Privacy Policy

1 Who we are

CryptoPilot Technologies Pte. Ltd., 12 Marina Boulevard, Singapore 018982, is the data controller for the personal data described here. Where we process data on behalf of an institutional client, that client is the controller and we act as processor under a separate agreement.

This policy sits alongside our Terms of Service, which govern your use of the platform generally.

2 Data we collect

We collect only what a feature actually needs. Data falls into four groups:

• Account data — name, email, password hash, two-factor settings, plan and billing status.
• Verification data — government ID, selfie, proof of address and source-of-funds answers, collected only when you request live trading and required of us by anti-money-laundering rules.
• Trading data — connected exchange accounts, balances, positions, orders, fills and the strategy settings you configure.
• Technical data — IP address, device and browser details, session timestamps, and in-app actions such as which pages and features you use.

3 Why we use it and our legal basis

Each purpose below is tied to a specific lawful basis under GDPR and equivalent laws. We do not repurpose data beyond what is listed without telling you first.

Where we rely on legitimate interest we have weighed it against your rights and can share that assessment on request. Where we rely on consent, you can withdraw it at any time without affecting anything done beforehand.

4 Exchange keys and trading data

Exchange API keys are the most sensitive data we hold, and they are handled apart from everything else. Keys are encrypted with AES-256 under a key held in a hardware security module, are never written to logs, and are never visible in plaintext to our staff — including support.

• Keys are used only to read balances and place the orders you or your enabled automation instruct.
• We do not accept and cannot use withdrawal permissions.
• Revoking a key in Settings → API Keys deletes it from our systems immediately; backups purge within 35 days.
• Executed trade records are kept for seven years to satisfy financial record-keeping rules, even after a key is revoked.

5 AI models and your data

Our signal models are trained on market data — prices, volumes, order books, on-chain activity and public news. They are not trained on your individual trading history, and your positions are never used to train a model that serves another user.

Your own data is used at inference time to personalise what you see: your portfolio shapes your risk assessment, and your holdings decide which signals reach you. That processing happens for your account and stays within it.

We may compute aggregate, de-identified statistics — for instance, the share of users holding an asset — and publish them. These cannot be traced back to an individual, and no single user's activity is identifiable in the output.

6 Who we share data with

We do not sell personal data, and we have never done so. We share it only in these circumstances:

• Exchanges you connect — order instructions go to the venue you selected, under its own privacy policy.
• Service providers — cloud hosting, payment processing, identity verification, email delivery and error monitoring, each contractually bound to process only on our instructions.
• Regulators and law enforcement — where a valid legal order requires it. We review every request, reject overbroad ones, and notify you unless legally barred from doing so.
• A successor entity — if CryptoPilot is acquired or merged, under the same protections, with notice to you before any transfer.

A current list of sub-processors is available on request and is updated whenever one changes.

7 International transfers

We operate from Singapore with infrastructure in Singapore, Frankfurt and Virginia. EU and UK data is stored in Frankfurt by default and is transferred outside that region only where necessary to operate the service.

Such transfers rely on the European Commission's Standard Contractual Clauses, the UK Addendum, and a transfer impact assessment for each destination. Copies are available from our Data Protection Officer.

8 How long we keep it

Retention periods are set out per purpose in section 3. Broadly: account data goes 30 days after closure, trade records are held seven years, verification documents five years, and analytics 14 months.

The 30-day window after closure exists so an account closed by mistake — or by someone who should not have had access — can be restored. After it passes, deletion is permanent and cannot be reversed. Backups containing deleted data expire within 35 days.

Where the law obliges us to keep a record, we retain that record alone and delete everything else.

9 How we protect it

• AES-256 encryption at rest and TLS 1.3 in transit, everywhere, with no unencrypted internal hops.
• Exchange keys sealed in a hardware security module, separate from the application database.
• Least-privilege staff access, reviewed quarterly, with every access to production data logged and alerted on.
• Independent penetration testing twice a year and an ongoing bug bounty programme.
• SOC 2 Type II audited controls.

No system is perfectly secure. If a breach affects your personal data and poses a real risk to you, we will notify you and the relevant supervisory authority within 72 hours of becoming aware, and tell you what happened and what to do.

10 Your rights and choices

Depending on where you live you have some or all of the following rights. We honour them for every user regardless of jurisdiction, and we never charge for exercising one.

1. Access — get a copy of the personal data we hold about you.
2. Rectification — correct data that is wrong or incomplete.
3. Erasure — have your data deleted, subject to records we must legally retain.
4. Portability — receive your data in a structured, machine-readable format.
5. Restriction and objection — pause processing, or object to anything we do on the basis of legitimate interest.
6. Withdraw consent — at any time, for anything we do on the basis of consent.
7. Non-discrimination — exercising a right never degrades your service or pricing.

Most of these are self-service in Settings → Privacy. For the rest, email privacy@cryptopilot.example — we respond within 30 days and will tell you promptly if a request genuinely needs longer. You may also complain to your local supervisory authority.

11 Cookies and tracking

We use three categories of cookie:

• Essential — sign-in sessions, security tokens and your theme and layout preferences. These cannot be switched off without breaking the app.
• Analytics — first-party measurement of which features are used, so we know what to improve. Optional, and off until you allow them.
• Performance — error and latency monitoring that helps us find faults. Optional.

We run no third-party advertising or cross-site tracking cookies, and we honour Global Privacy Control signals automatically. Preferences can be changed at any time in Settings.

12 Changes and contact

When this policy changes materially — a new purpose, a new category of recipient, a longer retention period — we give at least 30 days' notice by email and in-app before it takes effect. Clarifications and typographical fixes take effect on posting.

Contact

Data Protection Officer · CryptoPilot Technologies Pte. Ltd. · 12 Marina Boulevard, Singapore 018982 · privacy@cryptopilot.example

EU representative: CryptoPilot Europe B.V., Herengracht 420, 1017 BZ Amsterdam, Netherlands. UK representative: CryptoPilot UK Ltd., 30 Finsbury Square, London EC2A 1AG.

For product questions rather than privacy ones, the Help Center and FAQ are faster.