Legal

Privacy Policy

Last Updated: April 17, 2026

1. Data We Collect

Data you provide

• Email address - used to create your account and send transactional emails
• Password - stored as a one-way bcrypt hash. We never store or have access to your plaintext password
• Consent records - when you register, we record the fact that you ticked the consent checkbox (timestamp and checkbox ID), confirming your agreement to these Terms and your acknowledgment of the no-withdrawal policy. This record is necessary to demonstrate lawful basis for processing and contract formation
• Payment data - processed entirely by CryptoCloud.plus. We do not store wallet addresses, private keys, or transaction credentials on our servers

Data collected automatically

• Server logs - IP address, browser type, pages visited, timestamps. Used for security and debugging. Retained for up to 12 months
• Session token - a random authentication token stored in a secure cookie (cia_session) to keep you logged in. Contains no personal data. Expires after 7 days or on logout

What we do NOT collect

• We do not collect exchange API keys with withdrawal permissions
• We do not collect private wallet keys or seed phrases
• We do not use advertising trackers, analytics services (e.g. Google Analytics), or cross-site tracking cookies
• We do not sell your data to any third party

1a. Data Protection Officer

We have assessed our data processing activities and determined that appointment of a Data Protection Officer (DPO) is not mandatory under GDPR Art. 37, as our core activities do not involve large-scale systematic monitoring of individuals and we do not process special categories of personal data at scale. Privacy-related enquiries should be directed to privacy@cryptoaialerts.com.

2. How We Use Your Data

• To create and manage your account
• To send transactional emails: account verification and password reset
• To process your subscription via our payment processor
• To detect and prevent fraud, abuse, and unauthorised access
• To maintain and improve the platform
• To comply with applicable legal obligations

3. Legal Basis for Processing (GDPR)

For users in the European Economic Area, we process personal data under the following bases per GDPR Art. 6:

• Art. 6(1)(b) - Contract: to provide the subscription service you signed up for
• Art. 6(1)(f) - Legitimate interests: security, fraud prevention, service improvement
• Art. 6(1)(c) - Legal obligation: where required by law

3a. International Data Transfers

Our servers are operated within the European Union. Where personal data is accessed or processed by our infrastructure providers or payment processor outside the EEA, we ensure appropriate safeguards are in place in accordance with GDPR Chapter V. Specifically, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission under Art. 46(2)(c) GDPR as the transfer mechanism. A copy of the applicable SCCs is available on request by contacting privacy@cryptoaialerts.com.

4. Data Sharing

• CryptoCloud.plus - our payment processor, for subscription billing only
• Hosting provider - server infrastructure required to operate the platform
• Law enforcement - when required by a valid legal obligation or court order

We do not share, sell, or rent your data to any other third party.

5. Data Retention

• Account data: retained while your account is active, deleted within 90 days of an account deletion request
• Server logs: up to 12 months
• Payment records: as required by applicable law (typically 7 years)

6. Cookies

We use one strictly necessary cookie: cia_session - an authentication token. We do not use advertising or analytics cookies. No cookie consent banner is required for strictly necessary cookies under the EU ePrivacy Directive.

7. Your Rights

EU / EEA users - GDPR

• Access (Art. 15): request a copy of your personal data
• Rectification (Art. 16): correct inaccurate data
• Erasure (Art. 17): request deletion of your data
• Portability (Art. 20): receive your data in machine-readable format
• Object (Art. 21): object to processing based on legitimate interests
• Withdraw consent (Art. 7(3)): where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing
• Complaint: lodge a complaint with your national Data Protection Authority (e.g. ICO in the UK, CNIL in France, BfDI in Germany)

California users - CCPA/CPRA

• Right to know what personal information we collect and how it is used
• Right to delete your personal information
• Right to opt out of sale - we do not sell personal information
• Right to non-discrimination for exercising your rights

To exercise any right, email privacy@cryptoaialerts.com. We will respond within one calendar month. For complex or multiple requests we may extend this by a further two months and will notify you of any extension within the first month, as permitted by GDPR Art. 12(3).

7a. Automated Decision-Making

We do not make any automated decisions about you that produce legal effects or similarly significantly affect you (GDPR Art. 22). Our AI tools generate market analytics and signals for your information - they do not make decisions about your account, access, or any personal matter.

8. Security

• All data in transit is encrypted via HTTPS/TLS
• Passwords are stored as bcrypt hashes - never reversible
• Access to production systems is restricted to authorised personnel
• In the event of a data breach posing risk to users, we will notify affected users and, where required, relevant supervisory authorities within 72 hours

9. Children

Our platform is for users aged 18 and over. We do not knowingly collect data from minors. If we become aware a minor has registered, we will delete their account and data promptly.

10. Governing Law

This Privacy Policy is governed by the laws of England and Wales. This choice does not affect the mandatory data protection rights you hold under GDPR or the national law of your country of residence. If GDPR applies to your data, your rights under GDPR are enforceable regardless of this clause.

10a. Automated Data Cleanup

In accordance with the data minimisation principle (GDPR Art. 5(1)(e)), expired session tokens and verification tokens are periodically purged from our database. Server logs are deleted after 12 months. Account data is deleted within 90 days of a deletion request.

11. Changes

We may update this policy at any time. The "Last Updated" date above reflects the most recent revision. Continued use of the platform after changes constitutes acceptance.