Privacy Policy

1. Who is responsible for your data

The controller of personal data is Nektrade, Republic of Armenia. Data-protection enquiries: [email protected].

The Law of the Republic of Armenia on the Protection of Personal Data applies to this processing. Because the service is openly offered to residents of the European Union, GDPR also applies to their data (Art. 3(2)) — this document is written to both.

No Data Protection Officer has been appointed: as of this version the service’s activities do not meet the Article 37 criteria that make one mandatory. If that changes, the contact details will appear here.

2. What data is processed

The full list follows. It was compiled from what the system actually holds, not from a template.

• Account data: display name, email address (as entered and normalised), interface language, account status and email-confirmation state, dates of creation and deactivation.
• Authentication data: a password hash (scrypt; the password itself is neither stored nor recoverable), and fingerprints of one-time confirmation and reset tokens (the tokens themselves are not stored).
• Sessions: session identifier, a fingerprint of the issued credential, times of creation, last use, expiry and revocation. Sessions do NOT record IP addresses or browser details.
• Organization and membership: organization name, member roles, invitations (including the invited person’s email address) and the history of membership changes.
• Account activity log: event type, the identifier of the acting person, time, reason code. Passwords, tokens and their contents never enter the log.
• Trading activity inside the service: settings, instructions, orders, fills, cash movements and risk decisions, each with the identifier of the acting person.
• Exchange connection data: the public part of the API key and its fingerprint. The secret part is held in a separate secrets store and is never returned to the browser.
• Web server technical logs: IP address, time, requested path, response code, browser string (User-Agent).

3. Why, and on what legal basis

• Creating and running your account, signing in, confirming email, resetting a password — performance of a contract with you, GDPR Art. 6(1)(b).
• Operating the service on your instructions: settings, simulations, orders to an exchange — performance of a contract, Art. 6(1)(b).
• Security: logs, abuse detection, incident investigation — the controller’s legitimate interest in protecting the service and its users, Art. 6(1)(f).
• The immutable audit trail — legitimate interest in being able to explain and reconstruct what happened, Art. 6(1)(f), and the establishment or defence of legal claims.
• Service emails (address confirmation, password reset, invitations) — performance of a contract, Art. 6(1)(b). The service sends no marketing.
• Compliance with legal obligations, should any arise — Art. 6(1)(c).

4. Where the data comes from

Mostly from you directly: you enter a name, an email address and a password, connect an exchange key, and set your settings.

One category does not come from you: if someone invited you to an organization, the service received your email address from them. This is the notice required by GDPR Article 14 — the address is used only to deliver the invitation and to connect it to your future account; if you do not accept, the record stays until the invitation expires and then ceases to have effect.

5. Who receives the data

The service does not sell data and passes none to advertising networks. There are exactly as many recipients as it takes to run:

• netcup GmbH (Austria, EU) — hosting of the servers and the database. Processor.
• Cloudflare, Inc. (USA) — traffic protection and delivery. Every domain of the service is proxied through Cloudflare, so it terminates the TLS connection and sees IP addresses and request metadata. Processor.
• Resend (USA) — delivery of service emails. Receives the recipient address and the message content. Processor.
• The exchange whose account you connected (for example Binance) — receives trading instructions on your behalf. It acts as an independent controller in respect of your account with it, under its own terms.

6. Transfers outside the EEA

The servers and the database are in the European Union (Austria). Two processors — Cloudflare and Resend — are in the United States, so some data is processed outside the EEA.

Such transfers require Standard Contractual Clauses and supplementary measures. Putting those agreements in place is listed among the open decisions above: as of this version the controller must accept them and, where a processor offers EU data localisation, enable it.

7. How long data is kept

• Account and organization data — for as long as the account exists, and afterwards for as long as needed to defend legal claims.
• Sessions — until expiry or revocation; changing your password ends every session immediately.
• One-time confirmation and reset tokens — 24 hours, single use; after use only a fingerprint remains.
• Audit and trading-activity records — indefinitely and immutably. This is deliberate: without them it is impossible to explain why the system did what it did. Basis: GDPR Art. 17(3)(b) and (e).
• Web server technical logs — as of this version NO automatic retention limit is configured and the logs accumulate. This does not meet the storage-limitation principle (Art. 5(1)(e)); the task is in the list of open decisions above.

8. Your rights

In respect of your data you have the right to access it (Art. 15), correct it (Art. 16), erase it (Art. 17), restrict its processing (Art. 18), receive it in a portable form (Art. 20), object to processing based on legitimate interest (Art. 21), and withdraw consent where processing rests on it.

To exercise a right, write to [email protected]. We answer within one month (Art. 12(3)); for a complex request that may be extended by two further months, with notice.

One caveat about erasure, so as not to create a false expectation: account data is deleted, but audit and trading records are kept in pseudonymised form — they retain the acting person’s identifier, no longer linked to your name and address. There is no automated erasure procedure in the service yet: a request is carried out by hand.

If you believe your rights have been breached, you may complain to the Personal Data Protection Agency of the Ministry of Justice of the Republic of Armenia. If you are in the European Union, you may also complain to the data-protection supervisory authority of the country where you live.

9. Automated decisions

The service takes no automated decisions about you that produce legal effects or similarly significantly affect you within the meaning of GDPR Art. 22, and builds no profiles from your personal data.

Trading decisions are made from market data and the settings you chose, not from your personal data, and only within a mandate you granted explicitly and can revoke at any time.

10. Cookies and browser storage

The service uses no analytics, no advertising networks and no third-party counters. None exist in the interface code, and the content security policy forbids the browser from contacting outside addresses.

One functional cookie is used — genesis.locale — holding only your chosen language. Your session is kept in your browser’s localStorage and removed when you sign out. Both are strictly necessary for the service you requested, so neither requires consent.

11. How the data is protected

• Passwords are stored only as a scrypt hash with an individual salt; the original password is not recoverable.
• The secret part of an exchange key is held in a separate secrets store rather than in the application database, and is never returned to the browser.
• Connections are encrypted (TLS). Data belonging to different organizations is separated at the database level.
• Only members of an organization can reach its records, and actions are written to an immutable log.

12. Children

The service is not intended for anyone under 18 and does not knowingly collect their data. If such data has reached the system, write to us and it will be deleted.

13. Changes to this policy

This policy may change. The document carries a version and a date; material changes are announced in the interface and, where necessary, by email to the address you gave.