Privacy Policy & Data Protection

This Privacy Policy describes the operational and technical policies of Techthaastu Technologies ("RAStage", "We", "Us", "Our") regarding the collection, storage, processing, transfer, and safeguarding of personal and transactional data obtained through https://rastage.techthaastu.com/, our APIs, subdomains, white-label client portals, and official mobile applications (iOS and Android).

Under the Digital Personal Data Protection Act, 2023 (DPDP Act):

• For Research Analyst Account Data: RAStage acts as a Data Fiduciary in respect of the registration, billing, and operational data collected from the Research Analyst and their designated team members.
• For End-Client / Investor Data: The SEBI Registered Research Analyst acts as the primary Data Fiduciary who establishes the legal advisory relationship with the investor. RAStage acts as a Data Processor providing cloud storage, CRM pipelines, recommendation broadcast engines, and payment connectivity on behalf of the Research Analyst.

We collect only the minimum required information necessary to provide low-latency recommendation broadcasts, compliance auditing, CRM workflows, and payment checkouts:

We process collected personal and operational data exclusively for the following lawful purposes:

1. Delivering Trade Calls & Research: Operating the Recommendation Studio to dispatch entry prices, stop-loss triggers, target levels, and research rationale PDFs to subscribed investors.
2. Multi-Channel Broadcast Dispatch: Transmitting notifications via the official WhatsApp Business API, Telegram Bots, Telecom DLT SMS gateways, and transactional email servers.
3. Mobile App Experience: Powering our iOS and Android mobile apps to display real-time push alerts, portfolio tracking cards, historical recommendation outcomes, and risk assessments.
4. CRM & Subscription Renewal Automation: Managing subscriber tenures, calculating subscription validity, and sending automated UPI / Razorpay renewal reminders.
5. Regulatory Compliance & SEBI Audit Vault: Generating cryptographically hashed, immutable records of all publications, deliveries, and rationales as legally mandated by SEBI Regulations.

In an industry plagued by data scraping and unauthorized lead brokering, RAStage stands firmly on principles of absolute data confidentiality:

• No Third-Party Data Brokering: We NEVER sell, license, lease, share, or disclose client phone numbers, email addresses, or trading activity to third-party stockbrokers, lending apps, marketing agencies, or advertising exchanges.
• No Internal Cross-Selling: RAStage does not market competing research services or third-party products to an RA’s registered client base.
• Client Confidentiality: Your client list is strictly compartmentalized. Multi-tenant database security ensures no Research Analyst can ever view or access another analyst's subscriber data.

All digital transactions across RAStage—including SaaS upgrades, 1-click subscription checkouts, and UPI renewals—are processed securely through our verified payment partner, Razorpay Software Private Limited ("Razorpay"):

To ensure instantaneous (<0.8s SLA) broadcast delivery, RAStage transmits data through specialized enterprise sub-processors under strict data protection agreements:

• Meta Platforms (WhatsApp Business Cloud API): Dispatches encrypted recommendation alerts directly to subscriber mobile numbers. Data processed is limited to recipient phone numbers and pre-approved template message contents.
• Telegram Messenger API: Transmits real-time markdown broadcasts to linked Telegram Channels and private subscriber bots based on unique Telegram user IDs.
• Telecom DLT SMS Gateways: Transmits critical trading stop-loss and entry triggers via TRAI-registered telecom gateways (DLT scrubbing compliant).
• Amazon Web Services (AWS SES): Dispatches transactional emails, GST tax invoices, password resets, and comprehensive research PDFs.

The RAStage mobile applications for iOS and Android are engineered with strict privacy safeguards. We only request device permissions strictly necessary for application functionality:

• Push Notifications (POST_NOTIFICATIONS): Required to deliver time-sensitive market alerts, target hits, and stop-loss notifications directly to the device lock screen.
• Network Access (INTERNET / ACCESS_NETWORK_STATE): Required to communicate with our secure cloud servers and verify live trade call statuses.
• Biometric Authentication (Local Only): Optional fingerprint / FaceID unlock. Biometric validation is handled entirely on the local device enclave; biometric data is never transmitted to or stored on our servers.
• NO Intrusive Access: Our applications do NOT request access to your contact book, microphone, camera, background location, or private photo storage.

RAStage adheres to the stringent cybersecurity guidelines prescribed by SEBI circulars for market technology platforms:

While data principals possess rights to request data erasure under Section 12 of the DPDP Act 2023, such erasure rights are subject to Section 17 of the DPDP Act, which permits continued processing and retention where required by applicable laws or for compliance with statutory obligations.

Therefore, recommendation logs, published rationales, and investor delivery receipts stored within the SEBI Audit Vault cannot be destroyed or erased prior to the expiration of the statutory 5-year retention period, even if an account is closed or deleted.

Subject to the regulatory retention requirements outlined in Section 09, users possess the following statutory rights under the Digital Personal Data Protection Act, 2023:

• Right to Access Summary: You may request a summary of your personal data processed by RAStage and the identities of third-party sub-processors with whom it has been shared.
• Right to Correction & Updating: You may update or correct inaccurate or incomplete profile data directly from your console or by submitting a written request.
• Right to Grievance Redressal: You have the right to register complaints regarding data processing with our designated Grievance Officer, and if unsatisfied, escalate to the Data Protection Board of India.
• Right to Nominate: You have the right to nominate an individual who, in the event of your death or incapacity, shall exercise your data protection rights.

RAStage utilizes strictly necessary and functional cookies to ensure secure session authentication:

• Authentication Cookies: Secure, HttpOnly, SameSite cookies used to maintain verified login sessions for Research Analysts and investor subscribers.
• CSRF Prevention Tokens: Cryptographic tokens protecting web forms against cross-site request forgery attacks.
• No Invasive Advertising Trackers: We do NOT employ third-party advertising cookies, cross-site behavioral retargeting pixels (e.g. Meta Pixel, TikTok Pixel), or commercial tracking networks.

In accordance with Rule 3(2) of the Information Technology (Intermediary Guidelines) Rules, 2021, and the Digital Personal Data Protection Act, 2023, RAStage has designated a dedicated Grievance Redressal Officer: