隐私政策
最后更新：2026年11月8日
本文件仅提供英文版本。以英文版本为准。
This Privacy Policy explains how The Select Trader Limited, a company registered in Dubai, United Arab Emirates, with registration number [REGISTRATION NUMBER] and registered address at [REGISTERED ADDRESS] ("TSTrader", "we", "us" or "our"), collects, uses, shares and protects your personal data when you use the TSTrader website at tstrader.io, the TSTrader client area and our related services (together, the "Platform").
We are the controller of your personal data. This Policy should be read together with our Terms and Conditions.
1. Summary
- We collect the information needed to run your account, your wallet and your events, to keep the Platform fair and secure, and to meet our legal duties.
- We ask for identity documents only when they are needed: before your first withdrawal, when your deposits reach US$10,000, or when the law or a security concern requires it.
- Your username, profile picture and event results are public. Your real name, email address, phone number, identity documents and wallet balance are never shown publicly.
- We do not sell your personal data.
- We use the cookies needed to run the Platform. Analytics cookies (to count visits) and marketing cookies (to credit the affiliate whose link you followed) are used only if you allow them in our cookie banner, and you can change your choice at any time. We do not use advertising cookies (Section 12).
- We keep personal data only for set periods, then delete it or make it anonymous (Section 9).
- You have rights over your data, including access, correction and deletion. You can download your data and close your account yourself in Settings › Privacy and data (Section 11).
2. Who this Policy applies to
This Policy applies to visitors to our website, registered traders, event participants and spectators, Pro members, affiliates, newsletter subscribers, people who apply for a job or partnership with us, and anyone who contacts us.
It does not apply to third-party websites or services that we link to, such as cryptocurrency wallets, exchanges or blockchain explorers. Those have their own privacy policies.
3. Personal data we collect
3.1 Information you give us
| Category | Examples | When |
|---|---|---|
| Account information | First and last name, username, email address, phone number, password (stored only in a securely hashed form that we cannot read) | When you sign up |
| Profile picture | A photo you choose to upload (we keep a small square copy), or the trading avatar you pick. Without one, we show the first letter of your username | If you add one in Settings |
| Verification codes | One-time codes sent to your email address (stored only in a hashed form) | When you confirm your email or reset your password |
| Identity verification (KYC) information | Date of birth, nationality, address, photo identity document, proof of address, live photo or video check, and source-of-funds information | Before your first withdrawal, when deposits reach US$10,000, or when required |
| Wallet and payment information | Deposit and withdrawal amounts, cryptocurrency type and network, wallet addresses, blockchain transaction references, and exchange rates applied | When you deposit or withdraw |
| Event information | Events entered, entry and service fees paid, rewards, results, rankings, certificates | When you take part in events |
| Membership information | Pro plan, trial and renewal dates, payments | When you subscribe |
| Affiliate information | Referral link, referred users, referral reward records, payout details | If you join the affiliate programme |
| Job and partner applications | Name, email address, phone number, the role and location, the links you share (such as LinkedIn or your channel), your audience details, your message and your CV | When you apply on our careers pages |
| Communications | Messages to support, contact form messages (name, email address and message), complaints, and newsletter subscriptions | When you contact us or subscribe |
| Responsible participation settings | Deposit limits, cooling-off periods and self-exclusions | When you set them |
3.2 Information collected automatically
| Category | Examples |
|---|---|
| Trading activity on event accounts | Orders, positions, prices, balance, Equity, profit and loss, and timestamps on your simulated event accounts on our MT5 server |
| Login and security data | IP address, browser and device type (user agent), login times, session records and security events |
| Records of your agreement | Which version of the Terms and Conditions and this Policy you accepted, and your confirmation that Pro membership renews automatically (with the plan and price shown), each with the date, time, IP address and browser |
| Website visit statistics (only with your consent) | Pages visited, the website or link that brought you, campaign tags, device type, browser, operating system and country. We use a random visitor number, not your name, and we do not store your IP address with these statistics. If you sign up, where you first came from is kept with your account |
| Technical data | Server logs, error reports, and pages requested, kept to operate and secure the Platform |
3.3 Information from third parties
- Payment processor: confirmation, amount and status of your cryptocurrency deposits and withdrawals.
- Identity verification provider: the result of your identity checks and the data extracted from your documents.
- Screening services: results of sanctions, politically exposed person (PEP) and fraud checks.
- Affiliates: the fact that you signed up through an affiliate's referral link.
- Bot protection (Cloudflare Turnstile): the result of the check that tells people from automated programs on our sign-up, contact and newsletter forms.
