1. Data Controller

The data controller responsible for your personal data is:

• Company: ARVO P.C.
• Location: Greece
• Email: info@queyn.com

2. What Data We Collect

2.1 Account Information

When you register for an account, we collect:

• Username: Your chosen username for the platform
• Email address: For account verification, notifications, and communication
• Password: Stored as a cryptographic hash (we never store plain-text passwords)
• Account creation date: When you registered

2.2 Google OAuth Data

If you sign in with Google, we receive:

• Your Google email address
• Your Google profile name
• Google user ID (for authentication purposes)

We do NOT receive your Google password or access to your Google account beyond the information listed above.

2.3 Usage Data

We automatically collect information about how you use the Platform:

• Scenario configurations: Your saved market scenarios and parameters
• Strategy settings: Balance, leverage, and commission configurations
• Bot API usage: API key names, connection logs, and usage statistics
• Session data: Login times, session duration, and activity logs

2.4 Technical Data

We collect technical information for platform functionality and security:

• IP address: Temporarily used for rate limiting and security monitoring. Not permanently stored in our database.
• Browser type and version: For compatibility
• Device information: Operating system and device type
• Connection data: WebSocket connection logs and timestamps

2.5 Cookies and Similar Technologies

We use cookies and similar technologies:

• Authentication cookies (httpOnly): To keep you logged in securely
• Session cookies: To maintain your preferences during a session
• Local storage: To store your unsaved scenarios temporarily (browser-side only)

3. How We Use Your Data

3.1 Essential Platform Services

Legal basis: Contract performance (GDPR Article 6(1)(b))

• Create and manage your account
• Authenticate you when you log in
• Store and retrieve your saved scenarios
• Generate and manage Bot API keys
• Stream real-time data through WebSocket connections
• Process your scenario configurations and strategy settings

3.2 Communication

Legal basis: Contract performance and legitimate interests (GDPR Article 6(1)(b)(f))

• Send account verification emails
• Notify you of important platform updates or changes
• Respond to your support requests and inquiries
• Send service-related notifications (e.g., API key revocation, account security alerts)

3.3 Platform Improvement

Legal basis: Legitimate interests (GDPR Article 6(1)(f))

• Analyze usage patterns to improve features
• Monitor API usage to optimize performance
• Identify and fix technical issues
• Develop new features based on user needs

3.4 Security and Fraud Prevention

Legal basis: Legitimate interests (GDPR Article 6(1)(f))

• Detect and prevent unauthorized access
• Identify suspicious activity or abuse
• Protect against security threats and attacks
• Enforce our Terms of Service

3.5 Legal Compliance

Legal basis: Legal obligation (GDPR Article 6(1)(c))

• Comply with applicable laws and regulations
• Respond to lawful requests from authorities
• Protect our legal rights and interests

4. Data Sharing and Disclosure

4.1 We Do NOT Sell Your Data

Queyn does not sell, rent, or trade your personal data to third parties for marketing purposes.

4.2 Service Providers

We share data with trusted service providers who help us operate the Platform:

Service Provider	Purpose	Data Shared
Supabase	Database hosting and user authentication	Account data, scenarios, strategy configurations
Render	Backend server hosting	All data processed through the platform
Netlify	Frontend application hosting	Connection logs, IP addresses
Google OAuth	Optional authentication service	Google user ID, email, profile name
Resend	Transactional emails and account verification	Email address, username, verification tokens
Stripe	Pro subscription payments	Email address, payment information

All service providers are required to protect your data and use it only for the specified purposes.

4.3 Legal Requirements

We may disclose your data if required by law or in response to:

• Valid legal processes (court orders, subpoenas)
• Government requests or regulatory requirements
• Protection of our rights, property, or safety
• Emergency situations involving danger to persons

4.4 Business Transfers

If ARVO P.C. is acquired, merged, or restructured, your data may be transferred to the new entity. You will be notified of any such change.

5. International Data Transfers

ARVO P.C. is based in Greece (European Union). Your data is primarily stored and processed within the EU/EEA.

If we transfer data outside the EU/EEA, we ensure adequate protection through:

• Standard Contractual Clauses (SCCs): EU-approved data transfer agreements
• Adequacy decisions: Transfers to countries with adequate data protection
• Appropriate safeguards: Technical and organizational security measures

6. Data Retention

6.1 Active Accounts

We retain your data for as long as your account is active and you continue to use the Platform.

6.2 Inactive Accounts

If you do not log in for 12 consecutive months, your account may be considered inactive. We will send you a notification before deleting your data.

6.3 Deleted Accounts

When you delete your account (or we delete it after inactivity):

• Personal data is permanently deleted within 30 days
• Some data may be retained in backup systems for up to 90 days
• Anonymized usage statistics may be retained indefinitely

6.4 Legal Retention

We may retain certain data longer if required by law (e.g., tax records, legal disputes).

7. Your Rights (GDPR)

Under the General Data Protection Regulation (GDPR), you have the following rights:

7.1 Right of Access (Article 15)

You can request a copy of all personal data we hold about you. We will provide this within 30 days.

7.2 Right to Rectification (Article 16)

You can update or correct inaccurate data through your account settings or by contacting us.

7.3 Right to Erasure / "Right to be Forgotten" (Article 17)

You can request deletion of your account and personal data at any time. We will comply within 30 days unless we have legal obligations to retain certain data.

7.4 Right to Restriction of Processing (Article 18)

You can request that we limit how we process your data in certain circumstances (e.g., while disputing data accuracy).

7.5 Right to Data Portability (Article 20)

You can request your data in a machine-readable format (JSON or CSV) to transfer to another service.

7.6 Right to Object (Article 21)

You can object to processing of your data based on legitimate interests. We will stop processing unless we have compelling legal grounds.

7.7 Right to Withdraw Consent

Where we process data based on your consent, you can withdraw consent at any time.

7.8 Right to Lodge a Complaint

You have the right to lodge a complaint with a supervisory authority:

• Greece: Hellenic Data Protection Authority (HDPA)
• Website: www.dpa.gr

8. Data Security

We implement industry-standard security measures to protect your data:

8.1 Technical Measures

• Encryption: HTTPS/TLS for all data in transit
• Secure WebSockets (WSS): Encrypted real-time data streaming
• Password hashing: Bcrypt with salt for password storage
• httpOnly cookies: Protection against XSS attacks
• Secure authentication: Token-based authentication with expiration

8.2 Organizational Measures

• Access controls limiting who can access data
• Regular security audits and vulnerability assessments
• Employee training on data protection
• Incident response procedures

8.3 Data Breach Notification

In the event of a data breach affecting your personal data, we will:

• Notify you within 72 hours of discovering the breach
• Inform relevant supervisory authorities as required by law
• Provide details about the breach and steps taken to mitigate it
• Offer guidance on protecting yourself from potential harm

9. Children's Privacy

ARVO P.C.'s Queyn platform is not intended for users under the age of 18 years. We do not knowingly collect personal data from children.

If we discover that we have collected data from a child under 18:

• We will delete the account and all associated data immediately
• We will notify the account holder (if possible) before deletion

If you believe a child has created an account, please contact us at info@queyn.com.

10. Third-Party Links

The Platform may contain links to external websites or services (e.g., documentation, educational resources). This Privacy Policy does not apply to third-party sites.

We are not responsible for the privacy practices of external sites. Please review their privacy policies before providing any personal data.

11. Do Not Track (DNT)

Some browsers support "Do Not Track" (DNT) signals. We do not currently respond to DNT signals because there is no industry standard for how to interpret them.

12. Changes to This Privacy Policy

• We may update this Privacy Policy from time to time
• Material changes will be notified via email or prominent notice on the Platform
• The "Last Updated" date at the top reflects the most recent changes
• Continued use of the Platform after changes constitutes acceptance

13. Your Choices and Controls

13.1 Account Settings

You can manage your data through your account settings:

• Update your username or email address
• Change your password
• Manage Bot API keys
• Delete saved scenarios

13.2 Email Preferences

You can opt out of non-essential emails by:

• Clicking "unsubscribe" in any marketing email
• Contacting us at info@queyn.com

Note: You cannot opt out of essential service emails (e.g., account verification, security alerts).

13.3 Cookie Management

You can control cookies through your browser settings:

• Block all cookies: The Platform will not function properly
• Delete cookies: You will be logged out and lose preferences
• Allow essential cookies only: Recommended for basic functionality

13.4 Data Export

You can export your data at any time:

• Scenario data: Export as CSV or JSON from the Platform
• Account data: Request a full data export by contacting us

13.5 Account Deletion

To delete your account:

1. Log in to your account
2. Go to Settings → Account Settings
3. Click "Delete Account"
4. Confirm deletion

Alternatively, email us at info@queyn.com with your deletion request.

14. Contact Information

14.1 Data Protection Inquiries

For questions about this Privacy Policy or your data:

• Email: info@queyn.com
• Subject line: "Privacy Inquiry" or "GDPR Request"

14.2 Response Time

We aim to respond to all privacy inquiries within:

• General questions: 5 business days
• GDPR requests: 30 days (as required by law)
• Urgent security matters: 24-48 hours