1Introduction
Gravitas (“Gravitas”, the “Platform”, the “Services”) is a product of Alphaquest Technovations Private Limited (“Alphaquest”, the “Company”, “we”, “us”, or “our”), a company incorporated under the laws of India. For the personal data described in this Policy, the Company is the Data Fiduciary under the Digital Personal Data Protection Act, 2023 (the “Act”).
Registered office: WeWork Oberoi Commerz II, 20th Floor, CTS 95 HD-338, Goregaon East, Mumbai 400063, Maharashtra, India.
Grievance Officer: legal@graviti.exchange. The Grievance Officer answers questions about how we process personal data and handles requests and complaints (Article 13).
This Policy explains, in full, how we collect, use, share, keep and protect personal data, and what you can do about it. The short version, item by item, is the privacy notice at gravitas.trade/privacy/notice (notice of 2026-10-05), which you read and agree to before an account is created. Where the two differ, the notice you agreed to governs what we may do, and this Policy gives the detail.
2Definitions
Terms used but not defined in this Policy have the meanings given to them in the Gravitas Terms & Conditions and, where they are defined there, in the Act. In this Policy:
“Act” means the Digital Personal Data Protection Act, 2023, and “Rules” means the Digital Personal Data Protection Rules, 2025.
“Board” means the Data Protection Board of India established under the Act.
“Connected Account” means your own Bybit or Delta Exchange account, linked to the Services through API keys you issue or an authorisation you approve on that exchange.
“Data Processor” means a person who processes personal data on our behalf, under contract.
“Personal Data” means any data about an individual who is identifiable by or in relation to that data.
“Processing” means any operation performed on Personal Data, including collection, storage, use, sharing, restriction, erasure and destruction.
“User”, “you” or “your” means the individual the Personal Data is about, the Data Principal under the Act.
3Scope and Our Role
This Policy applies to Personal Data the Company processes in connection with the Services, whether you use them from India or elsewhere.
Bybit and Delta Exchange are separate companies. When you connect an account on either and trade, that exchange processes your data as its own Data Fiduciary under its own privacy policy and terms. Identity verification (know-your-customer) is performed by the exchange, not by us. Read the exchange’s privacy policy before linking a Connected Account.
The Company does not hold your funds. No Personal Data is processed by us for deposits, withdrawals or custody, because we do none of those.
4Personal Data We Process
Account data, from your Google sign-in
Your name, email address, profile photo (a link to it at Google) and Google account identifier, and whether Google has verified the email address.
The tokens Google issues when you sign in, which our sign-in system stores with your account. We do not receive your Google password.
Your exchange connection (Bybit, or Delta Exchange if you connect one)
The API key and secret you paste, or the tokens issued when you authorise Gravitas on the exchange, each stored encrypted (AES-256-GCM).
How the connection was made, the account identifier the exchange reports for it, which exchange you have chosen to trade on, and when it was linked.
Your activity on Gravitas
Every order we send for you: the contracts, sides and quantities, which tool it came from, and Bybit’s answer (order ids, fills, prices, status and errors), including orders Bybit rejected.
Take-profit and stop-loss settings you ask us to watch, and the state of each watch.
Copy-trading subscriptions (the strategy, the allocation and leverage you set, your acknowledgement of the margin required) and each round placed for you, with how it was sized and its result.
Competition entries, with a copy of your email address for contest communications, and the trading volume worked out from your orders.
Consent records
Which version of the privacy notice you agreed to and when, and your declaration that you are 18 or older; and each cookie choice you make, tied to your account if you are signed in and to a random identifier stored in your browser.
Security and technical data
Your sign-in sessions.
An access log of sign-ins, account creation, Bybit keys being saved and account deletion, each with the time and the IP address it came from.
Server logs, which can include IP addresses, the pages and API routes requested, and error details.
Messages
Messages you send through the Contact Us form or by email, including requests and complaints and the details of anyone you nominate, are kept in our mailboxes; they are not stored in the Gravitas database.
