Privacy Policy

Draft version · not yet effective

This Privacy Policy explains what personal data Fishak Labs collects when you use Auto-Trade (the web console and backoffice/admin surfaces), why, and how you can control it.

1. What we collect

Depending on how you use the Service, we collect:

• Account data — email, username, hashed password, two-factor authentication status.
• Exchange/broker API credentials — API key/secret pairs you provide to connect your own exchange or broker account. These are encrypted at rest with AES-GCM before storage and are never logged or displayed in full after entry; only the connection status and masked identifiers are shown back to you.
• Trading activity — orders, fills, positions, and P&L generated by your connected account, so we can show you your own trading history.
• Usage data — device/browser type, IP address, and in-app actions, for security (rate limiting, fraud detection) and reliability purposes.
• Billing data — subscription tier and payment status. Bot capital-tier subscriptions are billed in crypto directly to a payment address; we don't collect or store card details for them. Some other, legacy paid features may bill by card through a third-party payment processor instead — where that applies, card details are handled by that processor and are not stored on our servers.

2. How we use it

We use this data to operate the Service (execute your configured strategy, show your dashboard, enforce your capital caps and guards), to secure accounts (authentication, rate limiting, abuse prevention), to communicate with you (trade notifications, account and billing emails, invites), and to improve the product.

3. What we don't do

We do not sell your personal data. We do not share your exchange/broker API credentials with any third party other than the exchange/broker itself, to execute the trades you've configured.

4. Third parties

We use a small number of infrastructure providers to run the Service: our hosting provider, our payment processor for billing, and (on the bot signup flow) Cloudflare Turnstile for bot/abuse protection. Each only receives the data necessary to perform its function. See our Cookie Policy for details on Turnstile's own cookies.

5. Data retention and deletion

We retain account and trading-history data for as long as your account is active, plus a limited period afterward for legal, tax, and dispute-resolution purposes. You can request deletion of your account and associated personal data by contacting us through your account dashboard's support channel; we will delete or anonymize your data within a reasonable period, except where we are required to retain records (e.g. transaction records) by law.

6. Security

Exchange/broker credentials and other secrets are encrypted at rest (AES-GCM). Sessions use secure, HTTP-only cookies over HTTPS. Access to production systems is restricted and audited.

7. Your rights

Depending on your jurisdiction, you may have rights to access, correct, export, or delete your personal data. Contact us through your account dashboard to exercise these rights.

8. Changes to this policy

We may update this policy from time to time. Material changes will be notified in-app or by email before they take effect.

9. Contact

Questions about this policy can be sent to the support address listed in your account dashboard.