Privacy Policy
We take privacy as seriously as the people whose data we handle do. This policy is written in plain English, with the GDPR as its backbone. Last updated: 23 October 2026.
1. Who is responsible for your data
The data controller is OcuBit AI (contact: [email protected]). Our DPO is reachable at the same address with subject “DPO”.
2. What we collect, and why
2.1 When you browse the public site
- Technical logs: IP (truncated after 7 days), browser user-agent, pages visited, timestamp. Why: security, abuse detection, aggregated analytics.
- Essential cookies: session identifier and CSRF token.
- Analytics cookies (opt-in): a privacy-preserving event counter. See Cookie Policy.
2.2 When you fill in the contact form
- Your name, email, message, optional phone, topic, timestamp.
Why: so a human can reply. Legal basis: your consent and legitimate interest. We retain the submission for 24 months.
2.3 When you open an OcuBit account
- Account details, broker verification data, platform usage (watchlists, risk settings).
Platform data stays encrypted at rest and is never used to train identifying models.
3. What we never do
- Sell your personal data to advertisers, data brokers or affiliates.
- Share your trading behaviour outside the regulated execution chain.
- Use your identity data to train a model that could identify you.
- Add your email to marketing without separate opt-in.
4. Where your data lives
In Frankfurt, Germany, inside the EEA. Backups encrypted and in the same jurisdiction. No transfers outside the EEA except where strictly necessary for your chosen broker (under SCCs).
5. How long we keep it
| Type | Retention |
|---|---|
| Website technical logs | 7 days (IP truncated), 30 days aggregated |
| Contact form submissions | 24 months |
| Account data (active) | Lifetime of the account |
| Account data (closed) | 30 days, then anonymised. Legal/tax: 7 years per statute. |
| Model telemetry | 12 months, pseudonymised |
6. Your rights
Access, correct, erase, restrict, object, port, withdraw consent, lodge a complaint with your supervisory authority (EU national regulator, UK ICO, Canada OPC). Email [email protected]. Acknowledged in 72 hours, completed in 30 days.
7. Automated decision-making
The engine makes recommendations about market behaviour, not legal or significant decisions about you. Any trade is executed only on your action or your pre-committed rules.
8. Children
OcuBit AI is not directed at anyone under 18.
9. Security
TLS 1.3 in transit, AES-256 at rest. Passwords stored as salted Argon2id hashes. Internal access on need-to-know basis, logged, audited quarterly. Security.txt at /.well-known/security.txt.
10. Changes
Material changes get at least 30 days notice to active users by email.