Privacy Policy

1. Information We Collect

1.1 Information You Provide

1.2 Information Collected Automatically

1.3 Information We Do NOT Collect

We run no analytics: the Platform does not record pages visited, features used or session duration, and loads no analytics or tracking scripts (see the Cookie Policy). We do not collect: your real name or legal identity (unless voluntarily provided), government-issued identification documents, bank account or credit card details (payments are processed by third-party processors), cryptocurrency wallet addresses (other than for subscription payments, which are processed externally), or the contents of your trades on Exchanges (the Platform transmits orders but does not log trade details long-term).

2. How We Use Your Information

We use the collected information for the following purposes:

• Service Delivery: To provide, maintain, and improve the Platform's functionality, including data display and trade automation.
• Account Management: To create and manage your account, authenticate your identity, and process your subscription.
• API Key Usage: To connect to your Exchange accounts and execute trades on your behalf, as instructed by you through the Platform.
• Security & Fraud Prevention: To detect and prevent unauthorized access, abuse, or violations of our Terms of Service, including geo-restriction enforcement.
• Communication: To send you service-related notices, subscription confirmations, security alerts, and support responses.
• Operation & Troubleshooting: To diagnose errors and failed requests from application logs. We do not analyse how individual users use the Platform.
• Legal Compliance: To comply with applicable laws, regulations, legal processes, or enforceable governmental requests.

3. How We Store and Protect Your Information

3.1 API Key Security

Exchange API keys are encrypted at rest with AES-256-GCM. The encryption key is kept outside the database, in the server's environment. Keys are decrypted only in memory, by the automated components that read balances and place orders on your behalf. No staff tool shows a decrypted key: the administration panel shows at most a masked key identifier (first and last four characters) and a fingerprint of the secret, so that support can confirm which key is saved without seeing it. We collect keys only for venues where trading is enabled; keys for venues without enabled trading are not accepted.

3.2 Password Security

Account passwords are hashed using industry-standard one-way hashing algorithms (bcrypt or equivalent). The Company does not store passwords in plaintext and cannot retrieve your password. Password recovery is handled through secure reset mechanisms.

3.3 Infrastructure Security

The Platform is hosted on secured cloud infrastructure with encryption in transit (TLS 1.2+), firewalls, access controls, and regular security updates. While we implement commercially reasonable security measures, no system is completely secure, and we cannot guarantee absolute protection against all threats.

3.4 Data Location

Your data is processed and stored on servers located in the European Union. By using the Platform, you consent to the transfer and processing of your data in this location.

4. Sharing and Disclosure of Information

We do not sell, rent, or trade your personal information. We may share information in the following limited circumstances:

4.1 Third-Party Service Providers

We may share limited data with trusted service providers who assist us in operating the Platform, such as: cloud hosting providers and email delivery services. These providers are contractually obligated to use your data only for the purposes of providing their services to us and to maintain appropriate confidentiality and security measures.

4.2 Exchange API Connections

When you connect your Exchange API keys, the Platform communicates with the respective Exchange's API on your behalf. The data transmitted (orders, account queries) is subject to the Exchange's own privacy policy. The Company does not share your API keys with any party other than the Exchange for which they were created.

4.3 Legal Requirements

We may disclose your information if required to do so by law, regulation, legal process, or governmental request, or if we believe in good faith that disclosure is necessary to: comply with a legal obligation, protect the rights, property, or safety of the Company, its users, or the public, prevent fraud or other illegal activity, or respond to a lawful request by public authorities.

4.4 Business Transfers

In the event of a merger, acquisition, reorganization, or sale of assets, your information may be transferred as part of the transaction. We will notify you via email or prominent notice on the Platform before your information becomes subject to a different privacy policy.

5. Data Retention

We retain your information while your account exists. When you delete your account (Settings → Account → Danger Zone), the following happens:

• Grace period: you have fourteen (14) days to cancel. After that the account is erased automatically within the next hour. If a position, an unresolved leg or a referral payout is still open at that moment, erasure waits until it is closed — deleting your exchange keys would otherwise leave it unmanaged on the exchange. A deletion request is not accepted while anything is open.
• Erased: e-mail, password hash, two-factor secret, Telegram link, registration IP, device fingerprint, referral code, exchange API keys, trading settings, sessions, support conversations, saved payout addresses and failed sign-in records.
• Kept without anything that identifies you: payment records (plan, period, amount, dates, status) and referral commission and payout records, as required for accounting; trade history, for aggregate statistics; the count and type of account events, without IP address or details. These rows stay attached to an anonymous placeholder account so that the accounts still add up.
• API Keys: deleted from the live database immediately when you remove them or when the account is erased.
• Backups: the database is copied every hour and copies are kept for up to three hundred sixty-five (365) days; erasure does not rewrite existing copies. If a copy is ever restored, every account erased after that copy was made is erased again automatically before the Platform starts using it — for this we keep a list of erased account numbers and dates, which contains no other data. Exchange keys inside copies remain encrypted.
• Server Logs: application logs record masked e-mail addresses (for example j***@gmail.com) and IP addresses; daily logs are kept for ten (10) days, error logs are overwritten as they rotate.
• Legal Compliance Data: retained as required by applicable law (which may exceed the periods above).

6. Your Rights

Depending on your jurisdiction, you may have certain rights regarding your personal data. We endeavor to honor the following requests from all Users, regardless of location:

• Access & Portability: Download a copy of all personal data we hold about you at any time, as a ZIP of machine-readable JSON files: Settings → Account → Privacy & your data → Download my data.
• Correction: You may request correction of inaccurate or incomplete personal data.
• Deletion: You may request deletion of your personal data (subject to legal retention requirements).
• API Key Deletion: You may delete your Exchange API keys from the Platform at any time through the settings interface.
• Account Deletion: Delete your account yourself at any time: Settings → Account → Danger Zone → Request Account Deletion (fourteen-day cancel window; see Section 5).
• Objection / Restriction: You may object to or request restriction of certain data processing activities.

For any other request, contact us at support@funding-arb.com. We will respond within thirty (30) days.

7. Children's Privacy

The Platform is not intended for use by individuals under the age of eighteen (18). We do not knowingly collect personal information from minors. If we become aware that we have inadvertently collected data from a minor, we will take prompt steps to delete such data.

8. International Data Transfers

Your information may be transferred to and processed in jurisdictions other than your own. These jurisdictions may have different data protection laws. By using the Platform, you consent to such transfers. We implement appropriate safeguards (such as encryption and access controls) to ensure your data remains protected in accordance with this Privacy Policy regardless of where it is processed.

9. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. We will notify you of material changes by posting the updated policy on the Platform with a revised "Last Updated" date and, where appropriate, by sending an email notification. Your continued use of the Platform after such changes constitutes acceptance of the updated Privacy Policy.

10. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:

FundingArb
Email: support@funding-arb.com
Registered Address: Suite 3, Global Village, Jivan's Complex, Mont Fleuri, Mahé, Seychelles