Privacy Policy

The controller of your personal data is EdviTrade, the operator of the EDVI service, the website edvitrade.com and the dashboard app.edvitrade.com. You can reach us for any privacy question or request at [email protected] or through the support section of the dashboard. If we appoint a data protection officer or an EU representative, their contact details will be published here.

We process only the data needed to run the service. The dashboard stores the following categories.

Account data. E-mail address, name or nickname, password (stored only as a hash), interface language, time zone, optional avatar, two-factor authentication secret and recovery codes (encrypted), e-mail verification date and account role. If you sign in with Google, we receive your Google account e-mail, name and avatar. Legal basis: performance of the contract with you (Art. 6(1)(b) GDPR); two-factor authentication additionally serves our legitimate interest in account security (Art. 6(1)(f)).

Exchange connection data. The exchange you choose, your exchange API key, API secret and, for some exchanges, the API passphrase, and the exchange account identifier (UID) returned by the exchange. The dashboard forwards the key, secret and passphrase to our trading server, where the secret is stored encrypted and is used only to place and manage orders in your account and read its balance, positions and trade history. The dashboard itself stores the public API key, the UID and your connection settings (strategy, pairs, trading bots, risk multipliers, deposit settings). We never ask for withdrawal permissions and recommend that you do not grant them. Legal basis: performance of the contract (Art. 6(1)(b)).

Trading data. Balances, balance history, positions, orders placed by the strategies, realised profit and loss by day and by pair, and the operational log of the strategies in your account. This data is produced by our trading server from your exchange account and shown to you in the dashboard. Legal basis: performance of the contract (Art. 6(1)(b)).

Subscription, wallet and payments. Subscription plan and dates, purchases and their price, the internal account balance, deposit transactions you make in USDT on the BSC or TON networks (transaction hash, amount, the deposit address assigned to you), withdrawal requests, referral codes and referral income, and adjustments made by our staff. Blockchain transactions are public by nature; we do not control the networks. Legal basis: performance of the contract (Art. 6(1)(b)) and compliance with accounting and tax obligations (Art. 6(1)(c)).

Free trial record. To grant a single free trial per exchange account, we store the exchange name and exchange account UID together with the trial dates. This record is kept even if you delete your EDVI account, because its only purpose is to prevent repeated free trials. Legal basis: legitimate interest in preventing abuse (Art. 6(1)(f)).

Support and communication. Support tickets with the text and screenshots you send, our replies, announcements you have read or dismissed, and e-mails we send you (verification, security, subscription, low balance warnings, product updates). Legal basis: performance of the contract (Art. 6(1)(b)); product updates by e-mail are based on our legitimate interest in informing existing customers (Art. 6(1)(f)), and you can opt out at any time by writing to [email protected].

AI assistant. If you use the support assistant in the dashboard, your questions and the assistant's answers are stored in your account history. To answer, the assistant may read your own data (strategies, subscription, statistics, logs) and the question together with relevant context is sent to a third-party AI model provider. Before sending, we remove your name, contact details, API keys and secrets and other recognisable identifiers; the provider does not receive your password or exchange credentials. The assistant does not change anything in your account. Legal basis: performance of the contract (Art. 6(1)(b)).

Technical and security data. Session identifiers, IP address and browser identification string for logged-in sessions, server logs, timestamps of logins and actions, and error logs. Legal basis: legitimate interest in security, fraud prevention and troubleshooting (Art. 6(1)(f)).

Cookies and analytics. The public website uses only strictly necessary cookies (session, language, CSRF protection), which do not require consent; the cookie notice records your choice in your browser and nothing else. The login and registration forms are protected by Google reCAPTCHA, which processes your IP address and browser data to tell humans from bots (legitimate interest in security, Art. 6(1)(f)). In the dashboard we use a Google Ads conversion tag and Yandex Metrica (including session replay) to measure registrations and understand how the interface is used. These tags are not essential and are loaded only with your consent given in the dashboard's cookie notice; you can withdraw it at any time by changing your choice there or by clearing the site data in your browser, and you can object by e-mail. Legal basis: consent (Art. 6(1)(a) GDPR and the ePrivacy rules).

We do not process special categories of personal data, we do not take decisions about you that have legal effects based solely on automated processing, and we do not sell personal data.

We share personal data only with providers that help us run the service and only to the extent necessary: our hosting and infrastructure providers; our own trading server, which receives your API credentials and account identifiers; the exchanges you connect (they receive your orders and API calls, which they can link to your exchange account); our e-mail delivery provider (your e-mail address and message content); the AI model provider for the support assistant (filtered conversation content); analytics and advertising providers, only if you accepted non-essential cookies; and payment networks (blockchain transactions). Providers act as processors under a contract with us or as independent controllers under their own privacy policies (exchanges, Google, blockchain networks). We may also disclose data when required by law, a court order or a competent authority, or to establish, exercise or defend legal claims.

Some of our providers, in particular exchanges, Google, Yandex and the AI model provider, may process data outside the EEA. Where this happens we rely on an adequacy decision of the European Commission, on the Standard Contractual Clauses approved by the Commission, or on your explicit consent for optional tags. You can ask us for a copy of the safeguards in place.

• Account, exchange connection and settings data: for as long as your account exists. When you delete your account in the profile settings, your account, connections, wallet, tickets and related records in the dashboard are deleted and the trading server is instructed to delete your connections and credentials.
• Strategy operational logs: the detailed daily logs are deleted after one month; daily profit and loss history is kept for up to about 90 days for display and then no longer collected.
• Payment and subscription records are deleted together with your account, unless applicable accounting or tax law requires us to keep them; in that case they are kept only for the statutory period and only to the extent the law requires.
• Free trial record (exchange name and account UID): kept after account deletion to prevent repeated trials, for as long as the free trial exists as a feature.
• Support tickets and assistant history: deleted with your account; closed tickets may be kept in anonymised form to improve the assistant's knowledge base.
• Server and security logs: typically 14 to 30 days unless needed for an ongoing investigation.
• Sessions expire automatically after a period of inactivity.

Under the GDPR you have the right to access your personal data and receive a copy, to have inaccurate data corrected, to have your data erased ("right to be forgotten"), to restrict processing, to receive the data you provided in a machine-readable format and have it transferred to another controller, to object to processing based on our legitimate interests, including direct marketing, and to withdraw consent at any time without affecting the lawfulness of processing before withdrawal.

You can exercise most rights yourself in the dashboard: edit your profile and language, change your password and two-factor settings, revoke or replace your exchange API key, stop a strategy and delete a connection, and delete your entire account in the profile settings. For anything else write to [email protected]. We answer within one month; we may ask you to confirm your identity before acting on a request. You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state where you live, work or where the alleged infringement took place.

We protect data with encryption in transit (TLS), encrypted storage of exchange secrets and two-factor secrets, hashed passwords, access restricted to authorised staff, IP restrictions and request signing between our servers, and two-factor authentication that you can enable for your account. No system is completely secure. You are responsible for keeping your password, two-factor codes and exchange API credentials confidential, for restricting your API key to trading permissions and, where the exchange allows it, to our server IP addresses, and for revoking the key in the exchange if you suspect misuse.

The service is not intended for persons under 18 years of age and we do not knowingly collect their data. If you believe a minor has created an account, please contact us and we will delete it.

The website and the dashboard link to exchanges, blockchain explorers, social networks and other third-party sites. Their privacy practices are governed by their own policies, which we encourage you to read.

We may update this policy when the service or the law changes. The current version with the date of the last update is always available on this page; for material changes we will notify registered users in the dashboard or by e-mail.

Last updated: 19 October 2026.