Privacy Policy

ArjunaFx is operated by Agyaat Solutions ("Arjuna", "we", "us"), a business established in India. For the purposes of the Digital Personal Data Protection Act, 2023 ("DPDP Act") we are the Data Fiduciary for the personal data described in this policy; for users in the European Economic Area and the United Kingdom we are the Data Controller under the GDPR / UK GDPR.

You can reach us about anything in this policy at [email protected]. Our registered postal address is available on request to the same address.

Account data

• Your full name and email address, supplied when you register for the customer portal.
• Your password, which is never stored in readable form — authentication is handled by our identity provider, which stores only a salted hash.
• A phone number and any notes, where you give them to us during onboarding or support.
• A partner or referral code, if you registered through a partner of ours.

Enquiry data

• Your name, email address, phone number, preferred contact time and message, when you submit the contact form on our website.

Trading account and telemetry data

When you connect a MetaTrader account to Arjuna, the Expert Advisor ("EA") running on your terminal reports operational data to us so the dashboard can display and control it:

• Your MetaTrader account login number, broker name, and whether the account is a demo or a real account.
• Per-bot identifiers: the magic number, chart symbol, label and the EA runtime parameters in force.
• Trade events: ticket number, symbol, buy/sell side, lot size, entry and exit price, profit or loss, and the times the position was opened and closed.
• Account snapshots: balance, equity, margin level, floating profit or loss, realised profit or loss for the day, paused state and last-seen timestamp.
• Commands you or an administrator issue to a bot (pause, resume, change side, close a position, change a parameter) together with the time they were issued and consumed.

Technical data

• IP address, browser type and device information contained in ordinary web server and API logs.
• Session and error logs generated when you use the portal or when the EA calls our API.

• To create and operate your account, authenticate you, and keep you signed in — necessary to perform our contract with you (GDPR Art. 6(1)(b)); under the DPDP Act, processing for the purpose for which you gave your data.
• To license your trading accounts, register your bots, deliver commands to them and show you live and historical performance — necessary to perform our contract with you.
• To answer enquiries you send us through the contact form — your consent, and our legitimate interest in responding to prospective customers.
• To keep the service secure, detect abuse of API tokens and diagnose faults — our legitimate interest in operating a secure service (GDPR Art. 6(1)(f)).
• To measure how our public marketing pages perform — your consent, where analytics cookies are used.
• To meet legal, tax and accounting obligations — compliance with a legal obligation (GDPR Art. 6(1)(c)).

We do not sell your personal data, and we do not use your trading data to trade against you or to build profiles for advertising.

Arjuna uses first-party and third-party cookies, browser local storage, and web analytics measurements on our marketing website and customer portal for security, session management, partner attribution, and platform performance.

Detailed Cookie & Storage Collections:

• Strictly Necessary Session Cookie (arjuna_session): An httpOnly, secure, signed session token that maintains your authenticated session in the customer portal. It cannot be disabled.
• Partner Referral Attribution Cookie (arjuna_ref / arjuna_partner): A 30-day tracking cookie saved when you visit via a partner referral link, ensuring your account is accurately assigned under your partner IB code.
• User Preference Storage (arjuna_theme / skin / mode): Remembers your chosen UI appearance, light/dark mode preference, and menu state across visits.
• Marketing Analytics Measurement (_ga, _gid, _gtm): Collected solely on public marketing pages (arjunafx.trade) via Google Tag Manager to analyze traffic sources, visitor counts, and page engagement.

You can disable, manage, or delete cookies through your web browser preferences at any time. Note that clearing strictly necessary session cookies will require you to re-authenticate when logging into the portal.

We share personal data only with service providers who process it on our instructions, and only as far as they need it to provide their service to us:

• Supabase — managed database and authentication. Stores your account record, trading accounts, bots and all trading telemetry.
• Our cloud hosting and network providers — run the API, dashboard and supporting services, and process data incidentally through server logs.
• Resend — delivers transactional and enquiry email on our behalf.
• Google Tag Manager and Google Analytics — measurement on public marketing pages only, as described above.

If you registered through one of our partners using their referral code, we share with that partner the limited information they need to support and be credited for your account — typically your name, the accounts linked to you and their status. Partners do not receive your password.

We may disclose data where we are legally required to do so, to enforce our Terms and Conditions, or to protect our rights, our users or the public. If our business is sold or reorganised, data may transfer to the acquirer under the protections of this policy.

Our service providers may store or process data on servers outside your country, including outside India and outside the EEA. Where we transfer personal data from the EEA or the UK, we rely on the European Commission Standard Contractual Clauses or an equivalent safeguard in our agreements with those providers. Under the DPDP Act we transfer only to countries not restricted by the Central Government.

• Account and contact data: for as long as your account is active, and up to 24 months after you close it, so we can handle disputes and support requests.
• Trading telemetry (trade events, snapshots, commands): retained while the account is active and for up to 5 years afterwards, since it is the record of what the software did on your account.
• Enquiry emails: up to 24 months from the last message.
• Server and security logs: typically 90 days.

Where we are required to keep records for longer by tax or other law, we keep them for the period that law requires and no longer.

• All traffic between your browser, the EA and our API is encrypted in transit with TLS.
• The dashboard holds no database credentials. Every read and write is proxied by our backend, which is the only component with privileged database access.
• Sessions use an httpOnly, signed cookie rather than a token exposed to JavaScript.
• Each trading account has its own API token, which can be rotated, and each account carries a licence switch that disables it immediately when suspended.

No system is perfectly secure. Keep your password and your API token private — anyone holding your API token can send telemetry as your account. Tell us at once if you believe either has been exposed.

If you are in India (DPDP Act, 2023)

• Access a summary of the personal data we process about you and who we have shared it with.
• Have inaccurate or incomplete data corrected, updated or completed.
• Have your data erased when it is no longer needed for the purpose you gave it for, unless retention is required by law.
• Nominate another person to exercise these rights on your behalf if you die or become incapacitated.
• Withdraw consent at any time, where our processing rests on consent.
• Have a grievance addressed by us. Write to [email protected] and we will respond within the period prescribed by law. If you are not satisfied, you may complain to the Data Protection Board of India.

If you are in the EEA or the UK (GDPR / UK GDPR)

• Rights of access, rectification, erasure, restriction of processing, data portability, and objection to processing based on legitimate interests.
• The right to withdraw consent at any time without affecting processing already carried out.
• The right to lodge a complaint with your local supervisory authority.

To exercise any of these rights, email [email protected] from the address registered on your account. We may ask you to verify your identity before we act, and we will not charge you for a reasonable request.

Arjuna is not offered to anyone under 18. We do not knowingly collect data from children, and we do not carry out tracking or targeted advertising directed at children. If you believe a child has given us personal data, tell us and we will delete it.

We may update this policy as the service changes. The effective date at the top always reflects the current version. If a change materially affects how we use your data, we will tell you by email or through the portal before it takes effect.

Questions, requests or complaints about privacy: [email protected]. We aim to answer every request within 30 days.