Privacy Policy

1. Introduction

ArbTrade Pro ("Company," "we," "us," "our") is committed to protecting your privacy and ensuring you have a positive experience on our platform. This Privacy Policy explains how we collect, use, disclose, and otherwise process personal information in connection with our website, mobile application, and related services (collectively, the "Service").

This Privacy Policy applies to all users, including retail investors, institutional clients, and visitors. By accessing or using ArbTrade Pro, you acknowledge that you have read, understood, and agree to be bound by all the terms of this Privacy Policy.

If you do not agree with our practices, please do not use our Service.

2. Information We Collect

2.1 Information You Provide Directly

• Account Registration: Full name, email address, phone number, username, password, date of birth, nationality, residential address
• Identity Verification: Government-issued ID (passport, driver's license), proof of address (utility bills, bank statements), selfie for facial verification
• Financial Information: Bank account details, cryptocurrency wallet addresses, trading history, transaction records, portfolio composition
• Exchange API Credentials: Encrypted API keys and secrets from connected exchanges (Bybit, Binance, etc.)
• Communication: Support tickets, emails, chat messages, feedback, and survey responses
• Payment Information: Credit/debit card details (processed securely by PCI-DSS compliant payment processors)

2.2 Information Collected Automatically

• Device & Browser Data: Device type, OS, browser, IP address, device identifiers, mobile network information
• Usage Analytics: Pages visited, features accessed, trading activity, session duration, click patterns, feature interactions
• Location Data: Approximate location inferred from IP address (country, city level); not precise GPS tracking
• Cookies & Tracking: Session cookies, authentication tokens, preference data, analytics cookies
• Log Data: Server logs including access timestamps, error messages, API calls, transaction details
• Performance Data: System performance metrics, app crashes, latency measurements

2.3 Information from Third Parties

• Identity verification providers (KYC/AML services)
• Blockchain data providers for transaction verification
• Exchange APIs for real-time market data
• Payment processors and banking partners
• Security vendors for fraud detection
• Analytics providers for usage insights

3. How We Use Your Information

We process your information for the following legitimate purposes:

3.1 Automated Decision-Making & Profiling

We use automated systems to:

• Detect and prevent fraudulent transactions
• Assess account risk and compliance status
• Personalize trading recommendations (non-binding)
• Monitor for suspicious activity patterns

You have the right to request human review of automated decisions that significantly affect you.

4. Data Security & Encryption

We implement industry-leading security measures to protect your information:

4.1 Technical Controls

• In Transit: TLS 1.2+ encryption for all data transfers; HTTPS for web, TLS for mobile
• At Rest: AES-256 encryption for sensitive data (API keys, private keys, passwords)
• Authentication: Multi-factor authentication (MFA) required; bcrypt password hashing with salt
• Access Control: Role-based access control (RBAC); principle of least privilege
• Network Security: Firewall, DDoS protection, intrusion detection systems

4.2 Organizational Controls

• Regular security audits and penetration testing (quarterly minimum)
• Employee background checks and confidentiality agreements
• Secure data disposal protocols
• Incident response plan with 24/7 monitoring
• Compliance with SOC 2 Type II standards

5. Data Sharing & Disclosure

5.1 We Do NOT Sell Your Data

We do not sell, rent, or trade your personal information to third parties for marketing purposes. Period.

5.2 We May Share Information With:

• Service Providers: Payment processors, cloud hosting, analytics (all under strict data processing agreements)
• Law Enforcement: When legally required by subpoena, court order, or government request
• Regulators: Financial regulators, tax authorities, AML/KYC agencies
• Legal Compliance: To enforce our Terms of Service, protect our rights, or defend against claims
• Business Transfers: In event of merger, acquisition, bankruptcy, or asset sale
• With Your Consent: When you explicitly authorize us to share information

5.3 Public Blockchain Data

Cryptocurrency transactions are recorded on public blockchains. Once you initiate a transaction, wallet addresses and transaction amounts are permanently visible to everyone. We are not responsible for privacy leaks related to public blockchain use.

6. Your Rights & Choices

6.1 General Rights (All Users)

• Access: Request a copy of all personal information we hold about you
• Correction: Request we update or correct inaccurate information
• Deletion: Request deletion of your account and associated data (subject to legal holds)
• Opt-Out: Unsubscribe from marketing emails anytime via link in email
• Data Portability: Receive your data in portable format (CSV, JSON)

6.2 GDPR Rights (EU/UK Residents)

• Right to be forgotten (erasure)
• Right to restrict processing
• Right to object to processing
• Right to lodge a complaint with your data protection authority

6.3 CCPA Rights (California Residents)

• Right to know what personal information is collected
• Right to delete personal information (with exceptions)
• Right to opt-out of "sales" of personal information
• Right to non-discrimination for exercising CCPA rights

6.4 How to Exercise Your Rights

Submit requests via our contact form or email [email protected] with "Data Rights Request" in the subject line. Include your account email and specific request. We will respond within 30 days (or as required by law).

7. Regulatory Compliance

7.1 Data Retention

We retain personal information for as long as necessary to:

• Provide the Service and fulfill your requests
• Comply with legal obligations (typically 7 years for financial records)
• Resolve disputes and enforce agreements
• Detect and prevent fraud

After retention periods expire, we securely destroy the data using industry-standard protocols.

7.2 Jurisdiction & International Transfers

Our Service is operated in the United States. If you access it from outside the US, you consent to the transfer, storage, and processing of your information under US laws, which may have different privacy protections than your home country.

For EU/UK Users: We use appropriate safeguards (Standard Contractual Clauses) for international data transfers in compliance with GDPR.

7.3 Children's Privacy

Our Service is not intended for users under 18 years old. We do not knowingly collect information from children under 13. If we become aware of such collection, we will delete it immediately and notify the parent/guardian.

7.4 Financial Regulations

We comply with applicable financial regulations including:

• Anti-Money Laundering (AML) regulations
• Know Your Customer (KYC) requirements
• Sanctions screening (OFAC, UN, EU)
• Beneficial ownership reporting (FinCEN BOI)

8. Contact Us & Data Subject Requests

8.1 Data Protection Officer

For GDPR-related inquiries, you may contact our Data Protection Officer or submit a complaint to your local supervisory authority.

8.2 Policy Updates

We may update this Privacy Policy at any time. We will notify you of material changes by:

• Posting the updated policy on this page with a new "Last Updated" date
• Sending email notification to registered users
• Requiring explicit consent if changes are material

Your continued use of ArbTrade Pro after changes constitutes acceptance of the updated Privacy Policy.