Legal
Privacy Policy
What we collect, why, who else sees it, how long we keep it, and how to delete it.
Who we are
ZOOX AI is operated by Gunasekaran Vignesh (trading as ZOOX AI), which decides how your personal data is used and is responsible for it.
Questions about your data go to Gunasekaran Vignesh, our grievance officer, at zooxaiinfo@gmail.com.
What we collect
Your account: your name, email address, and mobile number if you give one, plus your password — stored only as a one-way hash, so nobody, including us, can read it back — and your time zone.
Your Deriv connection: the account id (for example DOT90004580), whether it is a demo or real account, its currency and last known balance, and the API token you give us. The token is encrypted with AES-256-GCM, is never shown back to anyone, and cannot withdraw money.
Your trading: your settings and limits, every contract placed through the service (market, direction, stake, payout, prices, result and times), daily totals, and the notifications we send you.
WhatsApp alerts, only if you switch them on: your WhatsApp number and the key CallMeBot gave it. The key is encrypted with AES-256-GCM and never shown back to anyone.
Your payments: the Razorpay order and payment references, the amount, status and payment method, and the payment notice Razorpay sends us, which can include the email address and phone number entered at checkout. We never receive your card number, UPI PIN or bank login.
Website purchases: the name, email address and phone number you enter when you pay for a plan on our website, so we can apply it to your account and contact you about it.
Signing in: a short description of the device you signed in from, kept with the session so it can be ended. Email verification codes are stored only as hashes and expire after ten minutes.
Technical records: our servers, and the network provider in front of them, record IP addresses and request details for security. Error reports have passwords, tokens and codes removed before they leave our servers.
We do not collect your location, contacts, photos or files, and the app contains no advertising or analytics trackers. The app downloads its fonts from Google Fonts, which sees your IP address when it does.
Why we use it
To provide the service: placing contracts on your Deriv account according to your settings, enforcing your limits, and showing your history.
To take payment and manage your subscription, to send verification codes and notifications, to answer you when you contact us, to keep the service secure, and to meet our legal obligations.
We process your data because you asked us to provide the service and agreed to these terms, and, for payment records, because the law requires it.
We do not sell your data, use it for advertising, or share it with anyone for their own marketing.
Who else sees it
Deriv receives your API token and our trade requests for your account. What Deriv holds about you is governed by its own privacy policy.
Razorpay processes your payment. Our email provider delivers the emails we send you. Our hosting provider runs the servers and database. Our network provider carries traffic to our servers. Our error-monitoring provider receives error reports with secrets removed.
If you switch on WhatsApp alerts, CallMeBot (callmebot.com) receives your WhatsApp number, its key and the text of each alert (the contract, stake and result), and delivers it to you over WhatsApp. Switch them off in the app at any time. The operator also receives an alert for each of your trades, with your client ID and name.
Each receives only what it needs for that job. Some of them process data outside India.
We disclose data to authorities only when the law requires us to.
How long we keep it
Everything is kept while your account exists.
When you delete your account, we delete your name, email address, mobile number, Deriv accounts and tokens, trade history, settings, notifications and sessions straight away.
Payment and subscription records — amount, date and references — are kept for as long as tax law requires, currently up to eight years. They are no longer linked to your name or email.
Website purchase records — name, email address, phone number, the amount and references — are kept for as long as tax law requires, the same as other payment records.
Encrypted database backups are kept for 14 days, so deleted data disappears from them within that time. Server logs are kept for up to 30 days.
How we protect it
Everything travels over HTTPS. Deriv tokens are encrypted, passwords are hashed, and only the operator can reach the database. Every administrative action is logged.
No system is perfectly secure. If a breach affects your data we will tell you, and the authorities, as the law requires.
Your rights
You can see most of your data in the app, correct your profile in Account Settings, and ask for a copy of the rest at zooxaiinfo@gmail.com.
You can delete your account from Profile → Delete account in the app. If you no longer have the app, write to zooxaiinfo@gmail.com from the email address on the account and we will delete it for you.
You can withdraw our access to your Deriv account at any time by unlinking it in the app, or by deleting the API token in your Deriv settings.
Complaints go first to Gunasekaran Vignesh at zooxaiinfo@gmail.com. We acknowledge within seven days. If you are not satisfied with our answer, you can complain to the Data Protection Board of India.
Children
ZOOX AI is not for anyone under 18. If we learn an account belongs to someone under 18, we delete it.
Changes
If we change this policy in a way that affects you, we will ask you to accept the new version the next time you open the app. The version is shown at the bottom.