Privacy Policy

01 Definitions & Interpretation

In this Privacy Policy ("Policy"), unless the context otherwise requires, the following terms shall have the meanings ascribed to them below:

• "Company", "We", "Us", "Our" refers to Humble Technologies Pvt. Ltd., a company incorporated under the Companies Act, 2013, having its registered office in India.
• "Platform" refers to the website located at humble.trade (or any successor domain), its sub-domains, mobile applications, APIs, algorithmic trading tools, and all related services operated by the Company.
• "User", "You", "Your" refers to any natural or legal person who visits, registers on, browses, or uses the Platform in any manner.
• "Personal Data" means any data about an individual who is identifiable by or in relation to such data, as defined under the Information Technology Act, 2000 and the Digital Personal Data Protection Act, 2023 ("DPDP Act").
• "Sensitive Personal Data or Information" ("SPDI") includes financial information such as bank account details, demat account details, trading credentials, passwords, and similar data as defined under the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011.
• "Services" means the algorithmic trading automation, strategy execution, backtesting, monitoring, and all related features provided through the Platform.
• "Broker" refers to any SEBI-registered stockbroker whose trading API is integrated with the Platform for executing trades on behalf of Users.
• "Cookies" mean small data files placed on your device by a website to store browsing information.
• "Data Principal" means the individual to whom Personal Data relates, as defined under the DPDP Act, 2023.
• "Data Fiduciary" means any person who alone or in conjunction with other persons determines the purpose and means of processing of Personal Data, as defined under the DPDP Act, 2023.

02 About Humble Platform

Humble is a technology platform that provides algorithmic trading automation tools. The Platform enables Users to configure, backtest, deploy, and monitor automated trading strategies that are executed through the Users' own SEBI-registered broker accounts via authorised APIs.

All trading activity initiated through the Platform is subject to the terms, conditions, risk disclosures, and regulatory requirements of the respective Broker. The Company facilitates technology-based trade execution only and is not a party to any transaction between the User and the Broker.

03 Scope of this Policy

This Policy applies to all persons who visit, browse, register on, or use the Platform, whether through the website, mobile application, API, or any other channel. This Policy is applicable regardless of whether you are a registered User, a trial User, or a visitor.

This Policy forms a binding contract between you and the Company. By accessing or using the Platform, you confirm that you have read, understood, and agree to be bound by the terms of this Policy. If you do not agree to this Policy, you must immediately discontinue use of the Platform.

This Policy should be read in conjunction with our Terms of Service, Disclaimer, and Risk Disclosure documents, all of which are incorporated herein by reference. In the event of any conflict, the specific provisions of this Policy relating to data protection shall prevail on matters of privacy and Personal Data.

The privacy practices of third-party brokers, payment gateways, analytics providers, or other external services linked from the Platform are governed by their own respective privacy policies. We do not guarantee the accuracy, integrity, or quality of information available on such third-party websites and do not endorse their practices.

04 Data We Collect

We collect data to provide, operate, maintain, and improve the Platform. The categories of data collected include:

4.1 Information You Provide Directly

• Account Information: Name, email address, phone number, password (stored in hashed form), and other details provided during registration.
• Broker Credentials: API keys, access tokens, request tokens, and other authorisation credentials needed to connect with your broker account. These are encrypted and stored securely and are used solely for the purpose of executing trades on your behalf.
• Trading Preferences: Strategy configurations, parameters, risk limits, instrument preferences, and other settings you configure on the Platform.
• Communication Data: Any messages, feedback, queries, or support requests you send to us via email, chat, or any other channel.
• Payment Information: Billing address, subscription plan details, and transaction records. Full payment card details are processed exclusively by our PCI-DSS compliant payment gateway and are never stored on our servers.

4.2 Data Generated Through Platform Usage

• Trading Activity Logs: Records of trades executed, order status, positions, profit and loss data, and bot performance metrics generated while using the Platform's services.
• Usage Data: Pages visited, features used, session duration, click patterns, frequency and timing of access, error logs, and interaction patterns.
• Device & Technical Data: IP address, browser type and version, operating system, device type, unique device identifiers, screen resolution, time zone, and language settings.

4.3 Data from Third-Party Sources

• Broker API Data: Account balance, portfolio holdings, order book, trade book, margin details, and position data received from your Broker's API upon your authorisation.
• Analytics Providers: Aggregate and anonymised usage data from third-party analytics tools such as Google Analytics.

