Corporate Identity & Scope
This Privacy Policy constitutes an authoritative legal agreement between you ("User", "Data Principal", or "Student") and Forex Masters Edtech Private Limited ("Company", "we", "us", or "our"), a private limited corporate entity incorporated under the provisions of the Companies Act, 2013, having its registered operational headquarters at Olympia Tech Park, 1 - SIDCO Industrial Estate, Guindy, Chennai, Tamil Nadu 600032, India.
Under the provisions of India's Digital Personal Data Protection Act, 2023 (DPDP Act) and the Information Technology Act, 2000 read with the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011, Forex Masters Edtech Private Limited acts as a Data Fiduciary. Under Regulation (EU) 2016/679 (General Data Protection Regulation or "GDPR"), the Company operates as a Data Controller.
This Privacy Policy governs your access to and utilization of all proprietary trading education modules, quantitative curriculum materials, conversational artificial intelligence interfaces, algorithmic trade journaling systems, and web applications accessible via forexmasters.in and its authorized subdomains (collectively, the "Platform"), subject to our Terms of Service. By creating an account, registering for educational courses, connecting read-only brokerage APIs, or transacting on the Platform, you acknowledge that you have read, understood, and consented to the collection, storage, and processing of your personal information as defined herein.
Categories of Personal Data
To deliver our quantitative educational curriculum, provide algorithmic journal analytics, and maintain platform security, we process personal data classified strictly into functional operational categories. We do not sell your personal data under any circumstances.
Account Identification & Profile Data
Includes full legal name, primary email address, cryptographically hashed authentication credentials (generated via Argon2/bcrypt algorithms), federated identity tokens (such as Google OAuth user identifiers), profile avatar image links, and mobile telephone numbers supplied voluntarily for SMS notifications or multi-factor authentication.
Payment & Invoicing Metadata
Includes Razorpay customer identifiers, merchant order references, payment transaction hashes, subscription lifecycle status, billing address, and state or province declarations utilized for Indian Goods and Services Tax (GST) assessment. Forex Masters never stores or processes raw credit or debit card numbers (PAN), CVV security codes, or bank net-banking passwords. All card payments are captured directly through PCI-DSS Level 1 certified hosted fields.
Interactive Learning & Courseware Telemetry
Includes video playback timestamp progress, module completion benchmarks, quiz attempt scores, quantitative assignment evaluations, competency milestone records, institutional certification issuance metadata, and peer contributions in official community forums.
Conversational AI & Mentorship Transcripts
Includes market research prompts, educational scenario queries, voice interaction audio data, automated speech-to-text transcriptions, synthesized feedback streams, and personalized educational state models created during interactive AI mentorship sessions.
Brokerage Journaling & Trade Execution Records
Includes encrypted read-only brokerage connection tokens (e.g. MetaApi or cTrader), historical trade execution logs, open position parameters, balance and equity curves, drawdown calculations, risk-to-reward ratios, and reflective self-assessment trade notes entered into your private journal.
Technical Diagnostics & Security Telemetry
Includes Internet Protocol (IP) addresses, operating system specifications, browser user agents, referring URLs, session durations, network latency metrics, client crash reports, and bot challenge verification tokens.
Methods of Data Collection
We collect information through three primary operational channels:
- Direct User Submission: Information that you directly furnish when completing registration forms, configuring user profile settings, submitting quiz answers, recording trade reflections, or transmitting inquiries to our support teams.
- Automated Platform Telemetry: Technical diagnostics collected automatically as you navigate through our course player, trigger interactive chart visualizers, or authenticate into your dashboard sessions.
- Authorized Third-Party Integrations: Data synchronized through explicit user authorization, including Google Single Sign-On (SSO) profile verifications and read-only broker API connections established for trade journaling.
Lawful Grounds for Processing
In accordance with Section 4 and Section 6 of India's Digital Personal Data Protection Act, 2023 and Article 6 of the General Data Protection Regulation, the Company processes personal data strictly under established legal bases:
1. Contractual Necessity (Art. 6(1)(b) GDPR / Section 4(1) DPDP Act): Processing necessary to execute our terms of service, provision paid course materials, calculate educational credits, deliver algorithmic journal analytics, and verify course completion credentials.
2. Specific & Affirmative Consent (Art. 6(1)(a) GDPR / Section 6 DPDP Act): Explicit affirmative consent collected at the time of account creation for optional communications, marketing digests, and third-party read-only broker data synchronizations. You maintain the absolute statutory right to withdraw consent at any time.
3. Legal and Statutory Obligations (Art. 6(1)(c) GDPR / Section 4(2) DPDP Act): Mandatory record-keeping required to comply with Indian tax regulations, statutory audit directives under the Companies Act, 2013, and applicable payment gateway regulations.
