प्राइवेसी पॉलिसी

This Privacy Policy explains how The Select Trader Limited, a company registered in Dubai, United Arab Emirates, with registration number [REGISTRATION NUMBER] and registered address at [REGISTERED ADDRESS] ("TSTrader", "we", "us" or "our"), collects, uses, shares and protects your personal data when you use the TSTrader website at tstrader.io, the TSTrader client area and our related services (together, the "Platform").

We are the controller of your personal data. This Policy should be read together with our Terms and Conditions.

1. Summary

• We collect the information needed to run your account, your wallet and your events, to keep the Platform fair and secure, and to meet our legal duties.
• We ask for identity documents only when they are needed: before your first withdrawal, when your deposits reach US$10,000, or when the law or a security concern requires it.
• Your username, profile picture and event results are public. Your real name, email address, phone number, identity documents and wallet balance are never shown publicly.
• We do not sell your personal data.
• We use the cookies needed to run the Platform. Analytics cookies (to count visits) and marketing cookies (to credit the affiliate whose link you followed) are used only if you allow them in our cookie banner, and you can change your choice at any time. We do not use advertising cookies (Section 12).
• We keep personal data only for set periods, then delete it or make it anonymous (Section 9).
• You have rights over your data, including access, correction and deletion. You can download your data and close your account yourself in Settings › Privacy and data (Section 11).

2. Who this Policy applies to

This Policy applies to visitors to our website, registered traders, event participants and spectators, Pro members, affiliates, newsletter subscribers, people who apply for a job or partnership with us, and anyone who contacts us.

It does not apply to third-party websites or services that we link to, such as cryptocurrency wallets, exchanges or blockchain explorers. Those have their own privacy policies.

3. Personal data we collect

3.1 Information you give us

Category	Examples	When
Account information	First and last name, username, email address, phone number, password (stored only in a securely hashed form that we cannot read)	When you sign up
Profile picture	A photo you choose to upload (we keep a small square copy), or the trading avatar you pick. Without one, we show the first letter of your username	If you add one in Settings
Verification codes	One-time codes sent to your email address (stored only in a hashed form)	When you confirm your email or reset your password
Identity verification (KYC) information	Date of birth, nationality, address, photo identity document, proof of address, live photo or video check, and source-of-funds information	Before your first withdrawal, when deposits reach US$10,000, or when required
Wallet and payment information	Deposit and withdrawal amounts, cryptocurrency type and network, wallet addresses, blockchain transaction references, and exchange rates applied	When you deposit or withdraw
Event information	Events entered, entry and service fees paid, rewards, results, rankings, certificates	When you take part in events
Membership information	Pro plan, trial and renewal dates, payments	When you subscribe
Affiliate information	Referral link, referred users, referral reward records, payout details	If you join the affiliate programme
Job and partner applications	Name, email address, phone number, the role and location, the links you share (such as LinkedIn or your channel), your audience details, your message and your CV	When you apply on our careers pages
Communications	Messages to support, contact form messages (name, email address and message), complaints, and newsletter subscriptions	When you contact us or subscribe
Responsible participation settings	Deposit limits, cooling-off periods and self-exclusions	When you set them

3.2 Information collected automatically

Category	Examples
Trading activity on event accounts	Orders, positions, prices, balance, Equity, profit and loss, and timestamps on your simulated event accounts on our MT5 server
Login and security data	IP address, browser and device type (user agent), login times, session records and security events
Records of your agreement	Which version of the Terms and Conditions and this Policy you accepted, and your confirmation that Pro membership renews automatically (with the plan and price shown), each with the date, time, IP address and browser
Website visit statistics (only with your consent)	Pages visited, the website or link that brought you, campaign tags, device type, browser, operating system and country. We use a random visitor number, not your name, and we do not store your IP address with these statistics. If you sign up, where you first came from is kept with your account
Technical data	Server logs, error reports, and pages requested, kept to operate and secure the Platform

3.3 Information from third parties

• Payment processor: confirmation, amount and status of your cryptocurrency deposits and withdrawals.
• Identity verification provider: the result of your identity checks and the data extracted from your documents.
• Screening services: results of sanctions, politically exposed person (PEP) and fraud checks.
• Affiliates: the fact that you signed up through an affiliate's referral link.
• Bot protection (Cloudflare Turnstile): the result of the check that tells people from automated programs on our sign-up, contact and newsletter forms.

