Privacy Policy

1. Who is responsible

AivorixQuant is responsible for your personal data. Contact: [email protected].

2. What we collect

• Account: e-mail address, password (stored only as a one-way hash), language, and — if you turn it on — your 2FA secret (encrypted).
• Security records: IP address, browser / device name and time of logins and important actions (for your protection and to investigate abuse).
• Exchange API keys: encrypted with AES-256-GCM; staff cannot read them. We keep the exchange name, a label, the last 4 characters and the permissions we checked.
• Trading data: your bots, settings, signals, trades, results and backtests.
• Payments: the invoice, the paying wallet address and the transaction hash (these are public on the blockchain anyway).
• Telegram: your chat id and username, only if you link Telegram for alerts.
• Push notifications: for each device where you turn them on, the push address your browser gives us and a device name such as “Chrome on Android”.

3. What we do NOT collect

• No identity documents, no bank or card numbers, no wallet seed phrases or private keys.
• No advertising or analytics trackers, and we never sell or rent your data.

4. Why we use it

• To provide the service you asked for (run bots, show results, send the alerts you chose).
• To keep accounts and the platform secure (login protection, abuse detection, audit log).
• To meet legal duties (for example accounting records of payments).
• To send service e-mails (security notices, payments). No marketing e-mails without your consent.

5. Who receives data

• Your exchange — only the API requests your bot makes with your key.
• Service providers who run parts of the service for us under contract: hosting, e-mail delivery and, if enabled, error tracking (with personal data removed).
• Telegram — the alert messages, only if you link it.
• Your browser's push service (Google, Mozilla, Apple or Microsoft) — only if you turn push on; the notifications are encrypted so they can't read them.
• Authorities — only when the law requires it.

6. How we protect it

Encryption in transit (HTTPS) and for secrets at rest, two-factor authentication, rate limits, an append-only security log, logged and limited staff access, and encrypted backups. No system is perfectly secure; if a breach affects you, we will tell you as the law requires.

7. How long we keep it

• While your account exists.
• When you delete your account: exchange keys are destroyed and every device is logged out immediately; your e-mail, 2FA, Telegram link, push devices, notifications and backtests are removed at once; bot and trade history within 30 days.
• Invoices are kept for the period accounting law requires, without your e-mail address. The security log is kept, linked only to an anonymous id.
• Encrypted backups are overwritten within about 14 days.

8. Your rights

• Download a copy of your data: Settings → Privacy & data → Download my data.
• Correct your data, or delete your account: Settings → Privacy & data → Delete account.
• Object to or ask about any use of your data, and complain to your data-protection authority. Write to [email protected].

9. Cookies

Only what the app needs: a secure, http-only login cookie, and your language and theme choice. No advertising or tracking cookies.

So the app opens without a connection, it keeps the last data it showed you (bots, trades, notifications — never keys, passwords or login tokens) in your browser on that device for up to 7 days. Logging out deletes it.

10. Children

The service is not for anyone under 18. We delete accounts we learn belong to a minor.

11. International transfers

Our servers and providers may be in other countries than yours. We use providers with appropriate safeguards for personal data.

12. Changes

We will tell you in the app about important changes; the version date is shown at the top.