Last updated: 22 June 2026
1. Introduction
Markup Club ("Markup Club", "we", "us", "our") is a mobile application operated by a SEBI-registered Research Analyst. We provide stock market research, model portfolio subscriptions, and the ability to execute the Research Analyst's recommendations through the broker account that you connect to the app.
This Privacy Policy explains what personal information we collect, why we collect it, how we use and share it, and the rights you have over it. By using Markup Club, you agree to the practices described in this Policy.
2. Who is responsible for your data
Markup Club is the data controller for the personal information you provide to us through the app. For any privacy-related queries, please write to markupinvest@gmail.com.
3. Information we collect
3.1 Information you give us
- Contact information — your name, email address, and phone number when you create an account.
- Authentication credentials — the password you set, or your Google or Apple sign-in identifier.
- Broker connection details — the broker you select and any API keys or OAuth tokens needed to connect to your broker account. Credentials are encrypted in transit and at rest and are never stored in plaintext on our servers.
- Payment information — subscription payments are processed by Razorpay and Cashfree. Markup Club does not store your card number, UPI handle, or bank account details. We receive only a transaction reference and the subscription status.
- Support correspondence — any messages, screenshots, or attachments you send to our support team.
3.2 Information collected from your broker
- Holdings and positions — once you authorize a broker connection, we read your current holdings, positions, and orders so that we can show your portfolio, calculate live P&L, and compute the trades required to execute a recommendation.
- Order status — when you place a trade through Markup Club, we receive the order acknowledgment, fill status, and execution price from the broker so we can show order progress.
- Funds available — we read your available cash and margin so we can show whether a recommended trade is fundable before you place it.
We do not initiate any trade without your explicit confirmation. We never withdraw funds from your broker account. Securities and money remain in your broker account at all times.
3.3 Information collected automatically
- Device and usage data — device model, operating system version, app version, anonymous device identifier, IP address (for security and abuse detection), and product interaction events (which screens you visit, which buttons you tap).
- Diagnostics — crash reports and performance metrics collected via Firebase Crashlytics so that we can find and fix bugs.
- Approximate location — collected only when required by your broker for KYC or regulatory compliance during trading sessions. You can decline this in your iOS or Android settings; some brokers may then refuse trades.
3.4 Information we do NOT collect
- Your broker password or PIN.
- Your full card number, CVV, UPI PIN, or net-banking password.
- Aadhaar number, PAN, or KYC documents. These are submitted directly to your broker and never pass through Markup Club's servers.
- Contacts, SMS, call logs, or photo library content (except photos you explicitly attach to a support email).
- Microphone audio, camera video, or HealthKit data.
4. How we use your information
| Purpose |
Information used |
Legal basis |
| Create and manage your account |
Contact info, authentication credentials |
Contract performance |
| Connect your broker and execute recommended trades |
Broker credentials, holdings, funds, order status |
Contract performance |
| Show portfolio, P&L, and recommendation status |
Holdings, positions, order history |
Contract performance |
| Process subscription payments |
Payment reference, subscription status |
Contract performance |
| Send service notifications and recommendation alerts |
Contact info, device push token |
Contract performance |
| Improve the app, fix bugs, prevent abuse |
Device data, crash reports, usage events |
Legitimate interest |
| Comply with SEBI Research Analyst regulations, AML, and other applicable laws |
Account records, trade audit logs |
Legal obligation |
| Respond to your support queries |
Support correspondence, account context |
Contract performance |
5. Who we share your information with
We do not sell your personal information. We share data only with the parties listed below, only to the extent necessary for the purposes described in Section 4.
- Your broker — trade orders, holdings queries, and the OAuth or API credentials you have provided. The broker handles the order on its own platform under its own privacy policy.
- Payment processors — Razorpay and Cashfree, for processing subscription payments. They are PCI-DSS compliant and operate under their own privacy policies.
- Cloud infrastructure providers — we host backend services on industry-standard cloud platforms with bank-grade security controls.
- Analytics and diagnostics — Firebase (Crashlytics, Messaging) for crash reports and push notifications. No personal information is sold to advertisers.
- Regulators and law enforcement — when required by a valid legal order from SEBI, RBI, the Income Tax Department, a court, or any other competent authority.
- Professional advisors — auditors, lawyers, and accountants, under strict confidentiality obligations.
We do not share your data with third-party advertising networks, data brokers, or marketing aggregators.
6. How we secure your information
- All data in transit is encrypted with TLS 1.3.
- Broker credentials, OAuth tokens, and sensitive personal data are encrypted at rest with AES-256.
- Passwords are stored as bcrypt or scrypt hashes — never in plaintext.
- Access to production systems is restricted to authorized personnel and protected by multi-factor authentication.
- We monitor systems for unauthorized access and conduct periodic security reviews.
No internet-facing service can guarantee absolute security. If we become aware of a personal-data breach, we will notify affected users and the relevant regulators within the timelines required by applicable law.
7. How long we retain your information
- Account information — for as long as your account is active, plus the retention period required by SEBI's Research Analyst record-keeping rules (currently five years) after account closure.
- Trade audit logs — retained for the period mandated by SEBI and applicable tax laws.
- Support correspondence — retained for up to three years for service-improvement and dispute-resolution purposes.
- Crash and diagnostic data — retained for up to 90 days unless aggregated into non-identifiable metrics.
8. Your rights
Subject to applicable law, you have the following rights:
- Access — request a copy of the personal information we hold about you.
- Correction — ask us to fix inaccurate or incomplete information.
- Deletion — ask us to delete your account and the personal information we hold. We will honor this request subject to legal obligations that require us to retain certain records (e.g. SEBI record-keeping). See our account deletion page for the dedicated request flow.
- Withdrawal of consent — revoke a broker connection or disable push notifications at any time from within the app.
- Grievance redressal — if you believe we have not handled your data correctly, write to our Grievance Officer at markupinvest@gmail.com. We will respond within 15 working days as required by Indian IT Rules.
To exercise any of these rights, email markupinvest@gmail.com from the address registered with your account. We may ask for additional verification to confirm your identity before acting on the request.
9. Children's privacy
Markup Club is not intended for users under the age of 18. Indian securities regulations require traders and investors to be at least 18 years old, and a demat account cannot be opened by a minor without a guardian. We do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us information, please contact us and we will delete it.
10. Cookies and tracking
The Markup Club mobile app does not use website cookies. The companion website (research.markup.club) uses only essential cookies necessary for the site to function. We do not use advertising cookies, cross-site trackers, or third-party marketing pixels.
11. International transfers
Markup Club operates primarily in India and stores personal data on infrastructure located in India. Some sub-processors (for example, Firebase) may process limited diagnostic data on servers outside India. Where this happens, we ensure that the transfer is covered by appropriate safeguards as required by Indian law.
12. Changes to this Policy
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. Material changes will be highlighted in the app and the updated Policy will be posted on this page with a new "Last updated" date. Continued use of Markup Club after the change takes effect indicates acceptance of the revised Policy.
13. Contact us
For any question about this Policy or about how we handle your personal information, write to us at: