Privacy policy
Effective {{EFFECTIVE_DATE}} · Funding Arbitrage Scanner is operated by {{COMPANY_NAME}}, {{REGISTERED_ADDRESS}}, {{JURISDICTION}}.
1. Summary
- We keep the personal data needed to run your account, bill you and send the messages you ask for, and little else.
- Your identity (name, email, sign-in) lives with our identity provider and in our account system. The scanner that serves market data knows you only by a pseudonymous key: no name, no email.
- We do not sell personal data and we do not use advertising cookies.
The controller of your personal data is {{COMPANY_NAME}}, {{REGISTERED_ADDRESS}}, {{JURISDICTION}}. Contact: {{CONTACT_EMAIL}}.
2. What we hold, where, why and for how long
| Data | Where it is kept | Why | How long |
|---|---|---|---|
| Identity: name, email address, sign-in methods and sessions | Our identity provider (Clerk), and a copy of your user id, email, name and account status in our account system (the control plane) | Signing you in; recognizing your account | While your account exists |
| Plan, subscription, organization and team membership, roles | Control plane | Deciding what your account may see and do | While your account exists |
| Payments ledger: invoices, credit balance, deposit addresses, amounts, networks, transaction hashes | Control plane; the transactions themselves are on public blockchains | Billing, accounting, fraud prevention and disputes | As long as accounting and tax law in {{JURISDICTION}} requires. On-chain records are public and permanent; we cannot erase them |
| Notification channels: verified email, linked Telegram chat and username, your message preferences | Control plane only | Sending billing notices and the alerts you set up | Until you unlink the channel, change it, or close your account |
| Notification log: the messages we sent you and whether delivery worked | Control plane | Delivery, retries, support questions and billing disputes | 90 days after creation, then deleted automatically (messages still waiting to be delivered are kept until sent) |
| Product data: favourite symbols, alert rules, simulated (paper) positions | Scanner database, keyed only by a pseudonymous subject key derived from your sign-in id; it holds no name or contact details | Providing those features | Favourites and alert rules until you remove them or close your account; paper positions until you delete them |
| API keys and API usage counts | Control plane. A key is shown to you once and stored only as a keyed hash (HMAC); we cannot read it back | Authenticating API calls, plan limits and usage billing | Until you revoke the key; usage counts as long as billing records |
| Audit log: changes to your account by you or our staff, staff support sessions, approvals | Control plane, append-only | Security, accountability and investigating incidents | {{AUDIT_LOG_RETENTION}} |
| Support conversations | Control plane | Answering you | While your account exists, or as needed to resolve the matter |
| Technical data: IP address, request ids, browser type, error logs | Our servers and hosting provider | Security, rate limiting, location restrictions and fixing faults | A short period for operational logs |
Counsel to confirm: legal bases for each purpose (contract, legal obligation, legitimate interest), the operational log retention period, and the audit log retention period.
Market data (prices, funding rates, order books) is not personal data.
3. Who processes data for us
- Clerk: identity, sign-in and sessions.
- Email provider ({{EMAIL_PROVIDER}}): delivering emails to your verified address.
- Telegram: only if you link a chat; it receives the alert messages you asked for and your chat id is stored with us.
- Blockchain RPC providers ({{BLOCKCHAIN_RPC_PROVIDERS}}): we query them for deposits to your invoice addresses. They see the addresses and transactions we ask about, not your name.
- Hosting ({{HOSTING_PROVIDER}}): runs our servers and databases.
Trading venues send us public market data; we do not share your data with them.
Counsel to confirm: international transfers and the safeguards used for each processor outside {{JURISDICTION}}.
4. Staff access
Access by our staff is limited by role and recorded in the audit log. For support, staff can open a read-only view of what your account sees for up to 15 minutes; they cannot change settings or pay in that view, and each session is audited.
5. Security
Data is encrypted in transit. API keys are stored as keyed hashes, secrets are never logged, and sensitive actions by staff require a second person's approval. No system is perfectly secure; we will tell you without undue delay if a breach affects your data.
6. Your choices and rights
- Change your notification preferences or unlink Telegram on the Notifications page; remove favourites, alerts and paper positions in the app.
- Depending on the law that applies to you, you may ask to access, correct, export or delete your personal data, or object to or restrict its use. Write to {{CONTACT_EMAIL}}.
- You may complain to the data protection authority in {{JURISDICTION}} or where you live.
7. Children
The service is not for anyone under 18. We do not knowingly collect their data.
8. Changes
We will post changes here with a new effective date and tell account holders about material changes by email.
See also the cookie notice.