Summary of Key Data Protection Standards

This Privacy Policy outlines how EquiTrek ("we", "our", or "us") collects, processes, and protects your information across our web application and simulated paper trading environment. We maintain a zero-compromise approach to user privacy, strictly enforcing data minimization principles under the General Data Protection Regulation (GDPR), California Consumer Privacy Act (CCPA/CPRA), and India's Digital Personal Data Protection Act (DPDPA).

Our core architectural philosophy is simple: we only store the bare minimum information necessary to run your personalized behavioral trading curriculum. We do not monetize personal data, we do not deploy invasive third-party ad trackers, and we never share your simulation logs with credit bureaus or commercial marketing brokers.

1. Information We Collect

We restrict our data intake to strictly necessary operational information:

Account Credentials: Verified email addresses and securely salted cryptographic password hashes provided during registration or waitlist onboarding.
Simulated Learning Metrics: Virtual paper trade executions, cognitive bias quiz answers, simulated portfolio hold times, and loss mitigation actions used solely by the AI Tutor to identify psychological behavioral traits.
Technical Diagnostic Telemetry: Anonymized browser signatures, device operating system versions, IP geolocation at the country level, and system response latencies required for security verification and DDoS mitigation.

Because EquiTrek is strictly an educational simulator, we never request, store, or process real brokerage account credentials, banking routing numbers, debit card details, credit scores, or government-issued identification numbers.

2. How We Use and Process Information

EquiTrek processes your information under legitimate educational interests and explicit contractual consent:

Delivering interactive curriculum modules and generating personalized Socratic behavioral trade audits.
Maintaining application performance, edge caching integrity, and safeguarding user sessions against unauthorized token hijacking.
Distributing important product announcements, beta release schedules, and critical security notices.
Conducting aggregated, anonymized behavioral finance research to refine curriculum effectiveness and prevent retail cognitive biases.

EquiTrek never sells, leases, or trades user contact details or learning logs to external brokers or commercial advertisers.

3. Data Security and Cryptographic Standards

We implement enterprise-grade security protocols across every layer of the EquiTrek stack:

Transport Security: All client-server transmissions require TLS 1.3 encryption with HTTP Strict Transport Security (HSTS) enforced across all subdomains.
Storage Encryption: Persistent records are encrypted at rest using AES-256 standard encryption keys rotated on automated operational cycles.
Defense-in-Depth: We deploy strict Content-Security-Policy (CSP) headers, X-Frame-Options DENY directives, and sanitized DOM rendering pipelines to prevent cross-site scripting (XSS) and iframe clickjacking attacks.

4. User Rights and Global Regulatory Compliance

Under international privacy frameworks including GDPR, CCPA/CPRA, and DPDPA, all users maintain comprehensive ownership over their digital footprint:

Right to Access: You may request an export of all personal data and simulation history linked to your email address.
Right to Rectification: You may update or correct inaccurate profile details at any time through our support team.
Right to Erasure: You may demand immediate, permanent deletion of your account, authentication tokens, and virtual trade records.
Right to Restrict Processing: You may opt out of non-essential diagnostic analytics without losing access to core educational simulations.

To exercise any of these statutory rights, submit a written verification request to our compliance team at privacy@equitrekapp.com. We acknowledge all inquiries within 48 business hours and resolve requests within 30 days.