05 Purpose of Data Collection

Your Personal Data is collected and processed only for lawful, specific, and clearly defined purposes, including:

• To create, maintain, and manage your account on the Platform.
• To execute algorithmic trading strategies on your behalf through your Broker's API, as configured and authorised by you.
• To provide real-time monitoring, bot status updates, performance dashboards, and trade notifications.
• To process payments, manage subscriptions, and issue invoices for paid Services.
• To provide customer support, troubleshoot issues, and respond to your queries.
• To analyse usage patterns and improve the performance, security, functionality, and user experience of the Platform.
• To comply with applicable laws, regulations, legal processes, or enforceable governmental requests, including obligations under the Information Technology Act, 2000, SEBI regulations, DPDP Act 2023, and the Prevention of Money Laundering Act, 2002.
• To detect, prevent, and address fraud, abuse, security incidents, and technical issues.
• To send important service-related communications such as account alerts, system updates, security warnings, and policy changes.
• To send promotional or marketing communications only with your prior explicit consent, with the option to opt-out at any time.

06 Legal Basis for Processing

We process your Personal Data on one or more of the following legal bases as applicable under the Information Technology Act, 2000, the DPDP Act, 2023, and other applicable Indian laws:

• Consent: Where you have provided explicit, informed, and freely given consent for the processing of your data for specified purposes. You may withdraw consent at any time; however, withdrawal will not affect the lawfulness of processing carried out before withdrawal.
• Contractual Necessity: Where processing is necessary for the performance of the contract between you and the Company (i.e., provision of Services you have subscribed to).
• Legal Obligation: Where processing is necessary for compliance with a legal or regulatory obligation, including but not limited to obligations under SEBI regulations, the Income Tax Act, the Prevention of Money Laundering Act, and court or tribunal orders.
• Legitimate Interests: Where processing is necessary for the legitimate interests of the Company, such as fraud prevention, platform security, service improvement, and internal analytics, provided such interests are not overridden by your fundamental rights and freedoms.

07 Sharing & Disclosure of Data

We do not sell, rent, or trade your Personal Data. However, we may share your data in the following limited circumstances:

• With Your Broker: API credentials and trade execution instructions are transmitted to your SEBI-registered broker's systems to execute trades as configured and authorised by you. This is essential for the provision of our core Services.
• Service Providers: With trusted third-party service providers who assist us in operating the Platform, including cloud hosting providers, payment gateways, email delivery services, and analytics providers. All such providers are bound by contractual obligations to protect your data and to use it only for the specific purposes for which it was shared.
• Legal Requirements: We may disclose your data when required to do so by law, regulation, legal process, court order, or government authority, including but not limited to requests by SEBI, income tax authorities, law enforcement agencies, or any other regulatory body.
• Protection of Rights: We may disclose data where we believe, in good faith, that disclosure is necessary to protect the rights, property, or safety of the Company, our Users, or the public, and to enforce our Terms of Service.
• Business Transfers: In the event of a merger, acquisition, reorganisation, bankruptcy, or sale of all or a portion of our assets, your data may be transferred as part of such transaction, subject to the acquirer being bound by the terms of this Policy.

08 Broker & API Integration

The Platform integrates with SEBI-registered brokers (including but not limited to Zerodha/Kite Connect, Dhan, Angel One, Upstox, Fyers, and others) via their official APIs to enable trade execution on your behalf.

• When you connect your broker account, you authorise us to receive API tokens and access certain account information such as order book, trade book, positions, holdings, and margin details, solely for the purpose of executing and monitoring your automated strategies.
• API tokens and credentials are encrypted using industry-standard encryption (AES-256) both at rest and in transit (TLS 1.2 or higher) and are stored in access-restricted environments.
• We do not store your broker login password. We use only the API tokens generated through the official OAuth-based authentication flow provided by your broker.
• You may revoke API access at any time either through the Platform or directly through your Broker's API management console. Upon revocation, we will cease all further access to your broker account.

09 Data Storage & Retention

Your data is stored on servers hosted in India by reputable cloud infrastructure providers that maintain industry-standard security certifications (ISO 27001, SOC 2). We take all reasonable measures to ensure data residency within Indian borders in compliance with applicable laws.

