Privacy Policy

Privacy at a Glance

This short summary is for convenience. The full Privacy Policy below is what applies.

• 1. Signalz is a technology platform that connects Investors with SEBI registered Research Analysts. We are not a SEBI registered intermediary.
• 2. We collect only the personal data needed to run the Platform, help RAs onboard and serve their clients, meet SEBI and other legal requirements, and keep the Platform safe.
• 3. When You subscribe to an RA, the RA is responsible for Your KYC and research records under SEBI rules, and We process that data on the RA's behalf.
• 4. We do not sell Your personal data. We do not share Your data with any RA You have not chosen to subscribe to or buy from.
• 5. We do not store Your trading account login, password, OTP, UPI PIN, full card number or broker holdings.
• 6. Promotional messages and non essential cookies are used only with Your consent, and You can withdraw consent at any time.
• 7. Some records must be kept for at least five years under SEBI rules, and some for longer under tax and company law, even if You close Your Account.
• 8. You can access, correct, update and erase Your data, withdraw consent, nominate someone and raise a grievance. Contact Our Grievance Officer at siddharth@katalx.in.

1. Who We Are and What This Policy Covers

• 1.1. This Privacy Policy is issued by KatalX Technologies Private Limited, CIN U62099MP2024PTC070319, a private limited company incorporated under the Companies Act, 2013, having its registered office at The Address, Regus Honda Big Wing, 33/C/S3, Scheme No. 78 III, near Shalimar Township, Sector F, Slice No. 3, Indore, Madhya Pradesh 452001, India (“Company”, “Signalz”, “We”, “Us” or “Our”).
• 1.2. It explains how We collect, use, share, store, protect and erase personal data when You use www.signalz.in, Signalz.pro, the Signalz Android and iOS applications, Signalz WhatsApp services and every other website, application, link, tool, feature or service operated under the Signalz name (the “Platform”).
• 1.3. This Privacy Policy is the notice required under Section 5 of the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and the Digital Personal Data Protection Rules, 2025 (“DPDP Rules”), and the privacy policy required under the Information Technology Act, 2000, the Information Technology (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011 to the extent still applicable, and Rule 3(1)(a) of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021.
• 1.4. This Privacy Policy forms part of and must be read with Our Terms of Use (“Terms”). Capitalised words not defined here have the meaning given in the Terms.
• 1.5. This Privacy Policy does not cover the independent websites, apps or systems of RAs, stock brokers, payment gateways or other third parties, even if You reach them through the Platform. Their own privacy policies apply.
• 1.6. This Privacy Policy is an electronic record under the Information Technology Act, 2000, is generated by a computer system and does not require any physical or digital signature.

2. Our Role Under Data Protection Law

Under the DPDP Act, a “Data Fiduciary” decides why and how personal data is processed, and a “Data Processor” processes it on behalf of a Data Fiduciary. Signalz plays different roles depending on the activity:

• 2.1. Where We act as a Data Processor for an RA, We process Your data only on the RA's instructions and under a written contract. You may also exercise Your rights directly with the RA.
• 2.2. We have not been notified as a Significant Data Fiduciary. If We are notified, We will comply with the additional obligations that apply, including appointing a Data Protection Officer based in India and carrying out periodic data protection impact assessments and audits.

3. Definitions

• 3.1. “Personal Data” means any data about an individual who is identifiable by or in relation to such data.
• 3.2. “Data Principal” or “You” means the individual to whom the personal data relates.
• 3.3. “Processing” means any operation performed on personal data, including collection, recording, organisation, storage, use, sharing, restriction, erasure and destruction.
• 3.4. “Consent Manager” means a person registered with the Data Protection Board of India who lets You give, manage, review and withdraw consent through an accessible platform.
• 3.5. “Board” means the Data Protection Board of India set up under the DPDP Act.

4. Personal Data We Collect

We collect only the personal data that is necessary for the purposes in Section 6. The data depends on how You use the Platform.

4.1 If You are an Investor

4.2 If You are a Research Analyst or Partner

4.3 Data collected automatically from every User

• 4.4. Data We do not collect. We do not collect or store Your trading account login, password, OTP, UPI PIN, full card number, CVV, broker holdings, order book or portfolio from any stock broker. We do not knowingly collect personal data of anyone under 18. We do not collect health, biometric data other than the photograph or selfie needed for KYC, or data about religion, caste or political views.
• 4.5. Fields that are mandatory are marked on the Platform. If You do not provide mandatory data, We or the RA may not be able to provide a particular service.

