Privacy policy

1. The data we collect

We collect only what we need to run Pivot:

• Account: your name, email address and password. Passwords are stored only as a salted scrypt hash; we never store or see the password itself. If you sign in with Google, we receive your name and verified email address from Google.
• Your work: questions and conversations with the assistant, screenshots you attach, saved layouts, chart drawings, watchlists, alerts, notes, screens, strategies, backtests, paper trades and setups you publish.
• Voice input: if you use the microphone, the recording is sent for transcription and is not stored by us after the text is returned.
• Your own AI keys: if you connect an AI provider key or AI subscription, we store it encrypted (AES-256-GCM), never show it back in full, and send it only to that provider. For a ChatGPT sign-in we keep your display name, not your email.
• Payments: your plan, subscription and payment references and their status. Card, UPI and bank details are entered with Razorpay and never reach our servers.
• Waitlist: your email address and the experience level you choose.
• Usage and device data: which features you use, error reports, your browser and device type, and your IP address, which we use for security and abuse limits.
• Messages you send us: the content of emails to our support address.

2. Why we use it

We use your data for these purposes, and no others:

• to create and secure your account, sign you in and recover access;
• to provide the features you use: answering your questions, saving your work, running your alerts and sending their notifications;
• to process payments, issue invoices and meet tax and accounting obligations;
• to send account, security, billing and service emails, and product emails you can switch off;
• to understand how Pivot is used, fix errors and improve the product;
• to prevent fraud and abuse, and to comply with the law and lawful requests from authorities.

3. Consent and your choices

We process your data on the basis of your consent, given when you create an account or use a feature, or for the legitimate uses the DPDP Act allows, such as data you share with us voluntarily for a specific purpose and compliance with law.

You can withdraw consent at any time by writing to contact@pivotnow.in. Withdrawal does not affect processing that happened before it, but some features will stop working, and closing the account may be the only way to withdraw from all processing.

4. How the AI assistant handles your data

When you ask a question, the question, the relevant part of the conversation and the context of the chart you are viewing are sent to the AI model that answers it. Pivot's assistant runs on Microsoft Azure's AI services, currently in Microsoft's United States data centres. Microsoft processes this data to provide the service and, under its terms, does not use it to train its models.

When the assistant searches the web, the search terms go through our own search service to public search engines and to Brave Search; they are not linked to your name or email. Pages you open in the Browser widget may load through a browser running on our servers, so the site sees our address rather than yours. When you use your own AI key or subscription, your requests go to that provider and its own data terms apply.

Please do not share passwords, card details, Aadhaar or PAN numbers, or other sensitive information in a conversation.

5. Who processes your data

We share personal data only with service providers that process it on our behalf, under contract, for the purposes above:

• Microsoft Azure: hosting, databases and backups (Central India region), the AI assistant and voice transcription (United States).
• Vercel: hosting of our website, pivotnow.in, and its waitlist form.
• Hostinger: our email service, including the emails we send you.
• Razorpay: payments and subscription mandates.
• PostHog: product analytics and error monitoring (United States).
• Google: sign-in, if you choose Sign in with Google, and YouTube searches when the assistant looks for videos.
• Brave Search: web searches the assistant runs for you.

Their own privacy policies: Microsoft, Vercel, Hostinger, Razorpay, PostHog, Google, Brave.

6. Other disclosures

We may disclose personal data when the law requires it, to respond to a valid request from a court, regulator or law-enforcement agency, or to protect the rights and safety of our users and the public. If Pivot Tech is involved in a merger or acquisition, your data may transfer to the successor, which will be bound by this policy.

Market-data and financial-data providers receive no personal data from us.

7. Where your data is stored

Your account and saved work are stored in India, in Microsoft Azure's Central India region. Some of the providers listed above process data outside India, mainly in the United States. We transfer data abroad only as the DPDP Act permits, and never to a country the Government of India has restricted.

8. How long we keep it

We keep personal data only as long as we need it for the purposes in this policy:

• Account and saved work: for as long as your account is open. When you close it, we delete it from our live systems within 30 days.
• Backups: copies of deleted data can remain in our encrypted backups. Backups are used only to recover from a failure and never to restore a closed account.
• Payment and invoice records: for 8 years, as Indian tax and accounting law requires.
• Security and server logs: up to 180 days.
• Email delivery records: 30 days. Password-reset links: they expire after 30 minutes and their records are deleted within a day.
• Waitlist entries: until you get access or ask us to remove you.

9. How we protect it

Data travels over encrypted connections (TLS), passwords are hashed, AI keys are encrypted with a key that is not stored in the database, and backups are encrypted at rest. Access to production systems is limited to the people who need it.

No system is perfectly secure. If a personal-data breach affects you, we will tell you without delay, explain what happened and what you can do, and report it to the Data Protection Board of India and CERT-In as the law requires.

10. Your rights

Under the DPDP Act you have the right to:

• get a summary of the personal data we hold about you and how we process it;
• have inaccurate or incomplete data corrected, completed or updated;
• have your data erased when it is no longer needed, or close your account;
• withdraw consent;
• nominate someone to exercise these rights if you die or become unable to;
• have a grievance addressed by us, and then by the Data Protection Board of India if you are not satisfied.

11. How to exercise them

Email contact@pivotnow.in from the address on your account, saying what you would like us to do. We may need to confirm the request is yours before acting. We respond within 30 days, and tell you if there is a legal reason we must keep some data.

You can also clear the data Pivot stores in your browser at any time.

12. Cookies and browser storage

Pivot uses your browser's local storage to keep you signed in and to remember your workspace and preferences, and a short-lived cookie during checkout. Our analytics service uses browser storage to tell visits apart; it creates a profile only once you sign in. We do not use advertising cookies and do not show third-party ads.

Clearing your browser storage signs you out and removes preferences saved on that device.

13. Children

Pivot is for adults aged 18 and over. We do not knowingly collect data from children. If you believe a child has created an account, write to us and we will delete it.

14. Changes to this policy

We will update this page when our practices change and show the date of the change at the top. For material changes, we will email you before they take effect.