Privacy Policy

1. Who we are

Tarzan SwingBot ("we", "us") is the responsible party for the personal information processed through this service, in terms of the Protection of Personal Information Act, 2013 (POPIA).

2. Information we collect

• Account information: name, email address, phone number.
• Authentication data: hashed passwords, TOTP secrets, optional passkey credentials.
• Broker API credentials: VALR keys (for crypto trading) and Alpaca keys (for stock trading), encrypted at rest and never returned to your browser.
• Trading configuration: strategy settings, risk limits, asset-class preferences, and per-market rules.
• Operational data: trade history, bot logs, P&L records, order confirmations, and position records for both crypto and stock markets.
• Technical data: IP address, browser, device, timestamps, and error logs.

3. How we use your information

• To operate the automated trading engine on your behalf across the markets you enable.
• To authenticate you and secure your account.
• To communicate service notices, risk alerts, and respond to support requests.
• To comply with legal obligations and enforce our terms.

4. Sharing and sub-processors

We do not sell personal information. We share data only with:

• Infrastructure sub-processors that host the application and database.
• VALR, to execute crypto trades and report balances.
• Alpaca, to execute US stock trades and report balances.
• Authorities where legally required by a competent court or regulator.

Each broker and sub-processor processes data according to its own terms and privacy policies. We recommend reviewing those policies before connecting your accounts.

5. Security

API credentials and authentication secrets are encrypted at rest using AES-256-GCM. Access requires two-factor authentication and optional passkeys. We apply row-level security, least-privilege database access, and separate encryption per environment. We cannot, however, guarantee absolute security, and you are responsible for maintaining the security of your account, devices, and broker credentials.

6. Retention and deletion

We retain personal information for as long as your account is active and as required by applicable law, after which it is deleted or anonymised. You may request deletion of your account and associated trading data by contacting us. Some data may be retained for legal, tax, or fraud-prevention purposes even after account deletion.

7. Your rights

Under POPIA you may access, correct, or delete your personal information, and object to processing. To exercise these rights, contact hello@tarzanswingbot.ai.

8. Cookies

We use only essential cookies required for authentication, session management, and security.

9. Updates

We may update this policy from time to time. Material changes will be notified via the email on file.