Privacy Policy
1. Who is responsible
Selçuk Sir operates Botrader and is the controller of your personal data.
Requests and contact: [email protected]
2. What data we process
| Category | Data |
|---|---|
| Identity and contact | Username, e-mail address, when the e-mail was verified |
| Account security | A one-way hash of your password (the password itself is never stored), the two-step verification secret and hashes of recovery codes, open sessions (IP address, browser/device, last seen), security events (sign-ins, failed sign-ins, password and settings changes, with IP address) |
| Use of the service | The virtual bots you create and their settings, virtual trade and event history, virtual balance, the exchange you selected, the version and time of the terms you accepted |
| Sign-in with Google / Microsoft | If you use it: the stable account ID the provider gives us, your e-mail address and whether the provider has verified it. Your password and other data held by the provider do not reach us. |
| Payments and subscription | If you buy a paid plan: the customer and subscription IDs issued by Paddle, the plan and billing period, amount, currency, payment / refund / subscription status and dates. Your card details, billing address and tax details are entered with Paddle and never reach us. |
| Optional connections | If you connect your own Telegram bot: its token, your chat ID and name; hashes and allow lists of the API keys and webhooks you create |
We do not ask for ID numbers, postal address, phone number, card details or exchange account details, and we do not process special categories of personal data.
3. Why we process it and on what legal basis
- Creating your account and providing the service (registration, sign-in, running virtual bots, notifications): performance of a contract.
- E-mail verification and password reset: performance of a contract.
- Activating, renewing, cancelling and refunding paid plans: performance of a contract; keeping payment records: legal obligation.
- Security (preventing abuse and unauthorised access, rate limits, security event log): our legitimate interest.
- Legal obligations and requests from competent authorities: legal obligation.
We do not use your data for advertising, profiling or marketing, and we do not sell it.
4. Who we share it with
The service runs on our own server. Only the data needed to deliver the service is passed through these providers:
- E-mail delivery service (verification and reset e-mails): your e-mail address and username.
- Secure connection infrastructure (HTTPS tunnel): your IP address and encrypted traffic when you connect to the site.
- Paddle.com, our Merchant of Record, if you buy a paid plan. Paddle processes your card, billing and tax details under its own privacy policy. We pass your Botrader user ID to Paddle so the payment can be matched to your account.
- Telegram, if you connect your Telegram bot: notifications are sent to your bot through Telegram.
- Google or Microsoft, if you sign in with them: your identity is verified by that provider, which sends us only the identity data listed above.
These providers' servers may be located in other countries; such transfers are made with the safeguards required by applicable law. Apart from these, your data is not shared with third parties unless the law requires it.
5. Cookies
We use a strictly necessary session cookie that keeps you signed in and a cookie that remembers your language. On your first visit a first-party source cookie records only the name of the site that referred you (for example google.com), any campaign tag in the link and the first page you opened; it contains no identifier, is not shared with anyone and expires after 90 days. If you register, this information is saved with your account so we can see which channels bring new members. There are no advertising cookies and no third-party tracking or analytics. Display preferences (such as your chart time frame) are stored only on your own device. Paddle's checkout window may set its own cookies needed to process the payment.
6. How long we keep it
- Account data is kept while your account exists.
- Sessions are kept for at most 7 days, e-mail verification and reset links for at most 7 days, and security event logs for 180 days, after which they are deleted.
- Payment records (amount, date, plan, status) are kept for the retention period required by accounting and tax law, even if you delete your account.
- When you delete your account, your account, bots, event history, sessions, API keys, Google/Microsoft links and Telegram connection are permanently deleted. Security event logs are kept only for security purposes until they expire. Anonymous numerical research statistics that cannot be linked to you may remain.
7. Your rights
You have the right to know whether your data is processed, to access it, to learn its purpose and who it is shared with, to have incorrect or incomplete data corrected, to have your data deleted, to object to processing based on our legitimate interest, to object to a decision against you made solely by automated analysis, to receive your data in a portable format, and to claim compensation if you suffer damage from unlawful processing. You can also lodge a complaint with the data protection authority of your country.
Send requests to [email protected] from the e-mail address registered to your account. Requests are answered free of charge within 30 days. You can also delete your account and data yourself at any time under Account → Delete account.
8. Children
The service is not intended for anyone under 18, and we do not knowingly collect their data.
9. Changes
This policy may be updated; each update gets a new version number and material changes are announced in the app or by e-mail.