Answers you give in our feedback form are collected by Google Forms, outside your Gravitas account.
Cookies and similar technologies
Cookies needed for the Services to work, and, only if you allow them, analytics and advertising cookies. Article 12 lists them.
What we do not collect
Passwords, government identity documents, proof of address, biometric data, bank or card details, or any data about funds. Where know-your-customer checks apply, Bybit performs them.
5Why We Process It, and on What Basis
We process Personal Data only for lawful purposes, and only on one of the grounds the Act allows: your consent (section 6), or a legitimate use listed in section 7.
With your consent, given when you create your account: to create and secure your account and sign you in; to place, manage and close the trades you ask for on your Connected Account; to run the features you turn on, such as take-profit and stop-loss watches, copy trading and competitions; to show your history; to keep the security records described in Article 4 (e); and to email you about your account.
With your separate consent, which is off until you allow it in cookie settings: analytics (to see how the site is used) and advertising measurement (to see whether our advertising works). Refusing costs you nothing in the Services.
As legitimate uses under section 7: answering a message you send us, using the details you provided for that purpose (section 7(a)); and complying with a law, a judgment or order, or a lawful request from the State (sections 7(c) to 7(e)).
Copy trading sizes each round for you automatically, from the allocation and leverage you set. No other decision about you is made by automated processing.
No adverse use of order flow. We do not process order or trading data to take a market position against you, and we do not run a pooled account into which your orders are matched.
We never sell Personal Data.
6Children
The Services are only for adults. Before an account is created we ask you to declare that you are 18 or older, and we do not create an account without that declaration. We do not knowingly process the Personal Data of anyone under 18, and we do not track, monitor the behaviour of, or target advertising at children. If we learn that an account belongs to someone under 18, we close it and erase its data, subject to Article 9.
8Transfers Outside India
Some of the recipients in Article 7 process Personal Data outside India: Bybit, Google and Meta among them. The Act allows this except to a country or territory the Government of India restricts by notification (section 16), and we will stop any transfer the Government restricts, and follow any further requirements it sets under Rule 15.
9How Long We Keep It
While your account is open, we keep the data in Article 4 for as long as it serves the purposes in Article 5, unless you erase it sooner (Article 13).
When you delete your account, it is erased from the Services at once, with what the law requires us to keep:
Rule 8(3) of the Rules requires us to keep the personal data and logs of each processing for one year from the date of that processing. So on deletion we keep, apart from the Services, a copy of your account details and of the orders, copy-trading subscriptions and rounds, and competition entries processed in the preceding twelve months. They are used only for the purposes set out in the Seventh Schedule to the Rules (lawful requests from the State), and each is deleted automatically one year after the processing it records.
Your Bybit API key and secret, Bybit authorisation and sign-in sessions are never kept. They are deleted with the account.
Records of your consents are kept for one year after the account is deleted, as proof of what you agreed to.
The access log in Article 4 (e) is kept for one year (Rule 6(1)(e) of the Rules) and then deleted.
Cookie choices made while signed out are kept for up to two years: one year while the choice is in force, and one year after.
Sign-in sessions end after seven days without use; expired sessions are deleted daily.
Our database is backed up daily and each backup is deleted after seven days, so data erased from the Services can remain in a backup for about eight days.
Emails in our mailboxes are kept as long as needed to deal with the matter, and no longer than one year after it is closed, unless the law requires longer.
Analytics and advertising data held by Google and Meta, if you allowed those cookies, is kept according to the retention we configure with them and their own policies.
Where another law requires a record to be kept for longer, we keep that record, and only that record, for as long as that law requires.
10How We Protect It
We protect Personal Data with reasonable security safeguards (section 8(5) of the Act and Rule 6), including:
Encryption of Bybit API keys, secrets and authorisation tokens at rest (AES-256-GCM), and of all traffic to and from the Services (HTTPS).
Access control: production systems are reachable only by authorised staff.
Visibility: the access log in Article 4 (e), kept for one year so that unauthorised access can be detected, investigated and remedied.
