Privacy policy

Who is responsible for your data

The controller is the operator of Bitcoin Fusion AI, at the registered office shown in the footer of every page. The legal entity name and company registration number are not yet published on this site, and no data protection officer has been appointed or named. A privacy notice is required to identify its controller precisely; until those details are published this one does not, and that is a gap we are stating rather than obscuring. Reach us through the contact page.

What we collect

Only what the service needs in order to work:

• Identity and contact data — your name, email address and mobile number, given when you register.
• Verification data — identity documents and related records, where identity or source-of-funds checks apply.
• Financial data — deposits, withdrawals, billing records and the trades your strategies produce.
• Product data — the strategies and risk limits you configure, and what the platform did in response.
• Technical data — IP address, device and browser type, and timestamped logs of access to your account.
• Marketing data — your consent choices, where you have given any.

Why we use it, and on what legal basis

Each purpose has its own basis, and they are not interchangeable:

• To run your account and execute what you configure — performance of our contract with you. Without this data there is no service to provide.
• To verify identity and prevent financial crime — compliance with a legal obligation.
• To keep the service secure and to investigate abuse — our legitimate interest in protecting the platform and its users, balanced against your rights.
• To answer your support requests — performance of our contract, or our legitimate interest in responding to you.
• Analytics about how the site is used — your consent, given through the cookie banner and withdrawable at any time.
• Marketing messages — your consent alone. We do not send them otherwise.

Whether you have to give it

Providing your name, email and mobile number is a condition of opening an account: without them we cannot create one. Providing verification data is a legal requirement for live trading, and we cannot lawfully proceed without it. Everything else — analytics, marketing — is optional, and declining costs you nothing but the feature itself.

Credentials and device records

Passwords are stored hashed and are not recoverable by us; second-factor secrets are encrypted at rest. Withdrawal destinations and device history are retained so unauthorised access can be detected and so you can review your own sessions. None of this is shared with third parties for their own purposes.

Automated processing

The platform executes trades automatically against conditions you set. That is automated processing of your instructions, and it is the product — but it is not a decision about you: it does not evaluate you, score you, or determine anything that affects your rights. We do not carry out automated decision-making producing legal or similarly significant effects concerning you, and we do not profile you for that purpose. Identity and fraud checks may use automated screening, and where such a check leads to a refusal you can ask for it to be reviewed by a person.

Who else sees it

Processors acting on our instructions and under contract — infrastructure hosting, payment processing, identity verification, email delivery, analytics and support tooling — together with the trading venues necessary to execute your orders, and regulators, auditors or law enforcement where we are legally required to disclose. We do not sell personal data, and we do not share it for anyone else’s marketing.

Processing outside your country

Some of those processors operate outside the UK and the European Economic Area. Where data is transferred out, it is done under an adequacy decision or under standard contractual clauses with additional safeguards where they are needed. You can ask us which safeguard applies to a given transfer.

How long we keep it

Account, transaction and verification records are kept for the life of the account and then for as long afterwards as tax, accounting and anti-money-laundering law requires — typically five to seven years, and that obligation outlasts your closing the account. Support correspondence is kept for two years. Technical logs are kept for twelve months. Data from an account that never left demo is deleted shortly after closure.

Your rights

Depending on where you live, you may ask us to:

• give you a copy of the data we hold about you;
• correct it where it is wrong or incomplete;
• delete it, where we have no overriding legal reason to keep it;
• restrict how we use it while a dispute about it is resolved;
• provide it in a portable, machine-readable form, or send it to someone else;
• stop processing that relies on our legitimate interests, including any direct marketing, which we will always stop on request.

Withdrawing consent

Where we rely on your consent — analytics cookies and marketing — you can withdraw it at any time, and it is as easy to withdraw as it was to give. Declining or withdrawing analytics consent clears the cookies it set. Withdrawal does not affect the lawfulness of what was done while the consent stood.

Complaining to a regulator

If you think we have handled your data wrongly, tell us first and we will try to put it right. You also have the right to complain directly to the data protection authority in the country where you live, where you work, or where the problem happened — you do not need our agreement to do so, and doing so does not affect any other right you have.

Cookies

The site sets no analytics or advertising cookie unless you accept one. Nothing is requested from an analytics provider until you choose, and the fonts and other assets the pages need are served from this site rather than a third party, so no request reaches anyone else before you have decided. Strictly necessary cookies — the ones that make a form submission or a session work — are set without consent because the service cannot function without them.

Keeping it safe

Access to production data is restricted to the people who need it, transport is encrypted, credentials are hashed and secrets encrypted at rest. No system is perfectly secure, and we do not claim otherwise. Where a breach is likely to result in a risk to your rights, we will notify the supervisory authority and, where the risk is high, you.

Changes, and how to reach us

We may update this notice. A revised version will be posted here with a new effective date, and where a change materially affects you we will tell you rather than relying on you to notice. Any question, request or complaint about your data should go through the contact page, and we will respond within one month.