4. Legitimate Operational Uses (Art. 6(1)(f) GDPR / Section 7 DPDP Act): System threat detection, denial-of-service prevention, credential stuffing defense, security auditing, and continuous infrastructure reliability monitoring.
AI & Zero Model-Training Guarantee
Forex Masters incorporates advanced artificial intelligence agents and large language model architectures to provide real-time educational mentorship, strategy simulation, and market curriculum navigation. We maintain an unequivocal institutional commitment to your intellectual privacy:
Forex Masters Edtech Private Limited does NOT sell, rent, license, or submit your private trading queries, conversation transcripts, voice audio, or proprietary trade journal records to train public third-party foundation models.
All interactions with external foundation model providers (such as OpenAI, Anthropic, and Google Cloud) are routed exclusively through commercial enterprise Application Programming Interfaces (APIs) protected by contractual terms enforcing zero-day data retention for model training.
Conversational prompts are processed ephemerally to produce contextual responses. Semantic memory vector embeddings stored within our vector databases are encrypted and bound strictly to your isolated account tenant. You retain the right to clear your AI interaction memory and conversational history at any time through your dashboard profile settings.
Financial & Invoicing Processing
All payment transactions, subscription billing sequences, and platform credit purchases are processed through Razorpay Software Private Limited, an authorized payment aggregator regulated by the Reserve Bank of India (RBI).
Razorpay operates as an independent PCI-DSS Level 1 certified entity. When initiating checkout, your payment instruments are tokenized in strict compliance with RBI tokenization directives. Forex Masters servers never receive, handle, or store raw card numbers, card security codes (CVV), or internet banking passwords.
In conformity with the Central Goods and Services Tax Act, 2017 and relevant state GST enactments, we record transaction identifiers, customer billing names, registered states, and tax invoice numbers. These records are preserved securely in our immutable accounting ledgers to generate legally compliant tax invoices and facilitate statutory tax filings.
Broker Journaling & Trade Analytics
Forex Masters is strictly an educational technology and trade journal analytics platform. The Company does not operate as a broker, portfolio manager, or investment adviser registered with the Securities and Exchange Board of India (SEBI).
When you connect third-party trading accounts via supported read-only API connectors (e.g. MetaApi, cTrader):
- Read-Only Enforced: Connectors operate under strict read-only permissions. The Platform cannot execute orders, modify open positions, deposit funds, or withdraw capital.
- Proprietary Confidentiality: Your individual trade logs, historical executions, equity fluctuations, and personal journal reflections remain confidential to your account tenant. We never aggregate or sell individual trading data to proprietary trading firms, market makers, or third-party brokers.
- Revocation: You may unlink your broker credentials at any time, which immediately terminates active data synchronization and initiates the scheduled deletion of stored connection tokens.
Institutional & Enterprise Accounts
Where your access to the Platform is provisioned, sponsored, or subsidized under an institutional group license (such as an academic college, university, or corporate workforce training arrangement), specific data sharing rules apply:
Authorized institutional administrators from your sponsoring organization may access reporting consoles detailing student enrollment status, module completion percentages, lesson engagement duration, quiz evaluations, and certification issuance.
Strict Isolation of Personal Data: Sponsoring institutional administrators are strictly prohibited from viewing students' personal payment receipts, individual credit card or bank billing metadata, or private personal trade journal reflections.
Third-Party Sub-processor Schedule
We partner with verified, institutional-grade third-party infrastructure providers to support platform hosting, database replication, payment processing, error diagnostics, and AI inference. Each sub-processor is bound by strict Data Processing Agreements (DPAs) incorporating standard contractual clauses and rigorous security benchmarks:
| Sub-processor | Functional Role | Data Processed | Location | Transfer Safeguards |
|---|---|---|---|---|
| Supabase Inc. | Database & Auth Infrastructure | Account identity, credentials, progress, journal data | AWS Mumbai / EU | Standard Contractual Clauses, ISO 27001 |
| Razorpay Software Pvt. Ltd. | Payment Gateway & Invoicing | Billing name, transaction reference, tax metadata | India | RBI Regulated, PCI-DSS Level 1 |
| Upstash Inc. | Redis Cache & Rate Limiting | Transient session tokens, security rate counters | Global Edge | TLS 1.3, AES-256 Encryption |
| Pinecone Systems, Inc. | Vector Memory Indexing | Anonymized high-dimensional semantic embeddings | United States | SOC 2 Type II, AES-256 |
| OpenAI, LLC | LLM Inference & Mentorship | Ephemeral conversational prompts and queries | United States | Enterprise Zero-Training Agreement |
| Anthropic, PBC | LLM Inference & Reasoning | Ephemeral mentorship reasoning prompts | United States | Enterprise Zero-Training Agreement |
| Google Cloud Platform | Gemini Multimodal Inference | Ephemeral chart image and prompt analysis | Global / US | SOC 2 Type II, ISO 27001 |
| Vercel Inc. | Edge Hosting & Serverless Execution | IP address, HTTP request headers, routing telemetry | Global Anycast | ISO 27001, Standard Contractual Clauses |
| Resend, Inc. | Transactional Email Delivery | Recipient email address, course alerts, receipts | United States | SOC 2 Type II, TLS 1.3 |
| Functional Software (Sentry) | Application Error Monitoring | Client stack traces, browser runtime crash logs | United States | SOC 2 Type II, PII Sanitization |
| PostHog, Inc. | Product Telemetry & Analytics | Anonymized user navigation events, session metrics | US / EU | GDPR Compliant, IP Anonymization |
| Cloudflare, Inc. | DNS, WAF & Bot Defense | Network request telemetry, bot challenge tokens | Global Anycast | PCI-DSS, SOC 2 Type II |
Cryptographic Security & Storage
We deploy institutional-grade technical, cryptographic, and organizational controls to protect personal data against accidental loss, unauthorized access, destruction, and alteration:
Row Level Security (RLS) Tenant Isolation: Our relational database architecture strictly enforces PostgreSQL Row Level Security. Database read and write operations are cryptographically scoped to the authenticated user's verified JSON Web Token (JWT) subject claim, mathematically preventing cross-tenant access.