5. How We Collect Personal Data

• 5.1. Directly from You when You register, complete Your profile or Investor Persona, subscribe, buy, complete KYC, eSign, post content, take part in Contests or campus programmes, or contact Us.
• 5.2. Automatically when You use the Platform, through cookies, SDKs, logs and similar technologies.
• 5.3. From third parties, including KYC Registration Agencies, the Central KYC Records Registry, DigiLocker and eSign providers when You authorise it; payment gateways; the RA You subscribe to; PaRRVA and its data centre for verified RA performance; Partners who refer You; and public sources such as the SEBI register of Research Analysts.

6. Why We Use Personal Data and on What Basis

We process personal data either with Your consent or for a legitimate use permitted under Section 7 of the DPDP Act, such as data You have voluntarily provided for a specific purpose, or compliance with law, a court order or a regulatory requirement.

• 6.1. We will not use Your personal data for a new purpose that is not compatible with the purposes above without informing You and, where required, obtaining fresh consent.

7. Consent

• 7.1. Where We rely on consent, it is free, specific, informed, unconditional and unambiguous, given by a clear affirmative action such as ticking a box or tapping a button, and limited to the data needed for the stated purpose.
• 7.2. Consent for promotional messages, non essential cookies and optional Investor Persona fields is separate from consent needed to use the core service, and refusing it will not stop You from using the Platform.
• 7.3. You may withdraw consent at any time, as easily as You gave it, from Your Account settings, by replying STOP to promotional messages where offered, or by writing to compliance@signalz.in. Once withdrawn, We will stop the related processing within a reasonable time and cause Our Data Processors to stop as well, unless the law requires or allows Us to continue.
• 7.4. Withdrawal does not affect processing done before withdrawal. If You withdraw consent needed for a core service, We or the RA may not be able to continue providing that service.
• 7.5. You may give, manage, review and withdraw consent through a Consent Manager registered with the Board, once such services are available, and We will honour consent given that way.
• 7.6. We keep a record of every consent given and withdrawn, as required by law.

8. Who We Share Personal Data With

We share personal data only for the purposes in Section 6, only to the extent needed, and under written contracts that require the recipient to protect it.

• 8.1. Your data is never shared with an RA You have not chosen to subscribe to or buy from. Investor Persona matching happens on the Platform, and an RA receives Your details only after You choose that RA.
• 8.2. RAs and educators who receive Your data are independently responsible for it under SEBI rules and data protection law, and are contractually required to use it only for serving You.
• 8.3. On a lawful order or request from an authorised government agency for prevention, detection, investigation or prosecution of offences or for cyber security incidents, We will provide information within the time required by law, which under the Intermediary Rules is generally within 72 hours.

9. What We Never Do

• 9.1. We never sell, rent or trade Your personal data.
• 9.2. We never share Your personal data with any listed company, issuer or person whose securities are covered in research.
• 9.3. We never use Your personal data to place, influence or front run any trade.
• 9.4. We never ask for or store Your trading account password, OTP, UPI PIN, full card number or CVV.
• 9.5. We never share Your data with advertisers for their own use.

10. Investor Persona, Profiling and Artificial Intelligence

• 10.1. We use the preferences You give Us to build an Investor Persona and show You RAs whose research style, segments and offerings match it. This is automated matching. It is not risk profiling, a suitability assessment, investment advice or a recommendation, and You make the final choice.
• 10.2. No RA can pay to change how it is matched or shown to You.
• 10.3. We may use artificial intelligence tools for summaries, search, translation, matching and content organisation. We share with AI service providers only the data needed for the feature, under contracts that restrict them to providing the service to Us. We do not use Your personal data to train AI models outside Signalz.
• 10.4. No decision that has a legal or similarly significant effect on You, such as suspension of Your Account, is taken solely by automated means without human review. You may ask Us to explain how matching works or to review any automated outcome by writing to compliance@signalz.in.
• 10.5. You can view and edit Your Investor Persona at any time, or delete optional fields.

11. Cookies and Similar Technologies

Cookies are small files stored on Your device. We and Our service providers use cookies, SDKs, pixels and local storage on the Platform.

• 11.1. You can manage cookie preferences through the cookie banner or settings on the Platform and through Your browser or device settings. Withdrawing consent stops future use and does not affect earlier use.
• 11.2. Third party websites linked from the Platform may set their own cookies, which We do not control.

12. Device Permissions

• 12.1. The Signalz app may ask for the following permissions, only when a feature needs them:
  1. camera and microphone, for KYC photographs, selfie or video verification, and live sessions;
  2. storage, photos and files, to upload KYC documents or attachments;
  3. notifications, to deliver research, alerts and service updates;
  4. approximate location, only if You allow it for a feature that needs it.
• 12.2. We do not access Your contacts, SMS inbox or call logs. You can turn off any permission in Your device settings at any time, though related features may stop working.

