Privacy Policy

01Scope

This policy covers three groups of people:

• Website visitors who browse invarity.ai.
• Demo requesters who submit the request-a-demo form.
• Platform users who hold an account at app.invarity.ai.

We are the data fiduciary for this data, which means we decide why and how it is processed. Where you upload content about other people, such as a colleague's name in a chat, you are responsible for having the right to share it.

02What we collect

We do not collect financial account numbers, PAN, Aadhaar, broker credentials, or live trading positions. The platform is not connected to any broker.

03How we use it

• To run the platform: authenticate you, run and store your backtests and sessions, enforce plan quotas, and show you your own history.
• To power Ivy: send your messages, strategy descriptions and relevant context to a large language model so it can respond (see section 4).
• To take payment: create orders, verify payments and activate plans through Razorpay.
• To communicate: send verification, password-reset and service emails, respond to support requests, and follow up on demo requests.
• To keep things secure: detect abuse, rate-limit requests, investigate incidents and keep audit logs.
• To improve the product: analyse aggregate usage and errors. We do not use your content to train machine-learning models without your explicit consent.
• To meet legal obligations: tax, accounting and lawful requests from authorities.

The legal basis for most of this is your consent, given when you register, submit the form or pay, and the legitimate use of providing a service you asked for. You can withdraw consent at any time as described in section 9, though some features will then stop working.

04AI processing

Ivy is built on large language models provided by Google (the Gemini API). To answer you, we send the model your chat message, your strategy description, relevant parts of your session history and, where needed, the specification, generated code and backtest results it is being asked about. Uploaded files may also be sent when you ask Ivy to read them.

Google processes this data under its API terms as our processor. Under those terms, data sent through the paid API is not used to train Google's models. We do not send your name, email address or payment details to the model unless you type them into a chat yourself, so please avoid doing so.

Model output can be inaccurate. The Terms & Conditions explain the limits of relying on it.

05Who we share it with

We do not sell personal data and we do not share it with advertisers. We share it only with service providers who process it on our behalf, and with authorities where the law requires.

Demo requests are stored in our database and emailed to our sales team so they can contact you.

We may also disclose personal data where required by law, court order or a government authority, to enforce our terms, to protect the rights or safety of anyone, or as part of a merger, acquisition or sale of assets, in which case this policy will continue to apply to the transferred data.

06Cookies and browser storage

The marketing website sets no cookies of its own and runs no analytics or advertising trackers.

The platform stores a session token in your browser so you stay logged in, plus small preferences such as the last view you had open. These are strictly necessary for the service to work. You can clear them by logging out or clearing your browser storage, which will sign you out.

07Retention

08Security

We protect personal data with measures appropriate to its sensitivity, including encryption in transit (TLS) and at rest with our cloud providers, salted password hashing, signed session tokens with limited lifetimes, verification of payment signatures server-side, rate limiting, access controls limited to staff who need the data, and logging of administrative access.

No system is perfectly secure. If we become aware of a personal data breach that affects you, we will notify you and the Data Protection Board of India as required by law, without undue delay.

09Your rights

Under the Digital Personal Data Protection Act, 2023 you have the right to:

• Access a summary of the personal data we hold about you and how it has been processed.
• Correct inaccurate or incomplete data, and update it.
• Erase your data, subject to retention we are legally required to keep.
• Withdraw consent at any time, with effect for future processing.
• Nominate another person to exercise these rights on your behalf if you die or become incapacitated.
• Raise a grievance with our grievance officer, and if unsatisfied, with the Data Protection Board of India.

You can change your name and password in the platform's settings. For anything else, email the grievance officer in section 13 from the address registered to your account. We will verify your identity and respond within 30 days.

10Children

The website and platform are for adults. We do not knowingly collect personal data from anyone under 18. If you believe a minor has created an account, contact us and we will delete it.

11Where data is stored

Our infrastructure runs on cloud providers whose data centres may be located outside India. By using the platform you acknowledge that your data may be stored and processed in those locations. We only use providers that commit to contractual and technical safeguards consistent with Indian law, and we will not transfer data to any country the Indian government restricts by notification.

12Changes to this policy

We may update this policy as the product and the law change. The version and effective date at the top of the page will change when we do. For material changes we will notify you by email or inside the platform before they take effect.

13Grievance officer and contact

As required by the Digital Personal Data Protection Act, 2023, our grievance officer can be reached at:

We acknowledge grievances within 72 hours and aim to resolve them within 30 days.