• Account Data: Retained for as long as your account is active, and thereafter for a period of five (5) years after account closure or last activity, whichever is later, to comply with regulatory and legal obligations.
• Trading Logs & Execution Data: Retained for a minimum period of five (5) years from the date of the transaction, or such longer period as may be required under SEBI regulations, the Income Tax Act, the DPDP Act, or any other applicable law.
• Broker API Tokens: Active tokens are stored only while your broker connection is active. Upon disconnection or account deletion, tokens are deleted within 24 hours.
• Usage & Analytics Data: Retained in anonymised or aggregated form for up to twenty-four (24) months for the purpose of platform improvement and analytics.
• Communication Records: Retained for a minimum of three (3) years from the date of communication for service quality and legal compliance.

After the applicable retention period, data will be securely deleted or irreversibly anonymised. We may retain certain data for a longer period where required by law or court order.

10 Your Rights as a Data Principal

In accordance with the Information Technology Act, 2000, the DPDP Act, 2023, and the DPDP Rules, 2025, you have the following rights in respect of your Personal Data:

• Right to Access: You have the right to obtain a summary of your Personal Data being processed by us and the processing activities undertaken.
• Right to Correction & Erasure: You have the right to request correction of inaccurate or misleading Personal Data and the right to request erasure of your Personal Data that is no longer necessary for the purpose for which it was collected, subject to any legal retention obligations.
• Right to Withdraw Consent: Where processing is based on your consent, you have the right to withdraw such consent at any time. Withdrawal of consent will not affect the lawfulness of processing carried out prior to withdrawal. Please note that withdrawal of consent may limit or restrict your ability to use certain features of the Platform.
• Right to Grievance Redressal: You have the right to file a complaint with our Grievance Officer and, if unsatisfied with the resolution, to escalate to the Data Protection Board of India.
• Right to Nominate: You have the right to nominate any individual who shall exercise your rights in the event of your death or incapacity, as per the provisions of the DPDP Act, 2023.

To exercise any of these rights, please contact our Grievance Officer using the details provided in Section 19 below. We will respond to your request within thirty (30) days or such period as prescribed by applicable law.

11 Cookies & Tracking Technologies

The Platform uses cookies and similar tracking technologies (such as local storage and pixel tags) to enhance your experience, remember your preferences, and gather analytical data.

• Essential Cookies: Required for the Platform to function correctly. These include session management, authentication, and security cookies. These cannot be disabled.
• Analytics Cookies: Used to understand how Users interact with the Platform, track performance metrics, and identify areas for improvement. We may use services such as Google Analytics for this purpose.
• Preference Cookies: Used to remember your settings, display preferences, and trading configurations for a personalised experience.

You can manage or delete cookies through your browser settings. However, disabling essential cookies may impair the functionality of the Platform. By continuing to use the Platform, you consent to the use of cookies as described herein.

We do not use advertising or behavioural tracking cookies. We do not serve targeted advertisements on the Platform.

12 Data Security Measures

We implement reasonable security practices and procedures, including technical, organisational, and physical safeguards, to protect your Personal Data against unauthorised access, alteration, disclosure, or destruction, as required under the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, and the DPDP Act, 2023.

• All data in transit is encrypted using TLS 1.2 or higher.
• Sensitive data at rest (including API tokens and credentials) is encrypted using AES-256 encryption.
• Passwords are stored using one-way cryptographic hashing with salt (bcrypt/argon2).
• Access to production systems is restricted to authorised personnel only, with multi-factor authentication and role-based access controls.
• Regular vulnerability assessments and security audits are conducted.
• Automated intrusion detection and monitoring systems are in place.
• Incident response procedures are documented and regularly tested.

13 Third-Party Links

The Platform may contain links to third-party websites, services, or applications, including but not limited to broker platforms, payment gateways, and social media pages. These third-party services are governed by their own privacy policies and terms of service, which we encourage you to review.

We do not control and are not responsible for the privacy practices, content, security, or data handling of any third-party service. Inclusion of a link on the Platform does not constitute endorsement by the Company. Your interactions with third-party services are solely at your own risk.

14 Children’s Data

The Platform and our Services are not intended for individuals under the age of 18 years. We do not knowingly collect, process, or store Personal Data from children or minors. If you are under 18 years of age, you are not permitted to use the Platform.

