Your data, handled with care.

01Who we are & scope

This Privacy Policy is issued by SQARME PRIVATE LIMITED ("SQARME", "we", "us", "our"), a company incorporated in India with its registered office at 44 Backary Portion, 2nd Floor, Regal Building, Connaught Place, New Delhi – 110001, India (CIN U62013DL2025PTC460672; GSTIN 07ABSCS2589N1Z9). We operate the SQARME CMD service available at cmd.sqarme.com, the marketing site at sqarme.com, and the trial at trial.sqarme.com.

For the personal data we collect about you, our merchant customer (your account, billing and login data), SQARME acts as the data fiduciary under the Digital Personal Data Protection Act, 2023 ("DPDP Act") and as the body corporate responsible under the Information Technology Act, 2000 and the SPDI Rules, 2011.

This policy applies to your use of SQARME CMD as a merchant. It does not govern Binance, Telegram, your bank, UPI apps or any other third party you use alongside our software — each of those is governed by its own privacy policy. For questions, write to grievance@sqarme.com.

02Data we collect

We collect only what is needed to provision, run and support your isolated engine. The list below is specific and reflects exactly how the system stores data.

Account & registration data

• Email address and username you provide at sign-up.
• Password — never stored in readable form. We keep only a salted one-way hash (PBKDF2-HMAC-SHA256, 600,000 iterations) plus the salt. We cannot recover your password.
• Nickname / display name used inside the dashboard.

Binance credentials

• Binance API key — the control plane stores only a SHA-256 hash of your API key (used to detect duplicate or repeat sign-ups), not the key itself in usable form.
• Binance API secret — your secret is never stored by us. At sign-up it is used in memory only to validate your keys live against Binance, then discarded. On your own engine, your API key and secret are encrypted into a credentials file using a key derived from your master password, and are decrypted only into memory when you log in. The secret is never written to the operating-system environment. See Section 5.

Your Binance public profile / KYC

• The KYC name, nickname and KYC status returned by Binance's account-detail API for your account. This is stored encrypted (Fernet) as an admin-only record, used to verify you during the manual approval step.

Payment & billing data

• UPI payment status and amount, your plan and any dues. Activation is paid by UPI QR. We do not collect or store any card data and we do not run an in-app card processor.

Telegram & operational data

• Your Telegram chat ID and a one-time bind code, used for approvals and alerts; engine port/directory, status, timestamps, and login-failure counters used for security.

Counterparty data processed by your engine

When your engine processes your Binance orders and chats, it handles data about your trading counterparties: their name (kept in clear for matching and display) and, where present, mobile number, email and PAN, plus per-order chat message content. The mobile, email and PAN fields and the chat content are encrypted at rest. See Section 4 for how responsibility is shared.

Other payment-instrument identifiers captured from your Binance order records — such as a counterparty's or payer's bank-account number, IFSC, UPI ID and account-holder name — and the payment accounts you configure are stored within your own isolated engine and may be held there in clear (not within the encrypted personal-data set above), accessible only on your engine.

Where you enable it, your engine reads the payment receipts you receive, extracts fields (amount, date/time, UTR, status) by OCR, and — to help answer a counterparty's request for proof of payment — matches the payee name on a receipt against the names on the order and the counterparty's Binance KYC name, and may forward the receipt image and extracted fields to that counterparty's Binance chat. This happens only at your direction and on your configuration.

To help protect you from fraud, your engine builds heuristic per-counterparty “trust scores” and an automatic block-list from your own order and dispute history, used as decision-support (for example whether to auto-release, warn or block). These are signals only — not official KYC/AML clearance (see our AML / KYC Policy). Because this data concerns your counterparties, you are the data fiduciary for it: you control it and can correct or clear it.

Free trial

If you use the one-day free trial, we process limited data to prevent abuse and repeat claims: the public IP address(es) you access it from, the Binance user number and KYC name derived from your trial activity, cleared-order references, and a fingerprint of the API key used. We rely on our legitimate interest in preventing fraud and abuse, and keep this only as long as needed for that purpose.

Technical data

• Cookies and session tokens strictly necessary to log you in and route you to your isolated engine — detailed in our Cookie Policy.
• Server logs. Before anything is written to a log file, API secrets and tokens are redacted and personal data (mobile, email, PAN) is masked.

03How we use data

We process personal data for the following purposes, each tied to a lawful basis under the DPDP Act (your consent and the performance of our service to you):

• Provide and run your engine — provision your isolated trading engine, validate your Binance keys, authenticate your logins and route you to your engine.
• Process your orders — display live orders and balances, and carry out the actions you take (mark-paid, release, cancel) and any automation features on your plan.
• Support — respond to your questions and troubleshoot issues via email, WhatsApp and Telegram.
• Security & integrity — detect duplicate sign-ups, monitor login failures, prevent abuse and protect the service.
• Billing — confirm UPI activation payments, manage your plan and dues, and issue GST tax invoices.
• Legal compliance — meet our obligations under applicable Indian law and respond to lawful requests from authorities.

We do not use your personal data for advertising and we do not sell it.

04Counterparty data & your responsibility

Your engine necessarily processes data about the people you trade with on Binance P2P — their name and, where Binance provides it, their mobile number, email, PAN and chat messages. This data originates from your trades on your own Binance account.