4. How we use your personal data, and our legal basis

We only use your personal data where the law allows it. The legal bases we rely on are: performing our contract with you, meeting our legal obligations, our legitimate interests (where these are not overridden by your rights), and your consent.

Purpose	Legal basis
Creating and managing your account, and confirming your email address	Contract
Running events: matching you with opponents, creating event accounts, measuring Equity, deciding results and paying rewards	Contract
Operating your wallet, processing deposits and withdrawals, and keeping accurate transaction records	Contract; legal obligation
Verifying your identity and age, and screening against sanctions and PEP lists	Legal obligation; legitimate interests (preventing fraud)
Preventing, detecting and investigating fraud, collusion, multiple accounts, money laundering and other breaches of our Terms	Legal obligation; legitimate interests
Keeping the Platform secure, including rate limits, login protection and session management	Legitimate interests
Showing public profiles, leaderboards, certificates and live spectating	Contract; legitimate interests
Providing Pro membership and the affiliate programme	Contract
Answering your messages and complaints	Contract; legitimate interests
Considering your job or partner application and contacting you about it	Steps you ask us to take before a contract; legitimate interests (hiring)
Sending service messages (for example verification codes, receipts and event results)	Contract
Sending our newsletter and marketing updates	Consent (you can unsubscribe at any time)
Measuring how the website is used (visit statistics) and crediting affiliates from referral links	Consent (cookie banner; you can change your choice at any time)
Keeping a record of your acceptance of our Terms and of Pro automatic renewal	Legal obligation; legitimate interests (being able to show what you agreed to)
Applying deposit limits, cooling-off periods and self-exclusion	Contract; legitimate interests (responsible participation)
Improving and developing the Platform, using aggregated or de-identified data where possible	Legitimate interests
Meeting legal, tax, accounting and regulatory requirements, and responding to lawful requests from authorities	Legal obligation

5. Public information

Events are public and social. The following information about you can be seen by other users and the public: your username, profile picture or avatar, country flag, event results, rankings, statistics, certificates, and the live performance of your event accounts during and after events (including Equity, profit and loss, and open positions), including through spectating, leaderboards, broadcasts and our social media.

We never show your real name, email address, phone number, date of birth, identity documents, wallet addresses or wallet balance in public.

Smart contract payments. Event entries and rewards paid through our smart contract are recorded on the Base public blockchain. Anyone can see a blockchain transaction, including the wallet addresses and amounts involved. Blockchain records cannot be changed or deleted by us or by anyone else, so the deletion right in Section 11 cannot apply to them. We never publish which TSTrader account a wallet address belongs to.

6. Automated decisions

Some decisions are made by our systems, for example matching you with an opponent, deciding event results from Equity, and flagging unusual activity for review.

Event results follow the published rules and are applied in the same way to every participant. Decisions with a significant effect on you, such as refusing a withdrawal or closing an account for suspected fraud, are always reviewed by a member of our team before they are final. You can ask us to review any automated decision by contacting us under Section 15.

7. Who we share your personal data with

We share personal data only where needed for the purposes in Section 4, and only with recipients bound to protect it.

