Legal

Privacy policy

This policy explains what personal data OrderBlock collects, why we use it, and the choices you have. It is written to meet the Digital Personal Data Protection Act, 2023 (DPDP Act) and the Information Technology Act, 2000.

Last updated

Who we are

OrderBlock (“we”, “us”) is the Data Fiduciary for personal data processed through order-block.com and the OrderBlock app. You can reach us at optionoraclebusiness@gmail.com.

What we collect

  • Account data from Google sign-in: your name, email address, profile photo and Google account identifier.
  • Your WhatsApp number, when you give it at Guest Login or checkout: we use it to send your login code, account messages and OrderBlock updates on WhatsApp through our messaging provider, and you can reply STOP at any time to stop the updates.
  • Subscription data: plan, amount, dates, payment reference and invoice details. Card, UPI and bank details are handled by the payment gateway and never reach our servers.
  • Content you create: trading journal entries, community posts, comments and likes, and feedback you send.
  • Usage and device data: pages viewed, clicks on key buttons, session times, device and browser type, IP address, approximate location derived from the IP address, and the page or campaign that brought you to us.
  • Support messages you exchange with us.

We do not ask for your PAN, Aadhaar, bank account numbers or trading account credentials.

Why we use it

  • To create your account, sign you in and provide the service you paid for.
  • To process payments, issue GST invoices and keep required records.
  • To protect accounts: enforcing device limits, preventing account sharing, fraud and abuse.
  • To understand, in aggregate, how the product is used so we can improve it.
  • To send service messages such as receipts and plan-expiry reminders. Marketing emails are sent only with your consent, and every one has an unsubscribe link.
  • To meet legal obligations and respond to lawful requests.

We do not make decisions about you that have legal or similarly significant effects by automated means.

Consent and legitimate uses

We process your personal data on the basis of the consent you give when you sign up, and for the legitimate uses permitted under Section 7 of the DPDP Act, such as complying with law. You can withdraw consent at any time by writing to us or deleting your account. Withdrawal does not affect processing already done, but we may no longer be able to provide the service.

Cookies

  • Essential: a session cookie that keeps you signed in, a security token that protects forms, and your light or dark theme choice.
  • Analytics: first-party identifiers that let us count visits and understand which pages help people. We do not use third-party advertising trackers.

Our pages load fonts from Google Fonts, which means Google receives your IP address when fonts are fetched.

Who we share it with

We never sell or rent personal data. We share it only with service providers who process it on our behalf under contract, and only as much as they need:

  • Cloud hosting and storage providers that run the service.
  • The payment gateway that processes your payment.
  • Google, to sign you in.
  • Email and video delivery providers.
  • An AI service used to screen community posts for spam and abuse; only the text of the post is sent.

We may also disclose data when required by law, a court order or a government authority, or to protect the rights and safety of our users and the service.

Where your data is processed

Your data is stored with reputable cloud providers. Some service providers may process data outside India, only in countries not restricted by the Central Government under Section 16 of the DPDP Act and with appropriate safeguards.

How long we keep it

  • Account data and your content: for as long as your account is active. When you delete your account, we erase it within 30 days, except what the law requires us to keep.
  • Payment and invoice records: for as long as tax and accounting laws require (currently up to 8 years).
  • Detailed usage logs: up to 12 months, after which they are kept only in aggregated form that no longer identifies you.

Your rights

Under the DPDP Act you have the right to:

  • get a summary of the personal data we hold about you and how it is processed;
  • have inaccurate or incomplete data corrected, completed or updated, and have data erased when it is no longer needed;
  • have your grievances addressed;
  • nominate another person to exercise your rights in the event of death or incapacity; and
  • withdraw consent at any time.

Write to optionoraclebusiness@gmail.com from your registered email address. We respond within the timelines set by the DPDP Act and its rules, and in any case within 30 days.

Children

OrderBlock is meant for adults. We do not knowingly process personal data of anyone under 18. If we learn that we have, we will delete it.

How we protect it

Data is encrypted in transit (TLS). Session tokens are stored only as one-way hashes, secrets are encrypted at rest, admin access is limited by role and recorded in an audit log, and uploaded images are re-encoded to strip hidden metadata. If a personal data breach occurs, we will inform the Data Protection Board of India and affected users as the law requires.

Changes to this policy

We will post any changes on this page and update the date at the top. If a change is significant, we will also tell you by email or in the app.

Grievance officer

For privacy questions, requests or complaints, contact our Grievance Officer at optionoraclebusiness@gmail.com with the subject line “Privacy”. If you are not satisfied with our response, you may complain to the Data Protection Board of India.