Legal

Privacy Policy

This policy explains what information the platform collects, why, who can see it, and the choices you have.

Last updated: October 2026

This is a working draft supplied with the software. The operator must complete it with its legal entity name, contact details, hosting regions and lawful bases, and have it reviewed against the privacy laws that apply to its users.

1. Information we collect

  • Account data: name, email address and a salted hash of your password. We never store your password in plain text.
  • Verification data: the details and identity documents you submit for KYC.
  • Financial records: deposits, withdrawals, investments and ledger entries on your account.
  • Support messages: anything you send through the contact or recovery forms.
  • Preferences: display currency and language.

2. How we use it

We use your data to operate your account, verify identity, process and audit financial activity, respond to support requests, prevent fraud and meet legal obligations. We do not sell personal data.

3. KYC documents

Documents are stored in private storage and are never reachable through a public URL. Only you and authorised reviewers can open them, and each review decision is recorded in the audit log.

4. Sessions and cookies

We use a single signed, HTTP-only session cookie to keep you signed in. It is cleared when you sign out. We do not use it for advertising.

5. Who can access your data

Access is limited by role. You see your own records. Authorised administrators can see account details needed to review verification, deposits and withdrawals. Infrastructure providers process data on our behalf to host the service.

We may disclose information where required by law or to protect against fraud.

6. Retention

Financial records and the audit log may be retained for the period required by applicable law, even after account closure. Identity documents are kept only as long as needed for verification and legal obligations, then deleted. The operator must publish the exact periods for its jurisdictions.

7. Your rights and account deletion

Depending on where you live you may be able to access, correct, export or delete your data, or object to certain processing. To make a request or to ask for account deletion, use the contact page. We may need to verify your identity first, and some records must be kept by law.

8. Security

Authorisation is enforced on our servers for every request, private documents are access-controlled, and administrative actions are audited. No system is perfectly secure, so please use a strong, unique password.