Global Privacy Policy & Data Protection Charter

The legal Data Controller responsible for the processing of your personal data is SmartEEDigital Teknoloji A.Ş. We have designated an official Data Protection Officer (DPO) to oversee privacy compliance, data subject rights requests, and supervisory authority communications. For any inquiries, you may directly contact our Data Protection Team at [email protected] or [email protected].

We adhere strictly to the principle of Data Minimization (GDPR Art. 5(1)(c)). We only collect data that is strictly necessary to provide algorithmic analysis and non-custodial trading execution: • Identity & Authentication Data: Email address, encrypted authentication hashes (Argon2id), display name, and optional OAuth profile identifiers (Google, GitHub). • Financial & Invoicing Metadata: Subscription status, tier, renewal dates, and country of tax residence. Note: We NEVER collect, process, or store raw credit card numbers or primary account numbers (PAN). All payment processing, invoicing, and tax collection is handled exclusively by our authorized Merchant of Record, Paddle.com. • Exchange API Credentials: API Key and API Secret provided by you to enable CCXT trading bot execution. These credentials are NEVER stored in plaintext. They are encrypted using military-grade AES-256-GCM envelope encryption with per-user key derivation. We strictly enforce and require that API keys have 'Withdrawal' permissions DISABLED. • Technical, Telemetry & Network Identifiers: Anonymized IP addresses, browser fingerprint metadata, device operating system, latency benchmarks, and application performance metrics.

Every processing activity conducted by TradingMaster AI is anchored upon a verified, legitimate legal basis: • Contractual Necessity (Art. 6(1)(b)): Processing required to deliver SaaS features, execute trade signals via connected CCXT exchange APIs, manage subscription access, and deliver real-time WebSocket feeds. • Legitimate Interests (Art. 6(1)(f)): Processing required to safeguard platform infrastructure, prevent fraud, mitigate distributed denial-of-service (DDoS) attacks, debug software defects, and maintain sub-millisecond execution reliability. • Legal & Statutory Obligations (Art. 6(1)(c)): Retaining billing records, tax compliance reports, and audit logs as mandated by applicable commercial and financial statutes. • Explicit Consent (Art. 6(1)(a)): Opt-in preferences for non-essential analytics cookies, product newsletters, and optional market alerts.

TradingMaster AI is an entirely non-custodial software provider. Under no circumstances does SmartEEDigital hold, manage, possess, or custody user fiat or cryptocurrency assets. All funds remain in your personal exchange accounts (e.g., Binance, Bybit, OKX, Gate.io, Kraken). All exchange API credentials uploaded to the platform are secured via multi-tiered envelope encryption (AES-256-GCM + hardware security modules). API keys discovered with withdrawal capabilities enabled are immediately flagged and rejected by our automated security filters.

We work exclusively with ISO 27001, SOC 2 Type II, and GDPR-compliant infrastructure partners: • Payment & Merchant of Record: Paddle.com (UK/EU/USA) - PCI-DSS Level 1 compliant Merchant of Record for global billing and tax settlement. • Cloud Infrastructure & Database Hosting: Hetzner Online GmbH (Germany/EU) and Amazon Web Services (AWS EU Frankfurt/Ireland) with full encryption at rest and in transit (TLS 1.3). • Redis Cache & Time-Series: Dedicated secure virtual private clouds (VPC) with zero public internet exposure. When data is transferred outside the European Economic Area (EEA), transfers are governed by European Commission Standard Contractual Clauses (SCCs) and robust supplementary technical safeguards.

We retain personal data only for as long as strictly necessary to fulfill the purposes for which it was collected: • Active Account Data: Retained throughout the duration of your active subscription. • Exchange API Keys: Instantly purged and cryptographically shredded upon bot deletion or user request. • Operational Logs: Rotated and automatically purged on a rolling 90-day retention schedule. • Tax & Invoicing Records: Retained for the statutory duration (typically 7 to 10 years) to satisfy national fiscal compliance obligations. • Market Candle OHLCV Data: Historical market price data is public market information and does not constitute personal data.

Regardless of your geographic location, TradingMaster AI guarantees full exercise of your data protection rights: • Right to Access (GDPR Art. 15): Request a complete copy of personal data processed by the platform. • Right to Rectification (GDPR Art. 16): Correct any inaccurate or incomplete personal records. • Right to Erasure / Right to be Forgotten (GDPR Art. 17): Request permanent deletion of your account and all associated credentials via our self-service deletion portal or by emailing [email protected]. • Right to Data Portability (GDPR Art. 20): Export your trading history, bot configurations, and profile data in standardized JSON format. • Right to Restrict & Object to Processing (GDPR Art. 18 & 21): Restrict processing under specific statutory circumstances. • Right to Lodge a Complaint: You have the right to file a complaint with your competent supervisory authority (e.g., the European Data Protection Board, UK ICO, or Turkish KVKK Kurumu).

The TradingMaster AI platform and all associated services are strictly restricted to individuals aged eighteen (18) years or older (or the age of legal majority in your jurisdiction). We do not knowingly solicit or collect personal information from minors. Accounts identified as belonging to underage individuals are terminated immediately.

For any inquiries, requests to exercise statutory data rights, or compliance concerns, please contact our legal team: • Data Protection Officer: [email protected] • Privacy Inquiries: [email protected] • Corporate Office: SmartEEDigital Teknoloji A.Ş., Legal & Compliance Division We commit to responding to all verified data requests within thirty (30) calendar days.