Data Retention & Deletion

1.Purpose & Scope

This Data Retention & Deletion Policy explains how long StockYatra keeps the different kinds of data we hold, and what happens when data is deleted. It supplements, and should be read together with, our Privacy Policy.

1. 1.1StockYatra is an educational paper-trading simulator operated by Lacspace Corporation Pvt. Ltd. This policy covers personal data we process through the website, mobile apps and related services (together, the "Service").
2. 1.2Where this policy uses "personal data", it means information that identifies you or can reasonably be linked to you. "Anonymised" or "aggregated" data — data stripped of identifiers so it no longer points to you — is treated differently and may be kept indefinitely.
3. 1.3If any term here appears to conflict with the Privacy Policy, the Privacy Policy governs the meaning of personal data and your rights over it; this policy adds detail on retention periods and deletion.

2.Our Retention Principle

1. 2.1We keep personal data only for as long as is necessary for the purpose it was collected, or for as long as the law requires us to keep it — whichever is longer.
2. 2.2When data is no longer needed for its purpose and no legal duty requires us to retain it, we delete it or irreversibly anonymise it so that it can no longer be linked to you.
3. 2.3Retention periods are set by reference to the purpose of the data, the sensitivity of the data, and any legal, tax, accounting or fraud-prevention obligation that applies. Because those factors differ by data type, the periods below are stated as principles rather than a single fixed number.

3.Retention by Data Type

Different kinds of data serve different purposes, so we keep them for different lengths of time. The main categories are:

1. 3.1We hold and retain the following broad categories of data:
   • Account & profile data (your name, email, login and account settings): kept while your account is active, so the Service works for you.
   • Activity & simulated-portfolio data (your virtual trades, coin and cash balances, watchlists, learning progress and in-app actions): kept while your account is active, then anonymised or aggregated so we can improve the Service without still identifying you.
   • Support communications (emails, tickets and chat with our team): kept for a limited period after your query is resolved, so we can handle follow-ups and reference past issues.
   • Payment & deposit records (records of verified deposits and any in-app service purchases): kept longer where tax, accounting or anti-fraud law requires us to retain them.
   • Security & server logs (technical logs, IP addresses, device and access records used to keep the Service safe): kept for a short rolling window and then overwritten or deleted.
   • Cookies & local storage (data held in your browser or on your device): kept for the lifetimes described in the Cookie Policy, and you can clear them at any time.
2. 3.2The periods above are maximums, not targets. Where we can safely shorten a retention period without breaking the Service or a legal duty, we do.

4.Legal & Regulatory Retention

1. 4.1Some records must be kept for a minimum period set by law — for example tax, accounting and anti-fraud records — even if you have closed your account or asked us to delete your data.
2. 4.2Where a legal minimum retention period applies, we keep only the specific records the law requires, for only as long as it requires, and we restrict access to them for that purpose alone.
3. 4.3We may also retain data where we are required to by a lawful request, court order, or ongoing legal claim, until that obligation ends.

5.How Account Deletion Works

1. 5.1You can close your account at any time from within the Service, or by asking us to close it. You may also make a separate request to delete your personal data without closing your account, subject to your rights below.
2. 5.2On account closure, or on a valid deletion request, we delete or irreversibly anonymise your personal data within a reasonable period, except for anything we are required or permitted to keep under this policy.
3. 5.3Deletion from our live systems does not instantly erase data from encrypted backups. Backups age out and are overwritten on their normal rotation cycle; until then, data in a backup is isolated, not actively used, and restored only for disaster recovery.
4. 5.4Once your account is deleted or anonymised, your simulated portfolio, coins, rankings and learning history cannot be recovered. Coins carry no monetary value and are non-withdrawable, so nothing of real-world value is lost on deletion.

6.What We May Retain After Deletion

Deletion is thorough but not always total. After we act on a deletion request, we may keep a limited amount of data:

1. 6.1We may retain the following after deleting the rest of your personal data:
   • minimal records needed for legal, tax and accounting compliance;
   • records needed to detect, prevent and investigate fraud or abuse of the Service;
   • the minimum information needed to handle or defend a dispute, claim or complaint;
   • anonymous, aggregated statistics that no longer identify you and are used to understand and improve the Service.
2. 6.2We keep such data only for as long as its specific purpose requires, and we do not use retained legal or fraud-prevention records to rebuild your profile or market to you.

7.Your Rights

1. 7.1You can ask us to confirm what personal data we hold about you, to correct it, or to delete it. To make a request, email privacy@stockyatra.com.
2. 7.2We may need to verify your identity before acting on a request, so that we do not disclose or delete data at the wrong person's instruction.
3. 7.3Where we cannot fully delete data because a legal duty or overriding purpose requires us to keep it, we will tell you what we are keeping and why.
4. 7.4If you are unhappy with how we handle a request, you can escalate through our Grievance & Dispute Resolution process.

8.Third Parties & Sub-processors

1. 8.1We use trusted providers — such as hosting, analytics, email and payment providers — to run the Service. They process personal data only on our instructions and under contract.
2. 8.2We instruct these providers to retain personal data only as long as needed to perform their service, and to delete or return it to us when it is no longer needed or when our arrangement ends.
3. 8.3A provider may be subject to its own legal retention duties; where that is the case, retention by that provider follows the same principles set out in this policy.

9.Changes to This Policy

1. 9.1We may update this policy from time to time. The current version is always the one published at stockyatra.com/legal/data-retention, and the effective date at the top reflects the latest revision.
2. 9.2Material changes will be notified through the Service or by other reasonable means. Continued use after a change means you accept the updated policy.

10.Contact

1. 10.1Questions about data retention or deletion, and all access or deletion requests: privacy@stockyatra.com. For general legal questions: legal@stockyatra.com.