Jaadu 2.0 Privacy Policy
This policy says what Jaadu 2.0 collects about you, why, who else sees it, where it goes, how long we keep it, and how to make us delete it. It is written to be read, not skimmed. If anything in it is unclear, write to sahityaceo@alzyontechsolutions.com and we will answer.
1. Who we are
Jaadu 2.0 is built and operated by Alzyon Tech Solutions Private Limited, a company incorporated in India (CIN U62012CT2024PTC016326) with its registered office at H.No 61, Shri House, Mahaveer Nagar, Dharampura-2, Jagdalpur, District Bastar, Chhattisgarh 494001, India. In this policy "we", "us" and "our" mean that company, and "you" means the person whose personal data we hold.
We decide why and how your personal data is processed. That makes us the Data Fiduciary under India's Digital Personal Data Protection Act, 2023 (the "DPDP Act"), the "body corporate" under the Information Technology Act, 2000 and the rules made under it, and, if you are in the European Economic Area or the United Kingdom, the "controller".
2. What this policy covers
It covers jaadu2.com: the public site, the waitlist, and the Jaadu 2.0 application, which is live in private beta by invitation. The company website at alzyontechsolutions.com has its own privacy policy.
Jaadu 2.0 is a research and analysis tool. It never holds your money, your exchange keys or your assets, and nothing you do in it places a trade anywhere. What it does hold is listed in clause 3.
3. What we collect
Itemised, as the DPDP Rules require, and grouped by where it comes from.
What you give us when you sign up
- Your email address. Required. It is your login, where your verification link goes, and where alerts and account notices are sent.
- A password. Required for password accounts, and never stored. We keep a one-way hash of it, so the password itself cannot be read out of our database by us or by anyone who obtains a copy of it.
- Your name. Optional. Used only to address you.
- If you sign in with Google: Google sends us your email address, your name, your profile picture and a Google account identifier. We do not receive your Google password, and we do not access anything else in your Google account.
What you create by using Jaadu 2.0
- Your conversations with the research desk. The desk is an AI system (the Terms of Use, clause 7, describe how it works). Every question you type and every answer Jaadu 2.0 gives is stored against your account, so you can return to it and so Jaadu 2.0 can follow a thread and learn how you work.
- A memory of you. From those conversations Jaadu 2.0 writes and keeps a memory file about how you trade: for example your risk posture, the timeframes you prefer, the markets you watch, and instructions you give it such as "stop showing me that". It exists so you do not have to repeat yourself. You can read it, correct it and delete it (clause 9).
- Watchlists, alerts, strategies and paper trades. The markets you follow, the conditions you set and the times they fired, the strategies you describe and their backtests, and the simulated trades in paper-trading runs.
What your browser tells us
- Your IP address and browser identifier when a sign-in session is created, so a session can be traced to the device that started it and revoked if it was not you.
- Ordinary server logs: the request, the time, the IP address and the browser identifier, kept as every web server keeps them, to keep the service running and to spot abuse.
- Market data loads directly. To draw the chart, your browser connects directly to the public data endpoints of third-party exchanges and market-data providers, in the same way that any website you visit sees your IP address. We send them nothing about you, and no account of yours is involved.
What we do not collect
- No payment details. Jaadu 2.0 is free today. If we introduce paid plans, payments will be handled by a payment provider, we will not store card numbers ourselves, and this policy will be updated before anything is charged.
- No exchange API keys, wallet addresses, brokerage credentials, identity documents or funds. Jaadu 2.0 has nowhere to put them.
- No analytics or tracking scripts. There is no Google Analytics, Meta pixel, session recorder or product-analytics SDK on jaadu2.com. Our fonts are served from our own server.
4. Why we use it, and on what basis
| Data | Purpose | Basis |
|---|---|---|
| Email, password hash, name, Google sign-in details | Create your account, verify your address, let you sign in, tell you when access opens, send account notices | You provided it for this purpose (DPDP Act, section 7(a)); your consent at signup |
| Conversations and the memory file | Run Jaadu 2.0 for you and improve it: answer your questions, keep the thread, remember your preferences; read by us to fix failures and make the desk better | Your consent at signup, withdrawable at any time |
| Watchlists, alerts, strategies, paper trades | Run the features you set up, email you when an alert fires | You provided it for this purpose |
| Session IP and browser identifier, server logs | Keep sessions secure and revocable, keep the service up, investigate abuse | Our legitimate operation of the service; security |
We do not use your data for advertising, and we do not sell it. We do not send marketing email. If we ever want to, we will ask separately, and refusing will not affect your account.
5. Cookies and local storage
We set one cookie, after you sign in: a session cookie that keeps you signed in. It is HttpOnly, so scripts cannot read it, and SameSite, so your browser never sends it to another site. There are no analytics cookies, no advertising cookies and no third-party cookies set by us, so there is nothing to opt out of. Declining the one cookie would only mean not being able to sign in.
The application also keeps a small number of interface preferences, such as panel layout and chart settings, in your browser's local storage. They stay on your device and are not sent to us.
6. Who else sees it
We do not sell, rent or share your data for anyone's marketing. It reaches other companies only as our service providers, acting on our instructions, in these cases:
- Microsoft (Azure OpenAI). When you ask the research desk a question, the question, the relevant part of the conversation and your memory file are sent to a language model hosted by Microsoft in the United States (East US 2 region) to produce the answer. Microsoft's published terms state that prompts and completions are not used to train its models or anyone else's, and that it may store prompts for up to 30 days for abuse monitoring, inside that region.
- Amazon Web Services. Our servers and database run on AWS in its Mumbai (ap-south-1) region, so AWS necessarily stores your data at rest on our behalf. Amazon Simple Email Service delivers our email, so your address and the content of each message pass through it.
- Google. If you sign in with Google, Google processes the sign-in under its own privacy policy. When you email us, your message is stored in our Google Workspace mailbox.
- Market-data providers. As clause 3 explains, your browser connects directly to third-party exchanges and market-data providers to load prices. They see your IP address; we send them nothing about you.
We may also disclose data if the law requires it: a valid order of a court or a competent authority, or where it is necessary to establish or defend a legal claim. We will tell you if we are compelled in this way unless the law prohibits us from doing so.
If Alzyon Tech Solutions Private Limited is ever acquired or merged, your data may transfer to the new entity under this policy, and we will tell you before anything changes.
7. How long we keep it
We keep your account and everything attached to it for as long as your account exists. Your conversations and memory file are kept for that whole time, because Jaadu 2.0 learns from them to serve you better; that is the product working as described, not a side effect.
When you delete your account, we delete everything within 90 days: your email, name, password hash and sign-in records; your conversations and memory file; your watchlists, alerts, strategies and paper-trading records; and the copies of them in our backups as those backups age out. Ordinary server logs rotate within 90 days and are not indexed by user. Where the law requires us to keep a specific record longer, for example a tax record, we keep only that record.
Under the DPDP Rules we will also erase your data if the purpose it was collected for is no longer served, and we will give you notice before erasing an inactive account so you can keep it.
8. What we never do
- Sell or rent your personal data, or share it for advertising.
- Hand your conversations to any third party to train their models. Microsoft's terms bar it from doing so with what we send it.
- Make automated decisions that have legal or similarly significant effects on you. Jaadu 2.0 produces analysis; it does not decide anything about you.
- Knowingly collect data from anyone under 18 (clause 9).
- Publish, quote or show your conversations to anyone outside the company.
9. Your rights
Whatever your country, you can ask us to:
- Tell you what we hold about you and what we have done with it, including your memory file.
- Correct or update anything that is wrong, including the memory file.
- Delete it, which closes your account (clause 7).
- Withdraw your consent at any time. It is as easy as giving it: use "Delete my account" in settings, or email us. Withdrawal does not affect processing that already happened.
- Nominate someone to exercise these rights for you if you die or become incapacitated, as the DPDP Act allows.
Write to sahityaceo@alzyontechsolutions.com from the address on your account. We will acknowledge within 48 hours and act within 30 days. There is no charge. We may ask you to confirm from your registered email so nobody else can delete your account.
If you are not satisfied with how we handled a grievance, you may complain to the Data Protection Board of India. Our internal response period is 30 days, shorter than the 90 days the DPDP Rules allow.
Children. Jaadu 2.0 is for adults. You must be 18 or older to hold an account, and we do not knowingly collect data from anyone younger. If you believe a child has signed up, tell us and we will delete the account.
10. If something goes wrong
If a personal data breach affects you, we will tell you without delay, in plain language: what happened, what data was involved, what we are doing about it, and what you can do. We will also report it to the Data Protection Board of India within 72 hours of becoming aware of it, as the DPDP Rules require. We will not wait to be asked.
11. How we protect it
- The whole service is served over HTTPS; plain HTTP is redirected, never served.
- Passwords are stored only as one-way hashes. Verification, reset and session tokens are stored as hashes too, so a copy of our database does not yield a working credential.
- The session cookie is HttpOnly and SameSite. Sign-in attempts are rate-limited.
- Any code the research desk writes to answer you runs in an isolated sandbox with no network access and hard limits on memory and time; it cannot reach the database or other users.
- Access to production systems is limited to the people who run them.
None of this makes a breach impossible, and we do not claim it does. Clause 10 says what happens if one occurs.
12. Where your data is processed
Your account and everything in clause 3 is stored in India (AWS, Mumbai). Questions to the research desk, with the conversation context and your memory file, are processed in the United States (Microsoft Azure OpenAI) and returned; Microsoft's retention of them is described in clause 6. Email passes through our email provider's servers, which may be outside India.
The DPDP Act permits transfer to any country the Central Government has not restricted. If a country we use is restricted, we will stop transferring there before the restriction takes effect and update this clause.
13. If you are outside India
European Economic Area and United Kingdom. Alzyon Tech Solutions Private Limited is the controller. Our lawful bases are: performance of our contract with you (your account and the features you set up); your consent (conversations and the memory file, withdrawable at any time); and our legitimate interests in keeping the service secure and running (session records and logs). You also have the rights to data portability, to object, and to restrict processing, and you may complain to your national supervisory authority. Transfers to India and the United States rely on the European Commission's standard contractual clauses with our providers and on your explicit consent where we ask for it.
California. We do not sell or share personal information as those terms are defined in California law, and we do not use it for cross-context behavioural advertising. The categories we collect are those in clause 3; you may exercise the rights in clause 9.
Everywhere else. The rights in clause 9 are available to you regardless of where you live.
14. Changes to this policy
We will update this page when what we do with your data changes, and the "last updated" date will move with it. If a change is significant, most obviously a new service provider, a new category of data, or paid plans, we will email you before it takes effect rather than rely on you re-reading this page. If you signed up before 13 May 2027, you will receive a one-time notice on or after that date restating what we hold and how to exercise your rights, as the DPDP Act requires.
15. Contact and Grievance Officer
Questions about this policy, requests under clause 9, and grievances go to our Grievance Officer, who is also the person able to answer questions about how your personal data is processed:
K Sahitya, Founder & CEO, Grievance Officer
sahityaceo@alzyontechsolutions.com
Alzyon Tech Solutions Private Limited, H.No 61, Shri House, Mahaveer Nagar, Dharampura-2, Jagdalpur, District Bastar, Chhattisgarh 494001, India
Grievances are acknowledged within 48 hours and resolved within 30 days.