Privacy Policy

This Privacy Policy (the "Policy") explains what data is processed when you use the Profit Cloud Telegram bot, the support bot, the Profit Cloud Arbitrageur desktop application and the related servers (together, the "Service"), for what purposes and on what terms. The Service is provided by Profit Cloud Administration (the "Administration"). By using the Service, you confirm that you have read and agree to this Policy.

1. Data collected and stored

The Administration follows the principle of data minimization and collects only what is necessary for the Service to operate. Depending on how you use the Service, the following may be processed:

• Telegram identifiers provided by the Telegram platform itself: numeric user ID, username (@username), first and last name (if set), language code.
• Your Service profile data: internal identifier (UID), selected interface language, time zone, subscription status and related parameters, the fact and time of acceptance of the user-facing documents.
• Email address that you provide and confirm with a code from an email.
• Email confirmation codes. A six-digit code is sent to your email and is valid for 10 minutes. The Service does not store the code itself, only its hash — a value from which the code cannot be recovered — together with the code's purpose, expiry time and the number of entry attempts.
• App sign-in session details: the application name and version, the operating system and the computer name reported by the application itself; the IP address the sign-in came from and the country determined from it; the time of sign-in and of last activity. The country is determined using an address database on the Service's server — the IP address is not sent anywhere for this. The session access key is stored on your computer; the Service keeps only its hash.
• Authenticator app secret (Google Authenticator and similar apps), if you connect one. It is stored encrypted.
• Security event log: sign-ins, sending and entry of confirmation codes, linking and changing your email, connecting an authenticator, freezing the account, ending sessions — with the time, session and IP address.
• Account freeze details: for how long and by what means a freeze was turned on, and, if support lifted it early, who did so and why.
• Data you create yourself: settings and filters, presets, favorite bundles, alerts, trade-journal entries and other user content.
• Application trading data: exchange connections, bundles, levels, orders and their executions, positions, trade results (PnL), fees and funding payments.
• Support requests and feedback: messages and attachments you send to the support bot, and support's replies.
• Payment metadata: information about issued invoices, payment status and amount, and the selected payment method. The Administration does not request or store bank card data; cryptocurrency transactions are recorded in the relevant public networks.
• Technical and diagnostic data: service logs, including the server request log with IP addresses, timestamps, error and event records required for operation, security and abuse prevention.

The Administration does not request passwords to your cryptocurrency-exchange accounts. Each user decides which permissions to grant to their API keys when creating a connection.

API keys are stored encrypted on the Service's server, and no screen of the Service displays them. The Service uses the keys only to check the key and its permissions, to execute your bundles and to read the state of your exchange account: balances, positions, orders, trades, fees and funding payments. The Service does not make withdrawals or transfers of funds.

2. Processing principles

Data is processed lawfully and fairly; limited to predefined purposes; limited to the data necessary for those purposes (minimization); kept accurate and stored no longer than necessary for the purposes of processing. The Administration takes measures to ensure the confidentiality and security of the data it processes.

3. Purposes of processing

Data is processed in order to: provide and maintain the Service; identify you as a user; confirm sign-in to the application with a second factor — a code from an email or from an authenticator app; restore access to your account, for example if you lose access to Telegram; notify you of security events — sign-ins, email changes, freezes; show you the list of your sessions; deliver the selected features; process subscriptions and payments; respond to support requests; ensure security and prevent abuse, including limiting how often emails are sent and keeping a security event log; improve the Service; and comply with applicable law.

4. Legal basis

Processing is based on your consent, which you give when you start using the Service, and to the extent necessary to provide the features you request. You may withdraw your consent (see Section 7).

5. Sharing with third parties

• The Service runs on top of the Telegram platform; messaging is governed by Telegram's own terms and policy.
• Emails with confirmation codes and security notifications are sent through an email service provider (Russia): it receives your email address and the content of the email. Your email provider then delivers it.
• The Service's servers are hosted by a hosting provider (Poland).
• Exchanges you have connected receive the Service's requests sent on your behalf with your API keys; processing on the exchange's side is governed by its own terms and policy.
• When you request to join Profit Cloud community groups, your Telegram identifier is checked against the open spammer database CAS (Combot Anti-Spam).
• Payments may involve third-party payment providers and public blockchain networks; processing on their side is governed by their own terms and policies, and the Administration is not responsible for the actions of such third-party service providers.
• The Administration does not sell your personal data.
• The Administration may disclose data where this is expressly required by applicable law.

6. Retention period

The Administration stores data no longer than necessary for the purposes for which it was collected, or until it is deleted at your request or upon deletion of your account. Certain information may be kept longer where required by applicable law or for security purposes (e.g. fraud prevention). Database backups are stored with storage providers; deletion of data at your request extends to backups as they are replaced.

The following periods apply to certain categories of data:

• sign-in session details, the security event log, records of confirmation codes (without the codes themselves) and of account freezes — 3 years from the event; your previous email address after a change is kept in the security event log for the same 3 years;
• your email address and authenticator app secret — for as long as they are linked to your account;
• application trading data — for as long as your account exists; it is deleted together with the account at your request;
• IP addresses in the server request log — no longer than 30 days.

7. Your rights and data deletion

You have the right to: request information about the data processed, request its correction, restriction of processing, deletion, and withdraw consent previously given. To exercise these rights, contact the Service's support bot in Telegram — @profit_cloud_support_bot.

In addition, in the application or through support you can: view the list of your sessions and end any of them or all at once; change your email address — confirmed with codes from emails.

Important: because an account and the associated data are technically required for the Service to function, deletion of your data results in the termination of your use of the Service — after deletion you can no longer use the Service with your previous account. Once your request is processed, the Administration deletes or anonymizes your data, except for information it is required to retain by law or for security reasons.

8. Security

The Administration applies reasonable technical and organizational measures to protect data against unauthorized access, alteration or loss. In particular, session access keys and confirmation codes are stored only as hashes, and the authenticator app secret and API keys are stored encrypted. However, no method of data transmission or storage can guarantee absolute security.

9. Age of users

The Service is not intended for individuals below the age at which, under applicable law (and Telegram's rules), they may independently consent to data processing.

10. Cross-border processing

Data may be processed and stored on servers in various jurisdictions, including outside your country of residence: the Service's servers are located in Poland, and emails are sent through an email service provider in Russia. By using the Service, you consent to such processing.

11. Changes to this Policy

The Administration may update this Policy from time to time. The current version is always available via the link in the Service. By continuing to use the Service after an update, you accept the revised Policy.

12. Contact

The Service is provided by Profit Cloud Administration. For any questions regarding data processing, please contact the support bot in Telegram — @profit_cloud_support_bot.