Encryption Standards: All data transmitted between client browsers and platform endpoints is encrypted using Transport Layer Security (TLS 1.3 / HTTPS). All persistent data, database records, vector indexes, and backups are encrypted at rest using Advanced Encryption Standard (AES-256).
Access Controls: Internal administrative access to production systems is governed by strict Role-Based Access Control (RBAC), the principle of least privilege, mandatory hardware-backed multi-factor authentication, and immutable audit trails.
Continuous Disaster Recovery: Automated encrypted database backups are created daily and stored across geographically diverse cloud regions with point-in-time recovery capabilities.
Data Retention & Erasure Schedule
We retain personal data only for as long as necessary to fulfill the educational purposes for which it was gathered, provide continuous platform access, and satisfy legal, accounting, and reporting obligations:
Active Account Lifecycle: Personal profile data, course progress, and trade journal records are maintained throughout the active lifespan of your account.
Account Deletion & 30-Day Erasure Window: Upon receiving a verified account deletion request via privacy@forexmasters.in or through your account dashboard, your personal profile data, conversational AI history, and trade journal logs will be permanently expunged from primary production datastores within thirty (30) days.
Statutory Financial Retention Exception: In accordance with Section 128 of the Companies Act, 2013 and Indian taxation regulations, transaction invoices, GST declarations, and payment records are preserved in isolated accounting archives for a mandatory period of up to seven (7) years. Archived financial data is strictly segregated from operational systems.
Data Principal Rights (DPDP & GDPR)
Depending on your jurisdiction, you are endowed with comprehensive statutory rights concerning your personal information:
Rights Under India's DPDP Act, 2023
- Right to Access Information: Request a summary of personal data processed, identities of all sub-processors who have received data, and the processing rationale.
- Right to Correction and Erasure: Request the correction of inaccurate or misleading data, the updating of incomplete records, and the erasure of data no longer necessary for service delivery.
- Right of Grievance Redressal: Statutory access to our dedicated Grievance Redressal mechanism with mandated resolution timelines.
- Right to Nominate: Designate an authorized individual who shall exercise data rights in the event of death or physical incapacity.
Rights Under the General Data Protection Regulation (GDPR)
Users located in the European Economic Area (EEA) and the United Kingdom enjoy the rights to data portability (receiving data in a structured, commonly used, and machine-readable JSON format), restriction of processing, objection to legitimate interest processing, and the right to lodge a formal complaint with an EU Data Protection Supervisory Authority.
California Privacy Rights (CCPA / CPRA)
California residents maintain the statutory right to request disclosure of personal data collected over the preceding 12 months, the right to request deletion, and the right not to be discriminated against for exercising privacy rights. Forex Masters does not sell or share personal information as defined by California law.
Protection of Minors
Our services are strictly directed to individuals aged eighteen (18) years and older. We do not knowingly solicit or collect personal data from minors. If we discover that personal information of an individual under 18 has been collected without verified parental authorization, we will immediately delete that account and permanently purge its data.
Grievance Redressal & Contacts
In accordance with the Information Technology Act, 2000 read with the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 and Section 6 of India's Digital Personal Data Protection Act, 2023, the designated statutory details for data privacy inquiries and grievance redressal are set forth below:
Olympia Tech Park, 1 - SIDCO Industrial Estate, Guindy, Chennai, Tamil Nadu 600032, India
Statutory Resolution Timeline: In compliance with applicable Indian information technology and data protection regulations, all privacy requests, data access inquiries, and formal grievances transmitted to privacy@forexmasters.in will be acknowledged within 48 hours and formally investigated and resolved within thirty (30) days of verified receipt.