Privacy Notice
Working draft of how VeltrixEye handles personal data. Every fact below reflects the platform’s current, verified behavior; items in brackets await operator and counsel input. This document is a working draft prepared for operator and counsel review. It is not counsel-approved and is not final. Bracketed items require operator input before publication.
Status of this document
This document is a working draft prepared for operator and counsel review. It is not counsel-approved and is not final. Bracketed items require operator input before publication.
Who is responsible
[OPERATOR TO CONFIRM: legal entity name] will be identified as the data controller once the operator confirms it. Contact: support@veltrixeye.com.
What the platform records (verified)
Account: your email, an optional display name, and your password — stored only as an argon2id password hash, never in plain text.
Sessions: a server-side session record containing a SHA-256 hash of the session token (the token itself lives only in your browser cookie), your IP address, and timestamps. Expired sessions are cleaned up at service start.
Audit log: an append-only security log of events (registration, sign-in, failed sign-in, sign-out, password change, and strategy-lifecycle actions) recording the time, your IP address, and browser user-agent string.
Your content: strategies, versions, conditions, setups, quality scores, backtests, alerts, and notification preferences that you create.
Notification deliveries: for alerts you receive, the platform stores the recipient email, the rendered message, and each delivery attempt’s outcome (documented retention defaults: delivered rows 30 days, failed rows 120 days).
Billing (only if you purchase a plan): subscription state, the payment provider’s customer/subscription identifiers, and verified payment evidence (provider reference, amount, currency, timestamps). Card and bank details are collected by the payment provider and are never stored by VeltrixEye.
Push notifications (only if you enable them): your browser’s push subscription (endpoint URL and two encryption keys), encrypted at rest server-side.
Server logs: operational request logs carry identifiers, statuses and error categories — message payloads and credentials are excluded by design.
What is not collected
No advertising identifiers and no third-party analytics or tracking scripts run on this site.
No precise location; IP addresses are used for security, rate limiting and audit attribution only.
No card, authorization, or bank details are stored by the platform.
Cookies and local storage
One strictly necessary session cookie (HttpOnly, SameSite=Strict, Secure in production) keeps you signed in. Your watchlist is stored in your browser’s local storage under veltrixeye:watchlist, and the cookie-notice dismissal under veltrixeye:cookie-notice.ack. Details: the Cookies page.
How information is used
To operate and secure the product: authenticate you, enforce plan limits server-side, evaluate your strategies, generate and deliver alerts, produce backtests and simulated execution records, process subscriptions, prevent abuse, and maintain the audit trail.
Who else receives data
Service providers needed to run the product: the hosting platform, the market-data provider, the payment provider (for checkout and payment verification), and the email/push/webhook delivery channels you configure. [OPERATOR TO CONFIRM: privacy-rights wording for the governing jurisdiction] A complete processor list is maintained by the operator: [OPERATOR TO CONFIRM: processor list and data-processing terms].
Retention
Verified specifics: notification delivery records keep delivered rows 30 days and failed rows 120 days; expired sessions are removed at service start. All other data is kept for as long as the account is active and as required to operate the service: [OPERATOR TO CONFIRM: general data-retention period]. Self-service account deletion is not currently offered; deletion requests: [OPERATOR TO CONFIRM: account and data deletion process].
Security
Passwords are hashed with argon2id; session tokens are stored hashed; session cookies are HttpOnly and SameSite=Strict and Secure in production; notification secrets and push keys are encrypted at rest with authenticated encryption. No system is perfectly secure, and no guarantee of absolute security is made.
Your rights
[OPERATOR TO CONFIRM: privacy-rights wording for the governing jurisdiction] To exercise any right or ask a question, contact support@veltrixeye.com.
Changes and contact
This notice may change with the product or the law. [OPERATOR TO CONFIRM: how changes to these terms are announced] Contact: support@veltrixeye.com.