Privacy Policy

ScoutStack Technical Research · Plot No. 83, Shrinivas Tower, M.P. Nagar Zone II, Bhopal, MP 462012

1. Information We Collect

We collect the following categories of personal information:

• Identity Data: Full name, date of birth, PAN card number, Aadhaar (last 4 digits only), address
• Contact Data: Email address, mobile number, WhatsApp number
• Financial Data: Bank account details (for KYC verification), demat account number, income range
• Investment Profile: Investment objectives, risk tolerance, trading experience, service interest
• Transaction Data: Subscription payments, invoice history, refund records
• Usage Data: App usage patterns, research calls viewed, login timestamps, device information
• Communication Data: WhatsApp messages, support tickets, grievances, feedback

2. Purpose of Data Collection

We collect and process your data for:

• KYC verification as mandated by SEBI RA Regulations 2014 (Reg. 25)
• Delivering research recommendations via WhatsApp, SMS, Telegram, and mobile app
• Subscription management, billing, and invoice generation
• Compliance with SEBI regulations including 5-year record retention (Reg. 25)
• Risk profiling and suitability assessment
• Grievance handling and resolution (SEBI 21-day mandate)
• Service improvement and communication

3. Legal Basis (SEBI Compliance)

Data processing is required under SEBI (Research Analysts) Regulations 2014:

• Regulation 24: KYC for fee-paying clients (PAN, address proof, investment objectives)
• Regulation 25: Record keeping for minimum 5 years from first interaction
• Regulation 26: Fee documentation and transaction records
• SEBI Circular Jan 2025: Client agreement, MITC acknowledgment

4. Data Retention

As per SEBI Regulation 25, all client records including KYC documents, research communications, transaction records, and correspondence are retained for a minimum of 5 years from the date of last interaction. This includes WhatsApp messages, SMS, email, and app notifications. Records related to pending disputes are retained indefinitely until resolution.

5. Data Sharing

We do NOT sell your personal data. Data may be shared with:

• SEBI / RAASB (BSE Limited): As required for regulatory compliance, audits, and inspections
• KYC Service Providers: Digio (for PAN/Aadhaar/Bank verification) — data transmitted securely
• Payment Gateway: CCAvenue (for subscription payments) — PCI DSS compliant
• Communication Providers: Meta (WhatsApp Business API), TextLocal (SMS), Telegram Bot API — for message delivery only
• Law Enforcement: If required by law, court order, or regulatory authority

6. Data Security

We implement industry-standard security measures:

• SSL/TLS encryption for all data in transit (HSTS enabled)
• Supabase PostgreSQL with Row Level Security (RLS) for data at rest
• Expo SecureStore for mobile token storage (iOS Keychain, Android Keystore)
• Biometric authentication (Face ID / Fingerprint) for app access
• HMAC-SHA256 webhook signature verification
• Rate limiting on all API endpoints

7. Your Rights

You have the right to:

• Access your personal data held by us
• Request correction of inaccurate data
• Request deletion of data (subject to SEBI 5-year retention requirement)
• Withdraw consent for marketing communications
• File a complaint with SEBI if you believe your data rights are violated

8. Cookies & Tracking

Our website uses essential cookies for authentication and session management. We do not use third-party advertising cookies. The mobile app uses device identifiers for push notification delivery only.

9. Children's Privacy

Our services are not directed to individuals under 18 years of age. We do not knowingly collect personal data from minors. Securities trading requires age verification as per Indian law.

10. Changes to This Policy

We may update this privacy policy to reflect changes in our practices or regulatory requirements. Material changes will be communicated via WhatsApp, email, or app notification. Continued use after notification constitutes acceptance.

11. YouTube API Services Disclosure

ScoutStack Technical Research's internal CRM ("Market Credo CRM") uses the YouTube API Services to manage our company YouTube channel (@marketcredo). By authorising the app, the channel owner consents to the following:

Data we collect via YouTube API Services

• Channel metadata: channel ID, title, description, custom URL, country, thumbnail URL, lifetime subscriber / view / video counts.
• Video catalog: video IDs, titles, descriptions, tags, durations, privacy status, thumbnail URLs, captions flag, lifetime view / like / comment counts.
• Public comment data on our videos: comment IDs, public author display names, public avatar URLs, comment text, like counts, parent comment IDs.
• Aggregate YouTube Analytics: views, watch time, average view duration, impressions, click-through rate, subscribers gained / lost. No per-viewer identifying information is ever collected.

How we use this data

YouTube API data is used solely to populate operator dashboards inside our internal CRM. We do not share, sell, or transmit YouTube API data to any third party. We do not use YouTube API data for advertising, retargeting, or any personalised serving.

Storage and security

• OAuth tokens are stored encrypted at rest in Supabase Vault. Plaintext storage is not used. Access requires service-role privileges held by the application server only.
• All other YouTube API data is stored in our private Supabase Postgres database with Row Level Security policies that restrict read access to the service role.
• All data is transmitted exclusively over HTTPS.

Retention and deletion

• Channel and video metadata: refreshed daily, retained while the channel is connected to our CRM.
• Comments: retained in the operator inbox for 90 days, then archived.
• Aggregate analytics: time-series snapshots retained for trend graphs.
• OAuth tokens: rotated on every refresh (approximately hourly for access tokens, on reconnect for refresh tokens).

How to revoke access and delete data

You can revoke ScoutStack's access to your YouTube data at any time by:

1. Visiting myaccount.google.com/permissions and removing "Market Credo CRM" from the list of third-party apps with access.
2. Emailing indirashakergaye@gmail.com with the subject "Delete my YouTube data" — all stored YouTube API data associated with your account will be deleted from our systems within 24 hours.

Revoking access also invalidates the OAuth refresh token; the CRM cannot make further API calls on your behalf.

Compliance with YouTube and Google policies

This application's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. By using this app, you also agree to be bound by the YouTube Terms of Service.

12. Contact Us

For privacy-related queries or data access requests:

• Compliance Officer: compliance@scoutstack.co.in
• Phone: +91 88279 79008
• Address: Plot No. 83, Shrinivas Tower, M.P. Nagar Zone II, Bhopal, MP 462012
• SEBI SCORES: https://scores.sebi.gov.in