Privacy Policy and Data Protection Notice

1. Data controller

Your personal data is processed under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 data controller in its capacity as XTRAD LIMITED Users resident in Turkey are additionally covered by Law no. 6698 on the Protection of Personal Data (KVKK).

Address: 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ · Email: [email protected]

2. Data we process

Identity and contact

• Full name, email address;
• Telegram or WhatsApp details you optionally share;
• The package preference, starting capital and free-text note you send in the application form.

Technical and usage data

• IP address, country, browser and device information;
• Panel session records, settings change history;
• Telemetry from your server: slot states, open positions, realised trade results, system logs.

Payment data

• Payment amount, date, network used and transaction ID;
• The wallet address you sent the payment from.

We do not collect card details. We do not ask for identity documents.

Your API key

Your Binance API key only on the server allocated to you, stored encrypted. It is not held in our central databases, does not appear in the telemetry stream, is not written to logs and is not displayed in the panel. Your key is created without withdrawal permission and, through the IP restriction, can be used only from that server.

3. Purposes and legal bases of processing

• Performance of the contract (UK GDPR art. 6(1)(b) · KVKK art. 5/2-c): assessing the application, provisioning the server, delivering the service, tracking payment.
• Legal obligation (UK GDPR art. 6(1)(c) · KVKK art. 5/2-ç): accounting, tax and retention obligations.
• Legitimate interest (UK GDPR art. 6(1)(f) · KVKK art. 5/2-f): service security, prevention of abuse, fault diagnosis, improving service quality.
• Explicit consent (UK GDPR art. 6(1)(a) · KVKK art. 5/1): information and announcement messages, sent only if you request them.

4. Transfers

Your data is never sold and never shared with third parties for marketing. The following providers are used so the service can be delivered:

• Cloudflare — site hosting, security, form delivery and analytics;
• Server provider Hetzner / Contabo — hosting of the machine allocated to you;
• Telegram — solely to deliver application notifications to us;
• Binance — trades are executed directly through your own account; Binance's own privacy policy applies to that relationship.

These providers' servers may be located outside the United Kingdom; transfers are made with appropriate safeguards under Chapter V of the UK GDPR (an adequacy decision or standard contractual clauses). For users resident in Turkey, article 9 of the KVKK also applies.

5. Retention periods

• Application records: if they do not become a service 12 months;
• Account and contract data: for the duration of the relationship and, from its end, 10 years (as required by limitation periods and legislation);
• Payment and accounting records: for the period required by law;
• Telemetry and system logs: 24 months;
• Your API key: when the subscription ends, together with the server it is deleted irreversibly.

6. Cookies and analytics

No advertising or tracking cookies are used on this site. For visit statistics we have chosen a cookie-free analytics tool (Cloudflare Web Analytics); it builds no personal profile and does not process your data for advertising. When you sign in to the panel, technically essential cookies are used to maintain your session.

7. Security

• All traffic is encrypted with TLS;
• API keys are held only on your own server and in encrypted form;
• No inbound connections are accepted to the servers; the engine listens on no port;
• Administrative access is restricted to a limited set of IP addresses;
• Access is logged and reviewed regularly.

No system can offer absolute security. In the event of a breach affecting your data, we will notify you and the competent authority within the period required by law.

8. Your rights

Under the UK GDPR and applicable data protection law you have the right to learn whether your personal data is processed, to request information, to learn the purpose of processing, to know the recipients of any transfer, to have incomplete or incorrect data corrected, to request erasure where the conditions are met, to require that these actions be notified to third parties the data was transferred to, to object to a result produced against you by automated analysis, and to claim compensation if you suffer loss.

You can send your requests to [email protected] you can send it to; within 30 days Unsatisfied with the reply, you may contact the United Kingdom data protection authority ICO(ico.org.uk), and if you are resident in Turkey the Turkish Data Protection Authorityyou may lodge a complaint with

9. Changes

We may update this policy. We notify material changes by email; the current version is always published on this page.