For this counterparty data, you are the principal / data fiduciary and SQARME processes it on your behalf (as a data processor) purely to operate your engine. You decide what to do with your counterparties' data, how long you keep it within your engine, and how you use it — including any obligations you have to those individuals under the DPDP Act and other applicable law.

You are responsible for handling counterparty data lawfully, including obtaining any notices or consents required from your counterparties and responding to their requests. SQARME provides encryption-at-rest and isolation for this data, but does not independently use counterparty data except as needed to run your engine and provide support.

05Security

We apply reasonable security practices designed for a non-custodial, single-tenant architecture. In plain terms:

• Per-merchant isolation. Each merchant runs as a separate operating-system process with its own data directory and its own encryption keys. There are no shared encryption keys across merchants.
• Encryption at rest. Sensitive records are encrypted using Fernet. Your Binance API key and secret are encrypted on your own engine with a key derived from your master password using PBKDF2-HMAC-SHA256 at 600,000 iterations; the same key-stretching protects your account password hash.
• Non-custodial secret. Your Binance API secret is never persisted by the control plane, is decrypted only into memory when you log in, and is never written to the OS environment.
• Encrypted PII. Counterparty mobile/email/PAN and per-order chat content are encrypted at rest with your engine's per-merchant key. This does not cover every field: other payment-instrument identifiers (such as a counterparty's bank-account number, IFSC and UPI ID) and the payment accounts you configure may be held in clear within your own isolated engine — see Section 2.
• Redacted logs. Secrets and tokens are redacted and personal identifiers are masked before logging.
• Access controls. Your engine is gated behind your master password and TOTP two-factor authentication.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. We do not claim any particular certification or standard. You are responsible for keeping your master password, fund password, TOTP device and Telegram account safe.

06Sharing & sub-processors

We do not sell personal data. We share data only with the limited set of service providers needed to run SQARME CMD, and with authorities where the law requires it.

We may disclose personal data to courts, regulators or law-enforcement authorities where we are legally required to do so, or to establish, exercise or defend legal claims. Each sub-processor handles data under its own privacy policy and security measures.

07Cross-border processing

Our hosting is located in India (Mumbai region). However, certain sub-processors — in particular Google (Cloud Vision and Google Fonts), Cloudflare (cdnjs) and QRCode Monkey (an EU / Germany-based service) — are global providers and may process some data (such as request metadata, IP address or user-agent) outside India under their own safeguards and contractual terms. Where the DPDP Act restricts transfers to particular countries, we will comply with those restrictions as and when they are notified.

08Data retention

We retain personal data for as long as your account is active and for a reasonable period afterwards, then delete or anonymize it, except where a longer period is required to meet a legal, tax or regulatory obligation (for example, GST and accounting records) or to resolve disputes and enforce our agreements.

• Account, login and billing data — kept while your account is active and for up to 180 days after closure, then deleted or anonymized (tax and accounting records such as GST invoices are kept for the longer period the law requires).
• Counterparty data on your engine — retained within your engine while your account is active; you control its lifecycle (see Section 4).
• Backups — rotate on a recurring schedule and are overwritten over time.
• Payment receipt images — not retained; only extracted OCR fields are kept.

09Your rights

Subject to the DPDP Act and applicable law, you have the right to:

• Access a summary of the personal data we process about you and the processing activities involved.
• Correction and completion of inaccurate or incomplete personal data.
• Erasure of your personal data where it is no longer necessary for the purpose it was collected, unless we are required to retain it by law.
• Grievance redressal — a readily available means to raise complaints (see Section 13).
• Nominate another individual to exercise your rights in the event of your death or incapacity.
• Withdraw consent where processing is based on consent; this may mean we can no longer provide parts of the service.

To exercise any of these rights, write to grievance@sqarme.com from your registered email. We will verify your identity and respond within the timelines required under the DPDP Act and the IT Act. Some requests may be limited where they affect another person's data (for example, your counterparties' data) or where we must retain records by law.

10Cookies

SQARME CMD uses only first-party, strictly-necessary and functional cookies (such as your login session and the signed token that routes you to your engine) and stores some interface preferences in your browser's local storage. We use no analytics, advertising or tracking cookies. For the full list — names, purposes and lifetimes — see our Cookie Policy.

11Children

SQARME CMD is a business tool intended for adult merchants and is not directed to anyone under 18 years of age. We do not knowingly collect personal data from children. If you believe a child has provided us personal data, contact grievance@sqarme.com and we will take appropriate steps to delete it.

12Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our service, technology or the law. When we do, we will revise the "Last updated" date shown at the top of this page. Material changes will be communicated through the service or by email where appropriate. The version in force is the one published at /privacy as of the stated effective date (16 July 2026).

13Grievance Officer & contact

If you have a question, concern or complaint about how we handle your personal data, please contact:

The Grievance Officer

SQARME PRIVATE LIMITED

Email

grievance@sqarme.com

Registered office

44 Backary Portion, 2nd Floor, Regal Building, Connaught Place, New Delhi – 110001, India

Phone / WhatsApp

+91 99903 22528 · Mon–Fri, 10 AM – 6 PM IST

We address grievances in accordance with the timelines under the DPDP Act and the IT Act, 2000 and its rules. If you are not satisfied with our response, you may have the right to approach the Data Protection Board of India once it is operational.

This Privacy Policy is governed by the laws of India. Subject to applicable law, the courts at New Delhi have exclusive jurisdiction. Read alongside our Terms of Service, Cookie Policy, AML / KYC Policy and Risk Disclaimer.