Recipient	Why
Hosting and infrastructure providers (currently Vercel, for the website, and Railway, for our servers and databases)	Hosting our website, client area, servers and databases
Email delivery provider (currently Resend)	Sending verification codes, receipts and service emails
Bot protection (currently Cloudflare Turnstile)	Telling people from automated programs on our public forms. Cloudflare receives your IP address and technical information about your browser for this check
Cryptocurrency payment processor (currently Confirmo)	Processing deposits and withdrawals
Wallet providers (currently Circle, for the built-in wallet, and Reown / WalletConnect, to connect your own wallet)	Creating and connecting the crypto wallet you use with our smart contract. They receive your wallet address and the details needed to create or connect the wallet
Identity verification and screening provider	Checking your identity, age, sanctions and PEP status
MT5 demo-account provider, and the host of our server that connects to it (currently Oracle Cloud)	Creating and reading the simulated event accounts. They receive the account details needed for the event, not your contact details or documents
Professional advisers	Lawyers, auditors and accountants, under confidentiality duties
Authorities, courts and regulators	Where the law requires it, or to protect our rights, our users or the public
A buyer or successor of our business	If we sell or reorganise our business, under the same protections

When you sign up through an affiliate's referral link, the affiliate can see your username, the date you joined, whether your first event entry has counted (which makes you a qualified referral), and the one-time reward they earned for you. Affiliates never see your real name, contact details, identity documents or wallet details.

Our service providers (processors) may use your personal data only to provide their service to us, on our written instructions, under data processing terms that require them to keep it confidential and secure, to help us respect your rights, and to delete or return it when the service ends. We keep a list of our current processors and will give it to you on request.

We do not sell your personal data, and we do not share it with third parties for their own marketing.

8. International transfers

We are based in the United Arab Emirates, and some of our service providers process data in other countries, including the United States and the European Union. When we transfer personal data outside the country where it was collected, we take the steps required by applicable law, such as relying on the receiving country's adequate level of protection or using contractual safeguards, so that your data stays protected.

9. How long we keep your personal data

We keep personal data only for as long as we need it for the purposes in Section 4, including to meet legal requirements.

Data	How long we keep it
Account information	For as long as your account is open, then for 5 years after it closes. After that, your name, email address, phone number and other details are deleted or replaced, and what remains (for example your username on past results) no longer identifies you
Records of your agreement (Terms, Privacy Policy, Pro automatic renewal)	For as long as your account is open, then for 5 years after it closes
Identity verification, wallet and transaction records	5 years after your account closes or after the transaction, whichever is later, as required by anti-money laundering law
Profile picture	Until you remove it or change it (choosing initials deletes the uploaded photo), or your account closes
Event records and results	For as long as your account is open, then for 5 years after it closes. Public results may remain shown under your username in historical leaderboards
Login and security records	Up to 2 years. Records of logins that have ended are deleted 30 days after they end
Verification codes	Deleted 1 day after they are used or expire
Copies of emails we sent you, and in-app notifications	2 years, or until you close your account (except the email that confirms the closing)
Website visit statistics (only with your consent)	13 months
Support and contact messages	3 years after the matter is closed
Job and partner applications, including CVs	12 months after you apply, then deleted. A CV that was uploaded but never sent is deleted after 1 day
Newsletter subscription	Until you unsubscribe, then a record of the unsubscription so that we respect it
Self-exclusion records	For as long as needed to respect the exclusion, and at least 5 years

When we no longer need personal data, we delete it or make it anonymous. These limits are applied automatically by our systems every day.

10. How we protect your personal data

We use technical and organisational measures appropriate to the risk, including:

• passwords and verification codes stored only as secure one-way hashes;
• encrypted connections (HTTPS) between your browser and the Platform;
• secure, HttpOnly session cookies, and session records stored as hashes;
• two-step login with an authenticator app for all staff accounts;
• limits on repeated login and code attempts;
• access to personal data limited to staff who need it, with an audit log of staff actions; and
• a double-entry ledger that records every money movement, checked automatically.

No system is completely secure. If a personal data breach is likely to put your rights at risk, we will tell you and the relevant authority as required by law.

11. Your rights

Depending on where you live, you have the right to:

1. access the personal data we hold about you and receive a copy;
2. correct personal data that is inaccurate or incomplete;
3. delete your personal data, where we no longer need it and the law does not require us to keep it;
4. restrict or object to our use of your personal data in certain cases, including for direct marketing at any time;
5. data portability: receive data you gave us in a structured, commonly used format;
6. withdraw consent at any time, where we rely on consent, without affecting earlier use; and
7. not be subject to a decision based only on automated processing that significantly affects you, and to ask for a human review.