Continuity: daily backups, kept for seven days.
Contracts requiring reasonable security safeguards from every Data Processor.
No system is perfectly secure. If a personal data breach affects you, Article 11 says what we will do.
11If There Is a Personal Data Breach
If we become aware of a personal data breach affecting you, we will tell you without delay, through your account email, in plain language: what happened, including its nature, extent and timing; the consequences likely for you; what we have done and are doing to reduce the risk; what you can do to protect yourself; and who you can contact. We will also report the breach to the Board without delay, and give the Board a detailed report within seventy-two hours of becoming aware of it, as Rule 7 of the Rules requires.
13Your Rights
Access (section 11): a summary of the Personal Data we hold about you and what we do with it, the identities of everyone we have shared it with and what was shared, and a copy.
Correction and erasure (section 12): have your data corrected, completed or updated, and erased by deleting your account from Settings or by asking us, subject to Article 9.
Withdraw consent (section 6(4)), as easily as you gave it: cookie consent from Cookie settings; your Bybit connection by revoking the key at Bybit or replacing it in Settings; and the consent your account rests on by deleting the account. Withdrawal does not affect processing done before it, and we stop processing, and have our Data Processors stop, within a reasonable time.
Grievance redressal (section 13): we answer every request and complaint within 30 days. If you are not satisfied, you may complain to the Data Protection Board of India once our process is complete (section 13(3)).
Nominate (section 14): name one or more people who may exercise these rights for you if you die or become unable to, by writing to the Grievance Officer with each nominee’s name, email address and relationship to you. We confirm a nominee’s identity, and the event, before acting.
How to make a request: write to the Grievance Officer at legal@graviti.exchange (details at gravitas.trade/privacy/grievance). To identify your account, write from, or give, the email address it signs in with. We may ask you to confirm your identity before acting, and we never ask for passwords, codes or API keys.
The Act also sets duties for you (section 15): to give authentic information, not to impersonate anyone, and not to file false or frivolous complaints.
14Consent Records and Accountability
We record every consent given and withdrawn (which notice, through which screen, and when), and keep the access log described in Article 4 (e), so that we can show how your data has been handled.
15Third-Party Services and Websites
The Services connect to Bybit and may link to other sites. This Policy does not cover their practices, which are governed by their own policies. Read Bybit’s privacy policy, and that of any other third party, before giving them information or linking your account.
16Changes to This Policy
We will update this Policy when our practices change, and show the date of the latest version at the top. If a change affects how we use your Personal Data, we will publish a new privacy notice and ask for your consent again before relying on it; until you agree, we will not process your data in the new way.
17Governing Law and Dispute Resolution
This Policy is governed by the laws of India. Subject to your right to complain to the Board, any dispute arising out of or in connection with it is subject to the exclusive jurisdiction of the courts in Mumbai, Maharashtra.
18Force Majeure
The Company shall not be liable for any failure to perform its obligations under this Policy if such failure results from any cause beyond the Company’s reasonable control, including mechanical, electronic, or communications failure or degradation.
19Limitation of Liability
To the maximum extent permitted by applicable law, the Company shall not be liable for any indirect, incidental, special, consequential or punitive damages, or any loss of profits, revenues, data, use or goodwill. Nothing in this Policy limits any obligation the Company has, or any right you have, under the Act, the Rules or any other law that cannot be limited by agreement.
20Severability
If any provision of this Policy is found unenforceable or invalid, that provision is limited or removed to the minimum extent necessary, and the rest of this Policy remains in force.
21Entire Agreement
This Policy, together with the Terms & Conditions, constitutes the entire agreement between you and the Company regarding the Processing of Personal Data and supersedes all prior or contemporaneous communications and proposals.
22Waiver
The failure of the Company to enforce any right or provision of this Policy will not be deemed a waiver of such right or provision.
23Language
This Policy and the privacy notice are written in English. If a translation is ever published and differs from the English, the English version governs.
Questions about this policy, or a request about your data, go to our Grievance Officer at legal@graviti.exchange.