1. Information we collect
- Account information — your name and email address, and the authentication identifiers used to sign you in (including via Google sign-in, if you choose it).
- Trade & journal data — the trades, executions, screenshots, CSV/XLSX files, tags, and notes you import or enter. You control what you upload; please do not include more personal data than you need.
- Billing information — your plan and subscription status, and the invoice records we are required to keep. Card and payment details are collected and processed directly by our payment processors (Stripe and Razorpay); we never receive or store your full card number.
- Broker connection metadata — where you connect a broker, we store connection metadata (such as the broker name and connection status). We do not expose your broker credentials or access tokens to you or to third parties, and they are never included in your data export.
- Usage & device data — server logs, approximate location derived from your IP address, browser/device information, and diagnostic data used to operate, secure, and improve the Service.
- Optional contact channels — a Telegram chat ID and/or a notification email address, only if you opt in to reminders and notifications.
- Support & feedback — the messages, email address, and page context you send us through the in-app feedback form or by email.
2. How we use your data and our lawful bases
Where the EU/UK GDPR or similar laws apply, we rely on the following lawful bases:
- Performance of a contract — to create and secure your account, import and store your trades, compute statistics, generate reviews, provide support, and process payments and subscriptions.
- Legitimate interests — to keep the Service secure and prevent fraud and abuse, to understand aggregate usage so we can improve the product, and to send you service and account communications. We balance these interests against your rights.
- Consent — where you opt in to optional features such as Telegram or email reminders, and (where required) for non-essential analytics. You can withdraw consent at any time.
- Legal obligation — to keep tax and accounting records and to respond to lawful requests.
We do not sell or rent your personal data, and we do not use it for third-party advertising.
3. AI processing of your trades
To generate written reviews and, where you use it, screenshot extraction, the relevant data you provide is processed by AI providers on our behalf — Anthropic (Claude), accessed either directly or through Microsoft Azure AI Foundry — under contractual confidentiality and data-protection terms. This processing is carried out to provide the Service to you. We do not use your private trade data to train third-party public models, and our providers are contractually restricted from doing so.
4. Sub-processors and how we share data
We share personal data only with the service providers we rely on to run the Service, each bound by a data-processing agreement and permitted to use your data only to provide their service to us:
- Google Cloud — hosting, database, and file storage (primary region: India, asia-south1, Mumbai).
- Stripe — payment processing and invoicing for customers paying in USD and other currencies (global).
- Razorpay — payment processing and recurring billing for customers paying in Indian Rupees (India).
- Anthropic and Microsoft Azure AI Foundry — AI analysis of your trades to generate reviews and, optionally, screenshot extraction (United States / global).
- Resend — delivery of transactional emails (account, billing, and reminder emails).
- Telegram — delivery of opt-in reminder messages, only if you connect the Telegram bot.
- Google Analytics (Firebase) and Umami — product analytics (see “Cookies & analytics” below).
Some of these providers process data outside your own country, including in the United States and India. Where personal data of EEA/UK users is transferred abroad, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses (and the UK Addendum) or an adequacy decision, together with additional technical and organisational measures. A current list of sub-processors is available on request at support@pnlbook.com.
We may also disclose data where required by law, regulation, or valid legal process, or to protect our rights, users, and the security of the Service; and in connection with a merger, acquisition, or asset sale, subject to this Policy.
5. Cookies & analytics
We use a single strictly-necessary cookie to keep you signed in, and browser local storage to remember preferences such as your theme. These are essential to the Service and cannot be switched off.
On our public website we also use two analytics tools to understand how the site is used: Umami, a privacy-focused, cookieless analytics tool that does not track you across sites; and Google Analytics 4 (via Firebase), which may set analytics cookies. We do not use advertising cookies, cross-site tracking pixels, or data brokers. Where the law requires consent for non-essential analytics cookies, we will obtain it, and you can control cookies through your browser settings.
6. Data retention
We keep your account and trade data for as long as your account is active. When you delete your account, we delete or irreversibly anonymise your personal data — including your trades, tags, and notes — within a reasonable period. We retain a minimal set of billing and invoice records in anonymised form for as long as required to meet tax, accounting, and fraud-prevention obligations. Backups are rotated on a scheduled basis and purged in the ordinary course.
7. Your rights & how to exercise them
Subject to applicable law, you have the right to access your data, to rectify inaccurate data, to erase your data, to receive a portable copy, and to object to or restrict certain processing. You can exercise the main rights yourself, at any time:
- Access & portability — use Settings → Download my data in the Service to download a complete copy of your profile, accounts, trades, tags, subscriptions, feedback, and broker-connection metadata as a JSON file. (Broker credentials and tokens are never included.) You can also export your trade history as CSV.
- Erasure — use Settings → Delete my account to permanently delete your account. This anonymises your personal data, cancels any active subscription, signs you out of all sessions, and deletes or anonymises your trades and accounts.
- Rectification & other rights — update your profile in Settings, or contact us at support@pnlbook.com and we will respond within the timelines required by applicable law.
8. Security
We use reasonable technical and organisational measures — including encryption in transit, access controls, and per-user data isolation at the database level — to protect your data. No method of transmission or storage is completely secure, so we cannot guarantee absolute security, but we work to protect your data and to notify you and the relevant authorities of any breach as required by law.
9. Children
The Service is not directed to anyone under 18, and we do not knowingly collect the personal data of children. If you believe a child has provided us data, contact us and we will delete it.
10. Changes to this Policy
We may update this Policy from time to time. Material changes will be notified through the Service or by email, and the “last updated” date above will change.
11. Contact & complaints
For any privacy question, request, or grievance, contact Quantmhill IT Services and Consultancy Private Limited at support@pnlbook.com, Budhakhera, Muzaffarnagar, Uttar Pradesh 247772, India. If you are in the EEA, the UK, or another region with a data-protection authority, you also have the right to lodge a complaint with your local supervisory authority — though we ask that you contact us first so we can try to resolve your concern.