13. Communications and Marketing

• 13.1. We send transactional and service messages through WhatsApp, SMS, email, push notifications, in app messages and calls, as described in Section 11 of the Terms.
• 13.2. We send promotional messages only with Your consent and in line with the Telecom Commercial Communications Customer Preference Regulations, 2018. You can opt out at any time without affecting service messages.
• 13.3. WhatsApp messages are processed by Meta Platforms under its own terms and privacy policy. Do not share KYC documents, passwords or OTPs over WhatsApp unless the Platform's verified flow asks for a document.
• 13.4. Calls with Our team may be recorded for quality, training and compliance, and You will be told at the start of the call.

14. Broker Linking and Basket Links

• 14.1. When an RA's research includes a basket, We may send You a Basket Link that opens Your stock broker's order window. You review and confirm the order on the broker's platform.
• 14.2. We do not receive or store Your broker login, password, OTP, holdings, orders or trade confirmations. Your broker's privacy policy applies to data You share with it.

15. Payments

• 15.1. Payments for Research Services are processed by the RA's own payment gateway, and payments for Education Products by Our payment gateway. Payment gateways are regulated by the Reserve Bank of India and are responsible for card and bank data security, including storage of payment data as required by the Reserve Bank of India.
• 15.2. We receive only the transaction reference, amount, status and masked payment details, and bank details You give Us for refunds.

16. How Long We Keep Personal Data

We keep personal data only as long as needed for the purpose for which it was collected, or longer where the law requires. After that, We erase it or anonymise it so that it can no longer identify You.

• 16.1. Inactive Accounts. If Your Account is inactive for three years, We may erase Your personal data after giving You at least 48 hours' notice, except data We must keep under this Section. Logging in or contacting Us within the notice period keeps Your Account active.

17. How We Protect Personal Data

• 17.1. We take reasonable security safeguards, as required by the DPDP Act, the DPDP Rules and Section 43A of the Information Technology Act, 2000, to prevent personal data breaches. These include:
  1. encryption of data in transit and at rest, and masking or tokenisation of sensitive fields such as Aadhaar and PAN where appropriate;
  2. role based access control, multi factor authentication for staff and need to know access;
  3. logging and monitoring of access to personal data to detect unauthorised access;
  4. backups and measures to keep data available and recoverable;
  5. regular vulnerability assessment and penetration testing, and secure development practices;
  6. written contracts with Data Processors requiring equivalent security safeguards;
  7. confidentiality obligations and privacy training for employees, who must not access or use research or personal data except for their work.
• 17.2. Aadhaar data, where used for KYC, is handled only in the manner permitted under the Aadhaar Act, 2016 and its regulations. We do not store full Aadhaar numbers.
• 17.3. No system is completely secure. You must keep Your login credentials, OTPs and devices secure and tell Us immediately if You suspect unauthorised use.

18. Personal Data Breach

• 18.1. If a personal data breach occurs, We will inform affected Users without delay, in plain language, about the nature and extent of the breach, its likely consequences, the steps We have taken and the steps You can take to protect Yourself, and Our contact details.
• 18.2. We will inform the Board without delay and give it a detailed report within 72 hours of becoming aware of the breach, or such longer time as the Board allows. We will also report cyber security incidents to the Indian Computer Emergency Response Team within the time required by its directions, and inform SEBI, RAASB or affected RAs where required.

19. Where Personal Data Is Stored and Cross Border Transfer

• 19.1. Personal data is stored on servers of Our cloud service providers. Some service providers may store or process data outside India.
• 19.2. Any transfer outside India is made in compliance with Section 16 of the DPDP Act and the DPDP Rules, and not to any country or territory restricted by the Central Government. Recipients are bound by contracts requiring them to protect the data to the standard required by Indian law.
• 19.3. Records relating to Research Services are maintained so that they can be produced to SEBI, RAASB and other authorities whenever required. System logs are maintained in India as required by law.