You can use the most common rights yourself, at any time, in Settings › Privacy and data:

• Download your data: "Download my data" gives you a file (JSON, a structured and commonly used format) with your account details, wallet transactions, Duels, Cups, Pro membership, affiliate records, notifications, login and security history, and every acceptance of our Terms.
• Close your account and delete your data: you confirm with your username and password. We log you out on every device and delete your profile picture, payout address, linked wallets, notifications and copies of emails straight away. Records that the law requires us to keep (identity checks, money and event records, and records of your agreement) are kept for the periods in Section 9 and then deleted or made anonymous. Before closing, your wallet must be empty and your events and payments finished, so that nothing of yours is lost.
• Cookies: "Cookie settings" in the website footer, or in Settings › Privacy and data, lets you change your choice at any time.
• Correct your details: most details can be changed in Settings › Profile Details; for the rest, contact us.

For any other request, or if you cannot log in, email support@tstrader.io from the email address registered to your account. We may need to verify your identity before acting. We will answer within one month, or tell you if we need more time as allowed by law.

Some rights are limited by law. For example, we cannot delete transaction and identity records that anti-money laundering law requires us to keep.

If you are not satisfied with our answer, you can complain to the data protection authority in your country. In the United Arab Emirates, this is the UAE Data Office.

12. Cookies

Cookies are small files that a website stores in your browser. All our cookies are our own (first-party): no other company can read them. When you first visit, our cookie banner asks for your choice. Optional cookies are only set if you allow them, and "Reject optional" is as easy as "Accept all". You can change your choice at any time with "Cookie settings" in the website footer or in Settings › Privacy and data. When you turn a group off, we delete its cookies from your browser.

Strictly necessary (always on). These are needed for the Platform to work and to keep it secure, so the law does not require consent for them.

Cookie	Purpose	Duration
tst_session	Keeps you logged in to the client area securely	Up to 30 days, or until you log out
tst_staff	Keeps staff logged in to the back office securely (staff only)	Up to 12 hours
tst_lang	Remembers the language you chose	Until you close your browser, or 12 months if you opened a link to a page in a chosen language
tst_consent	Remembers your cookie choice, so we do not ask again on every page	12 months

Analytics (optional, only with your consent). These let us count visits and see which pages and links work, with a random number instead of your name.

Cookie	Purpose	Duration
tst_vid	A random visitor number, so a returning visit is not counted as a new visitor	12 months
tst_sid	The current visit	30 minutes after your last activity
tst_src	Where you first came from (link code, campaign tags, referring website, first page)	90 days

Marketing (optional, only with your consent).

Cookie	Purpose	Duration
tst_ref	Remembers the affiliate code from a referral link you followed, so the affiliate who referred you is credited if you sign up later. Without this cookie, the code is still credited if you sign up during the same visit	30 days

Browser storage. We also store a few settings in your browser's local storage, which never leave your device: your light or dark display choice (tst_theme), whether you folded the side menu (tst_sidebar), notices you have closed, and, on test networks only, a test wallet you create. We do not use advertising or social media tracking cookies.

Other services. Our fonts are served from our own website, so no outside font service receives your IP address. Our public forms use Cloudflare Turnstile to block automated programs (Section 7).

13. Children

The Platform is only for people aged 18 and over. We do not knowingly collect personal data from anyone under 18. If we learn that a person under 18 has opened an account, we will close it and delete their personal data, except where the law requires us to keep it. If you believe a child has given us personal data, please contact us.

14. Changes to this Policy

We may update this Policy from time to time. We will show the date of the latest version at the top of this page. For important changes, we will notify you by email or in the client area before they take effect, and we will ask you to accept the new version the next time you log in.

15. Contact us

For any question about this Policy or your personal data, please contact us:

The Select Trader Limited [REGISTERED ADDRESS] Dubai, United Arab Emirates

Email: support@tstrader.io