Privacy Policy
This policy explains what personal data OrderSlip collects, why, who it is shared with, how long it is kept and the rights you have. It is written to meet the Digital Personal Data Protection Act, 2023 and the rules made under it, and the Information Technology Act, 2000 and its rules on sensitive personal data.
1. Who is responsible
WeGrow Finserv, 814, 8th Floor, Millennium Business Hub, Sarthana Jakatnaka, Varachha Road, Surat - 395006, Gujarat ("we") decides how personal data of OrderSlip account users (account owners and team members) is used, and is responsible for it.
Your clients' data. When you add a demat holder, you decide what client data is entered and why. For that data, you are responsible to your client, and we process it only on your instructions to provide OrderSlip. You confirm that you have told your clients about this and have their consent or another lawful basis to share their data and credentials with us.
2. Data we collect
| Category | Examples | Source |
|---|---|---|
| Account data | Name, firm name, mobile, email, password (stored only as a one-way hash), authenticator enrolment, role of each team member | You |
| Billing data | Billing name and address, GSTIN, invoices, payment reference and status. Card, UPI and bank details are entered on the payment gateway's page; we do not store them. | You, payment gateway |
| Demat holder data | Client name, mobile, email, broker client code, group | You |
| Broker credentials (sensitive) | Broker login ID, password, two-factor details (e.g. date of birth or PAN as the broker requires), TOTP secret, API key and secret | You |
| Trading data | Orders and order status, available funds and margin, holdings, positions, alert rules and baskets | You and your broker's API |
| Static IP data | IP address, port, validity and which demat holder it is bound to | Our IP provider |
| Usage and device data | Login times, IP address, browser and device type, pages used, error logs, audit log of actions | Automatically |
| Support data | Tickets, emails, call notes | You |
| Referral data | Partner code or referral link used at sign-up | Cookie / you |
3. Why we use it
- To provide OrderSlip: create your account, log in to each broker, place and track orders, fetch funds, holdings and positions, run alert orders, allocate static IPs.
- Billing and tax: process payments and refunds, issue GST invoices and keep accounting records.
- Security: OTP and authenticator checks, fraud and abuse prevention, audit logs, investigating incidents.
- Service messages: OTPs, order and login alerts, plan and IP expiry reminders, policy changes. You can switch most alerts off in Settings; security and billing messages cannot be switched off.
- Support and improvement: answer tickets, fix errors, understand which features are used (in aggregated form).
- Legal duties: comply with law, court orders and requests from authorities, and defend legal claims.
- Marketing: product news and offers only with your consent. You can unsubscribe at any time.
We do not sell personal data, and we do not use your clients' trading data for our own trading or for advertising.
4. How broker credentials are protected
- Encrypted with AES-256 using keys held in a separate key-management service.
- Write-only: once saved, credentials are never shown again in the app, to you or to our staff. You can only replace them.
- Used by the system only to log in to the broker for the demat holder they belong to, through that holder's static IP.
- Deleted at once when you remove the demat holder or close your account.
5. Who we share data with
- Your broker (e.g. Motilal Oswal): the credentials and order details needed to log in and place orders, as you instruct.
- Static IP provider: only what is needed to buy and renew IPs. No client names or credentials.
- Payment gateways (e.g. Razorpay or Cashfree): to collect payments and process refunds.
- Service providers who process data for us under contract: cloud hosting, encryption key management, SMS / WhatsApp / email delivery, support tools.
- Sales partners: if you signed up through a partner, they see only your firm name, city, plan and payment amounts (excluding GST).
- Authorities: where required by law, a court, SEBI, an exchange, tax authorities or law enforcement.
- Business transfer: if OrderSlip is sold or reorganised, to the new owner, under this policy.
6. Where data is stored
Data is stored on servers located in India. If a service provider processes data outside India, we do so only where Indian law permits and with appropriate safeguards.
7. How long we keep it
| Data | Kept for |
|---|---|
| Broker credentials | Until the demat holder is removed or the account is closed, then deleted at once |
| Account, demat holder and trading data | While your account is active, and 90 days after closure so you can export it; then deleted or anonymised |
| Invoices, payments and tax records | 8 years, as required by tax laws |
| Order records and audit logs | Up to 8 years, for dispute resolution and legal requirements |
| OTP and security logs | Up to 1 year |
8. Security
We use encryption in transit (HTTPS) and at rest, mandatory authenticator-based two-factor login for admins, role-based access, separate static IPs per demat holder, regular backups, access logging and staff confidentiality obligations. No system is completely secure; if a personal data breach occurs, we will inform affected users and the Data Protection Board of India as the law requires.
9. Cookies
- Essential: keep you logged in and secure. These cannot be turned off.
- Preferences: remember settings such as light / dark theme.
- Referral: remember a partner's referral link for up to 60 days.
- Analytics: aggregated usage statistics, only with your consent.
10. Your rights
You can ask us to:
- give you a summary of your personal data and how it is used;
- correct, complete or update it (most of it you can edit in Settings);
- erase it, except where we must keep it by law;
- withdraw consent (for example to marketing). Withdrawing consent does not affect processing already done, and the service may stop if the data is essential to it;
- nominate a person to exercise your rights in case of death or incapacity;
- resolve a grievance about how we handle your data.
Write to infoorderslip@gmail.com. We may need to verify your identity first. If you are not satisfied with our reply, you may complain to the Data Protection Board of India.
If you are a client whose demat account was added by a firm, please contact that firm first; we will help them respond.
11. Children
OrderSlip is meant for adults and businesses. We do not knowingly collect personal data of anyone under 18 as an account user.
12. Changes to this policy
We will post updates here with a new "Last updated" date and email account owners about material changes before they take effect.