20. Your Rights

Subject to the DPDP Act and other Applicable Law, You have the following rights:

• 20.1. Right to access information. You can ask for a summary of the personal data We process about You, the processing activities, and the identities of other Data Fiduciaries and Data Processors with whom it has been shared, along with a description of the data shared.
• 20.2. Right to correction, completion and updating. You can correct inaccurate or misleading data, complete incomplete data and update data. Many details can be changed directly in Your Account settings.
• 20.3. Right to erasure. You can ask Us to erase personal data that is no longer needed for the purpose for which it was collected, unless We must keep it under law, as set out in Section 16.
• 20.4. Right to withdraw consent, as described in Section 7.
• 20.5. Right of grievance redressal. You can raise a grievance with Our Grievance Officer as described in Section 27.
• 20.6. Right to nominate. You can nominate another individual to exercise Your rights in case of Your death or incapacity, by writing to compliance@signalz.in with the nominee's name and contact details.
• 20.7. How to exercise Your rights. Use the options in Your Account settings or write to compliance@signalz.in from Your registered email address, mentioning Your registered mobile number. We may ask You to verify Your identity before acting on a request. We will acknowledge Your request within 24 hours and respond within 30 days, and in any case within the time limit set by the DPDP Rules.
• 20.8. Where We hold data as a Data Processor for an RA, We will pass Your request to the RA and help the RA respond. You may also contact the RA directly.
• 20.9. Exercising these rights is free of charge.

21. Your Duties as a Data Principal

Under Section 15 of the DPDP Act, You must:

1. follow Applicable Law when exercising Your rights;
2. not impersonate another person while providing personal data;
3. not suppress any material information while providing personal data for KYC or any document issued by the State;
4. not register a false or frivolous grievance or complaint with Us or the Board;
5. provide only verifiably authentic information when exercising the right to correction or erasure.

Breach of these duties may attract a penalty under the DPDP Act.

22. Children's Personal Data

• 22.1. The Platform is only for individuals aged 18 or above. We do not knowingly collect personal data of children, and campus programmes are open only to students aged 18 or above.
• 22.2. If We learn that We have collected personal data of a child without verifiable parental consent, We will delete it and close the Account. If You believe a child has registered, please write to compliance@signalz.in.

23. Personal Data of Others You Share With Us

• 23.1. If You give Us personal data of another person, for example when referring a friend, adding a nominee or posting content, You confirm that You have their permission to do so and have told them about this Privacy Policy.
• 23.2. You must keep personal data of other Users that You come across on the Platform confidential and must not collect, copy or misuse it.

24. Third Party Websites and Services

• 24.1. The Platform may link to or integrate with third party websites and services, including RAs' own websites, stock brokers, payment gateways, KYC providers and social media. We are not responsible for their privacy practices. Please read their privacy policies before sharing data with them.

25. Business Transfers

• 25.1. If the Company is involved in a merger, acquisition, amalgamation, restructuring or sale of all or part of its business, personal data may be transferred to the successor, subject to Applicable Law. The successor will be bound to protect it on terms no less protective than this Privacy Policy, and We will inform You of any change in who controls Your data.

26. Changes to This Privacy Policy

• 26.1. We may update this Privacy Policy to reflect changes in law, regulation or the Platform. For material changes, including any new purpose of processing, We will notify You by email or in app message at least 7 days before they take effect and, where required, ask for fresh consent.
• 26.2. The latest version is always available on the Platform with its Last Updated date. Earlier versions are archived and available on request.

27. Grievance Officer and Contact

• 27.1. For any question, request or grievance about this Privacy Policy or Your personal data, contact:

  Siddharth Raj Jain, Grievance Officer and Data Protection Contact

  Email: siddharth@katalx.in or compliance@signalz.in

  Address: KatalX Technologies Private Limited, The Address, Regus Honda Big Wing, 33/C/S3, Scheme No. 78 III, near Shalimar Township, Sector F, Slice No. 3, Indore, Madhya Pradesh 452001, India

• 27.2. We will acknowledge every grievance within 24 hours and resolve it within 15 days of receipt, as required under the Intermediary Rules, and in any case within the time limit set by the DPDP Rules.
• 27.3. If You are not satisfied with Our response, You may complain to the Data Protection Board of India, after exhausting Our grievance redressal process, as provided under the DPDP Act.
• 27.4. Complaints about Research Services provided by an RA can also be raised with the RA, on SEBI's SCORES portal at https://scores.sebi.gov.in, and through SEBI's SMART ODR portal at https://smartodr.in, as described in Schedule 3 of the Terms.

28. Language and Governing Law

• 28.1. This Privacy Policy is available in English. You may ask for it in any language listed in the Eighth Schedule to the Constitution of India by writing to compliance@signalz.in. If there is any difference between versions, the English version prevails.
• 28.2. This Privacy Policy is governed by the laws of India. Disputes are subject to Section 29 of the Terms.

Copyright © KatalX Technologies Private Limited. All rights reserved.

Version 2.0 | Last Updated : 01 October 2026