Legal
Privacy Notice
Last updated: [DATE] · Controller: [COMPANY NAME], [ADDRESS] · Contact: [CONTACT EMAIL]
What we collect and why
- Account: email, country of residence, password (stored only as a one-way hash), two-step login secret (encrypted). To run your account and keep it secure.
- Exchange API key: stored sealed; the website cannot open it, only the order engine can. To place the orders of plans you arm.
- Plans, journal and activity: your plans, your reasons and reviews, orders sent and decisions taken. To run your plans and show you what happened.
- Security watch: the balances on your connected key at the engine's last reading, open orders it did not place, and the alarms it sent you. To warn you about use of your key that your plans did not cause. The balances are erased when you remove the key.
- Security data: IP address and time of log-in and sign-up attempts, kept for 2 days. To slow down password guessing.
- Activity log: the IP address of each log-in and password change, so you can spot a log-in that was not yours. It is removed after 90 days.
- Logged-in browsers: for each log-in, the time, IP address and browser name, and a random device cookie that marks your browser. To list where you are logged in, let you log a browser out, and email you about a log-in from a new device. Removed 90 days after the browser was last used.
- Recovery codes and anti-phishing phrase: your recovery codes, stored only as one-way hashes, and the phrase you chose for our emails, if any.
- Unconfirmed sign-ups: an account whose email address is never confirmed is deleted after 7 days.
- Emails we send you: each email waits in our database until it goes out. Its text is deleted once it is sent; the address, subject and time are removed after 30 days. To retry emails that did not go through.
Who processes it for us
- Hosting and database: [HOSTING PROVIDER, REGION].
- Email delivery: [EMAIL PROVIDER].
- Plan reader (only if you use it): the text you write is sent to [AI PROVIDER] to fill in the plan card.
- Bot check on sign-up and password reset (when it is switched on): Cloudflare Turnstile checks that the form is sent by a person.
- Your exchange (for example Binance) receives the orders of your plans under its own privacy policy.
We do not sell your data and do not use it for advertising.
How long we keep it
As long as your account exists. When you delete your account in Settings, your plans, journal, activity and stored keys are erased. [RETENTION FOR LEGAL/ACCOUNTING RECORDS, e.g. invoices, TO BE SET BY COUNSEL.]
Your rights
You can access, correct, export or delete your data, and object to or restrict its use, as the law where you live allows. In Settings you can download all your data as one file, change your email address and delete your account. Write to [CONTACT EMAIL]. You may also complain to your data protection authority.
International transfers
[DESCRIBE WHERE DATA IS STORED AND THE SAFEGUARDS FOR TRANSFERS. TO BE COMPLETED BY COUNSEL.]