If we become aware that we have inadvertently collected Personal Data from a minor, we will take immediate steps to delete such data from our systems. If you are a parent or guardian and believe that your child has provided Personal Data to us, please contact us immediately using the details in Section 20.

15 Financial & Trading Disclaimer

• Trading in equities, derivatives, futures, and options involves substantial risk of loss and is not suitable for every investor. You should carefully consider whether trading is appropriate for you in light of your financial condition and ability to bear financial risk.
• Past performance of any strategy, algorithm, or the Platform is not indicative of future results. Backtesting and simulated results have inherent limitations and do not guarantee live trading performance.
• The Company does not provide investment advice, stock tips, recommendations, portfolio management services, or any other advisory service, whether directly or indirectly. All algorithmic strategies are configured, deployed, and executed at the User's sole discretion and risk.
• The Company is not responsible for any financial losses, margin shortfalls, penalties, or any other adverse consequences arising from the use of the Platform, including but not limited to losses caused by system failures, network issues, broker API downtime, incorrect strategy configurations, market volatility, or any other cause.
• The Company shall not be liable for any actions, omissions, delays, or errors of any Broker or third-party service provider integrated with the Platform.
• Algorithmic and automated trading carries additional risks, including but not limited to risks of technology failure, rapid execution of unintended trades, compounding of losses, liquidity risk, and risks related to market data delays or inaccuracies.
• You are strongly advised to consult a qualified, SEBI-registered financial advisor before making any investment decisions.

16 Limitation of Liability

To the fullest extent permitted by applicable law:

• The Company, its directors, officers, employees, agents, and affiliates shall not be liable for any direct, indirect, incidental, special, consequential, or punitive damages, including but not limited to loss of profits, trading losses, loss of data, loss of goodwill, or loss arising out of or in connection with your use of the Platform, regardless of the cause of action and even if the Company has been advised of the possibility of such damages.
• In no event shall the Company's total aggregate liability exceed the amount actually paid by you to the Company for the Services during the twelve (12) months immediately preceding the event giving rise to the claim.
• The Platform and Services are provided on an "AS IS" and "AS AVAILABLE" basis, without any warranties of any kind, whether express, implied, or statutory, including but not limited to warranties of merchantability, fitness for a particular purpose, non-infringement, accuracy, reliability, availability, or uninterrupted service.
• The Company does not warrant that the Platform will be error-free, uninterrupted, secure, or free from viruses or harmful components, or that any defects will be corrected.

17 Changes to this Policy

The Company reserves the right to modify, amend, or update this Privacy Policy at any time, at its sole discretion, without prior notice. The revised Policy will be effective immediately upon publication on the Platform, and the "Last Updated" date at the top will be revised accordingly.

It is your responsibility to periodically review this Policy to stay informed of any changes. Your continued use of the Platform after the publication of a revised Policy constitutes your acceptance of and agreement to the updated terms.

For material changes that significantly affect your rights or obligations, we will make reasonable efforts to notify you via email or a prominent notice on the Platform. However, the absence of such notification shall not affect the enforceability of the updated Policy.

18 Governing Law & Jurisdiction

This Privacy Policy shall be governed by and construed in accordance with the laws of the Republic of India, including but not limited to the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, the Digital Personal Data Protection Act, 2023, the DPDP Rules, 2025, and such other applicable laws, rules, and regulations.

Any disputes arising out of or in connection with this Policy shall be subject to the exclusive jurisdiction of the competent courts located in India. The Company shall also have the right to initiate proceedings in any court of competent jurisdiction as it may deem appropriate.

If any provision of this Policy is found to be invalid, illegal, or unenforceable, the remaining provisions shall continue in full force and effect.

19 Grievance Redressal

In accordance with the Information Technology Act, 2000 and rules made thereunder, and the DPDP Act, 2023, we have designated a Grievance Officer who can be contacted for any complaints, concerns, or questions regarding your Personal Data or this Privacy Policy:

If you are not satisfied with the resolution provided by the Grievance Officer, you may escalate your complaint to the Data Protection Board of India in accordance with the provisions of the DPDP Act, 2023.

20 Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, you may contact us at:

By using the Platform, you acknowledge that you have read and understood this Privacy Policy in its entirety and agree to the collection, use, and processing of your information as described herein.