to verify your identity first.

9. Children

The Service is for adults aged 18 and over. We do not knowingly collect data from anyone under 18; if we learn we have, we delete it.

10. Retention summary

Trading Rule Check: Uploaded tradebook files are available for 24 hours, then removed by automatic cleanup. You can delete an uploaded file earlier. We keep the name, email address, verification record, broker/rule check summaries and paid-signup history indefinitely for follow-up and lead tracking. File deletion and signing out do not delete these lead records. There is no automatic expiry for this lead history.

Website recordings: recordings of website visits (described in Section 7) are kept indefinitely; there is no automatic expiry, and a visit’s recordings are deleted if you turn analytics off. Storage is capped, and recording stops when the cap is reached.

Website survey: anonymous survey answers and the visit reference they belong to are kept indefinitely; there is no automatic expiry. They contain no name, email address or phone number.

Website visits: the anonymous visit record described in Section 7 (its reference, first page, reported source and campaign name, approximate place, and device and browser type) is kept indefinitely, together with that visit's recordings and survey answers. The count of time spent on the site for visit notices is kept for at most one hour.

For other Service data, we keep it only as long as the purpose in Section 1 requires, then delete or anonymise it. Accounts inactive for 12 months receive a notice and are deleted 30 days later unless you sign in. Anonymised, aggregated statistics (which cannot identify you) may be kept to improve the Service.

11. Grievance Officer and contact

Perumal Nallaswamy, Designated Partner & Grievance Officer
BINARIFY LLP, No. 16, Kammanahalli Main Road, St. Thomas Town, Bengaluru, Karnataka 560084, India
Email: privacy@zensibly.com · Phone: +91 88923 95952 (Mon–Fri 9:00–18:00 IST; live-trading issues 8:30–16:00 IST on market days)

Grievances are acknowledged within 48 hours and resolved within the period required by law.

12. Changes to this Policy

We will notify material changes by email and in the app at least 15 days before they take effect. The "Effective date" at the top shows the current version; earlier versions are available on request.

This Policy is an electronic record under the Information Technology Act, 2000 and does not require a physical signature.