Log in Start free

Privacy policy

Last updated: 27 September 2026

This policy explains how Mitesh Bhavsar ("BCEIE", "we", "us"), MB Internet Pvt Ltd, Ahmedabad, Gujarat, handles your personal data when you use bceie.mbtoolz.com, the BCEIE app and our alerts. We are the Data Fiduciary for this data under the Digital Personal Data Protection Act, 2023 ("DPDP Act"), and we also follow the Information Technology Act, 2000 and its rules.

In short: we collect only what we need to run BCEIE, we never sell your data, and you can ask us to see, correct or delete it at any time.

1. What we collect

You give us:

  • Account: your email address, and optionally a display name.
  • Your stocks: watchlists and holdings you add or import — symbol, quantity and, if you enter it, average price.
  • Alerts: your alert rules, quiet hours and notification preferences; if you link Telegram, your Telegram chat ID; if you allow browser notifications, the notification address your browser gives us.
  • Billing (paid plans only): your plan and payment status, Razorpay reference IDs, invoices, and optional GST details (legal name, GSTIN, state and address).
  • Messages: anything you send us, such as support requests or complaints.

Collected automatically:

  • Sign-in and security: one-time sign-in codes (stored only in hashed form and expiring after 10 minutes), session records, IP address, browser type and request logs, used to keep your account and the Service secure.
  • Cookies: one essential cookie that keeps you signed in. We do not use advertising or third-party tracking cookies.
  • Usage statistics: anonymous page and event counts from our own self-hosted analytics (Umami), which uses no cookies and does not follow you across other websites.

What we never store:

  • CAS statements (CDSL/NSDL PDFs) and their passwords are read in memory to show you a preview and then discarded — the file and password are not saved.
  • Broker access tokens (for example Dhan) are used once to fetch your holdings and are not stored.
  • Card and UPI details are entered on Razorpay's secure page. We never see or store them.

2. Why we use it

  • to create and secure your account and sign you in;
  • to show your feed, watchlists, holdings, calendar and Risk Radar, and to send the alerts and digests you ask for;
  • to process payments and issue GST invoices (paid plans only);
  • to answer support requests and complaints;
  • to prevent fraud and abuse, keep the Service running and fix problems;
  • to improve BCEIE using anonymous usage statistics;
  • to meet legal obligations, such as tax and accounting rules.

We process your data on the basis of the consent you give when you sign up and use each feature, and for the legitimate uses allowed by Section 7 of the DPDP Act (for example, meeting legal obligations). We send service emails (sign-in codes, alerts you set up, billing and important notices). We will not send you marketing messages without your consent, and you can opt out of any optional email at any time.

3. Who we share it with

We do not sell or rent your personal data. We share it only with service providers who process it for us, under contract, and only as needed:

  • Hosting: our servers are hosted by a cloud provider in the Netherlands (EU).
  • Email: Titan (our email provider) delivers sign-in codes, alerts and notices.
  • Telegram: delivers alerts to the chat you link. Telegram's own privacy policy applies to your Telegram account.
  • Browser notification services (for example Google, Mozilla or Apple, depending on your browser) deliver push notifications you enable.
  • Razorpay: processes payments for paid plans.

We may also disclose data when required by law, a court order or a government authority, or to protect the rights and safety of our users or the Service. If BCEIE is sold or merged, your data may transfer to the new owner under this policy, and we will tell you first.

Filings are analysed with automated tools, including AI models. We do not send your personal data, watchlists or holdings to AI providers — they only see public exchange filings.

4. Where your data is stored

Your data is stored on servers outside India (currently in the Netherlands), and some providers above may process it in other countries. We transfer data abroad only as the DPDP Act allows, and we protect it in the same way wherever it is stored.

5. How long we keep it

  • Account, stocks and alert data: while your account is active. When you delete your account, we delete this data within 30 days.
  • Invoices and payment records: for as long as tax and accounting laws require (currently at least 8 years), even after you delete your account.
  • Security logs: up to 90 days.
  • Backups: deleted data may remain in our backups, which are kept on our own servers with restricted access, for up to 30 days until they are overwritten.
  • Inactive accounts: if you have not signed in for 3 years, we may delete your account after warning you by email.

6. Your rights

Under the DPDP Act you have the right to:

  • get a summary of the personal data we hold about you and how we use it;
  • correct or update inaccurate or incomplete data;
  • have your data erased (account deletion);
  • withdraw consent at any time (this does not affect processing already done, and some features may stop working);
  • nominate another person to exercise your rights if you die or become incapacitated;
  • have your complaints addressed by our Grievance Officer.

To use any of these rights, email support@bceie.com from the address linked to your account. We may ask you to confirm your identity. We will respond within 30 days. You can also unlink Telegram, turn off notifications and remove holdings yourself in the app at any time.

If you are not satisfied with our response, you may complain to the Data Protection Board of India.

7. Security

We use encryption in transit (HTTPS), hashed sign-in codes, secure session cookies, access controls, rate limiting, monitoring and regular backups. No system is perfectly secure; if a personal data breach happens, we will inform you and the Data Protection Board as the law requires.

8. Children

BCEIE is for people aged 18 and over. We do not knowingly collect data from children. If you believe a child has created an account, contact us and we will delete it.

9. Changes to this policy

We may update this policy. For material changes we will notify you by email or in the app before they take effect. The date at the top shows when it was last updated.

10. Contact

Grievance Officer: Mitesh Bhavsar — support@bceie.com. See Grievance officer for details and timelines.