1. Information we collect
- Account information — your name and email address, and the authentication identifiers used to sign you in (including via Google sign-in, if you choose it).
- Trade & journal data — the trades, executions, screenshots, CSV/XLSX files, tags, and notes you import or enter. You control what you upload; please do not include more personal data than you need.
- Billing information — your plan and subscription status, and the invoice records we are required to keep. Card and payment details are collected and processed directly by our payment processors (Stripe and Razorpay); we never receive or store your full card number.
- Broker connection metadata — where you connect a broker, we store connection metadata (such as the broker name and connection status). We do not expose your broker credentials or access tokens to you or to third parties, and they are never included in your data export.
- Usage & device data — server logs, approximate location derived from your IP address, browser/device information, and diagnostic data used to operate, secure, and improve the Service.
- Optional contact channels — a Telegram chat ID and/or a notification email address, only if you opt in to reminders and notifications.
- Support & feedback — the messages, email address, and page context you send us through the in-app feedback form or by email.
2. How we use your data and our lawful bases
Where the EU/UK GDPR or similar laws apply, we rely on the following lawful bases:
- Performance of a contract — to create and secure your account, import and store your trades, compute statistics, generate reviews, provide support, and process payments and subscriptions.
- Legitimate interests — to keep the Service secure and prevent fraud and abuse, to understand aggregate usage so we can improve the product, and to send you service and account communications. We balance these interests against your rights.
- Consent — where you opt in to optional features such as Telegram or email reminders, and for optional website analytics in every region. You can withdraw consent at any time.
- Legal obligation — to keep tax and accounting records and to respond to lawful requests.
We do not sell or rent your personal data, and we do not use it for third-party advertising.
3. AI processing of your trades
When you request a written review or screenshot extraction, we send the relevant trade, journal or image data to Anthropic to produce that response. Do not include passwords, payment credentials or unrelated personal information in uploads or notes. PnL Book does not train public AI models with your journal. Provider processing and retention are governed by the applicable provider terms; contact us for details of the arrangements for your account.
4. Sub-processors and how we share data
We use the following service providers to operate the Service. The data shared depends on the features you use. Contact us for the applicable processing terms and any business data-processing agreement before sharing data on behalf of an organisation:
- Google Cloud — hosting, database, and file storage (primary region: India, asia-south1, Mumbai).
- Stripe — payment processing when Stripe checkout is available and selected. USD checkout is currently unavailable.
- Razorpay — payment processing and recurring billing for customers paying in Indian Rupees (India).
- Anthropic — AI reviews and screenshot extraction (United States / global).
- Hostinger SMTP — delivery of account, billing and reminder emails.
- Telegram — delivery of opt-in reminder messages, only if you connect the Telegram bot.
- Google Analytics (Firebase) and Umami — product analytics (see “Cookies & analytics” below).
Some providers process data outside your country, including in India and the United States. International transfer requirements depend on the relevant jurisdictions and provider arrangements. To request details of the safeguards and contractual documents applicable to your account, contact support@pnlbook.com.
We may also disclose data where required by law, regulation, or valid legal process, or to protect our rights, users, and the security of the Service; and in connection with a merger, acquisition, or asset sale, subject to this Policy.
5. Cookies & analytics
We use strictly necessary cookies to keep you signed in and remember your analytics choice, and browser local storage to remember preferences such as your theme. These are essential to the Service and cannot be switched off.
On our public website we also use two analytics tools to understand how the site is used: Umami, a privacy-focused, cookieless analytics tool that does not track you across sites; and Google Analytics 4 (via Firebase), which may set analytics cookies. Both tools remain off until you choose Allow analytics. Use the persistent Privacy choices button to reject analytics later. Withdrawal disables further collection in that browser and removes available Google Analytics cookies; it does not retroactively remove events already sent. We do not use advertising cookies or data brokers.
6. Data retention
We keep your account and trade data for as long as your account is active. When you delete your account, we delete or irreversibly anonymise your personal data — including your trades, tags, and notes — within a reasonable period. We retain a minimal set of billing and invoice records in anonymised form for as long as required to meet tax, accounting, and fraud-prevention obligations. Backups are rotated on a scheduled basis and purged in the ordinary course.
7. Your rights & how to exercise them
Subject to applicable law, you have the right to access your data, to rectify inaccurate data, to erase your data, to receive a portable copy, and to object to or restrict certain processing. You can exercise the main rights yourself, at any time:
- Access & portability — use Settings → Download my data in the Service to download a ZIP archive containing your account and journal records as JSON and original uploads, including reviews, notes, reminders and notification settings. Authentication secrets and broker credentials are excluded. Full archives support up to 128 MiB; larger accounts can download records-only JSON and contact us for the complete file archive. You can also export your trade history as CSV.
- Erasure — use Settings → Delete my account to permanently delete your account. This anonymises your personal data, cancels any active subscription, signs you out of all sessions, and deletes or anonymises your trades and accounts. Uploaded files are queued for removal with retries; access through the deleted account ends immediately. If subscription cancellation cannot be confirmed, deletion pauses and your account remains available while you retry or contact support.
- Rectification & other rights — update your profile in Settings, or contact us at support@pnlbook.com and we will respond within the timelines required by applicable law.
8. Security
We use reasonable technical and organisational measures — including encryption in transit, access controls and ownership checks — to protect your data. No method of transmission or storage is completely secure, so we cannot guarantee absolute security, but we work to protect your data and to notify you and the relevant authorities of any breach as required by law.
9. Children
The Service is not directed to anyone under 18, and we do not knowingly collect the personal data of children. If you believe a child has provided us data, contact us and we will delete it.
10. Changes to this Policy
We may update this Policy from time to time. Material changes will be notified through the Service or by email, and the “last updated” date above will change.
11. Contact & complaints
For any privacy question, request, or grievance, contact Quantmhill IT Services and Consultancy Private Limited at support@pnlbook.com, Budhakhera, Muzaffarnagar, Uttar Pradesh 247772, India. If you are in the EEA, the UK, or another region with a data-protection authority, you also have the right to lodge a complaint with your local supervisory authority — though we ask that you contact us first so we can try to resolve your concern.