4. How we use your personal data, and our legal basis
We only use your personal data where the law allows it. The legal bases we rely on are: performing our contract with you, meeting our legal obligations, our legitimate interests (where these are not overridden by your rights), and your consent.
| Purpose | Legal basis |
|---|---|
| Creating and managing your account, and confirming your email address | Contract |
| Running events: matching you with opponents, creating event accounts, measuring Equity, deciding results and paying rewards | Contract |
| Operating your wallet, processing deposits and withdrawals, and keeping accurate transaction records | Contract; legal obligation |
| Verifying your identity and age, and screening against sanctions and PEP lists | Legal obligation; legitimate interests (preventing fraud) |
| Preventing, detecting and investigating fraud, collusion, multiple accounts, money laundering and other breaches of our Terms | Legal obligation; legitimate interests |
| Keeping the Platform secure, including rate limits, login protection and session management | Legitimate interests |
| Showing public profiles, leaderboards, certificates and live spectating | Contract; legitimate interests |
| Providing Pro membership and the affiliate programme | Contract |
| Answering your messages and complaints | Contract; legitimate interests |
| Considering your job or partner application and contacting you about it | Steps you ask us to take before a contract; legitimate interests (hiring) |
| Sending service messages (for example verification codes, receipts and event results) | Contract |
| Sending our newsletter and marketing updates | Consent (you can unsubscribe at any time) |
| Measuring how the website is used (visit statistics) and crediting affiliates from referral links | Consent (cookie banner; you can change your choice at any time) |
| Keeping a record of your acceptance of our Terms and of Pro automatic renewal | Legal obligation; legitimate interests (being able to show what you agreed to) |
| Applying deposit limits, cooling-off periods and self-exclusion | Contract; legitimate interests (responsible participation) |
| Improving and developing the Platform, using aggregated or de-identified data where possible | Legitimate interests |
| Meeting legal, tax, accounting and regulatory requirements, and responding to lawful requests from authorities | Legal obligation |
5. Public information
Events are public and social. The following information about you can be seen by other users and the public: your username, profile picture or avatar, country flag, event results, rankings, statistics, certificates, and the live performance of your event accounts during and after events (including Equity, profit and loss, and open positions), including through spectating, leaderboards, broadcasts and our social media.
We never show your real name, email address, phone number, date of birth, identity documents, wallet addresses or wallet balance in public.
Smart contract payments. Event entries and rewards paid through our smart contract are recorded on the Base public blockchain. Anyone can see a blockchain transaction, including the wallet addresses and amounts involved. Blockchain records cannot be changed or deleted by us or by anyone else, so the deletion right in Section 11 cannot apply to them. We never publish which TSTrader account a wallet address belongs to.
6. Automated decisions
Some decisions are made by our systems, for example matching you with an opponent, deciding event results from Equity, and flagging unusual activity for review.
Event results follow the published rules and are applied in the same way to every participant. Decisions with a significant effect on you, such as refusing a withdrawal or closing an account for suspected fraud, are always reviewed by a member of our team before they are final. You can ask us to review any automated decision by contacting us under Section 15.
7. Who we share your personal data with
We share personal data only where needed for the purposes in Section 4, and only with recipients bound to protect it.
| Recipient | Why |
|---|---|
| Hosting and infrastructure providers (currently Vercel, for the website, and Railway, for our servers and databases) | Hosting our website, client area, servers and databases |
| Email delivery provider (currently Resend) | Sending verification codes, receipts and service emails |
| Bot protection (currently Cloudflare Turnstile) | Telling people from automated programs on our public forms. Cloudflare receives your IP address and technical information about your browser for this check |
| Cryptocurrency payment processor (currently Confirmo) | Processing deposits and withdrawals |
| Wallet providers (currently Circle, for the built-in wallet, and Reown / WalletConnect, to connect your own wallet) | Creating and connecting the crypto wallet you use with our smart contract. They receive your wallet address and the details needed to create or connect the wallet |
| Identity verification and screening provider | Checking your identity, age, sanctions and PEP status |
| MT5 demo-account provider, and the host of our server that connects to it (currently Oracle Cloud) | Creating and reading the simulated event accounts. They receive the account details needed for the event, not your contact details or documents |
| Professional advisers | Lawyers, auditors and accountants, under confidentiality duties |
| Authorities, courts and regulators | Where the law requires it, or to protect our rights, our users or the public |
| A buyer or successor of our business | If we sell or reorganise our business, under the same protections |
When you sign up through an affiliate's referral link, the affiliate can see your username, the date you joined, whether your first event entry has counted (which makes you a qualified referral), and the one-time reward they earned for you. Affiliates never see your real name, contact details, identity documents or wallet details.
Our service providers (processors) may use your personal data only to provide their service to us, on our written instructions, under data processing terms that require them to keep it confidential and secure, to help us respect your rights, and to delete or return it when the service ends. We keep a list of our current processors and will give it to you on request.
We do not sell your personal data, and we do not share it with third parties for their own marketing.
8. International transfers
We are based in the United Arab Emirates, and some of our service providers process data in other countries, including the United States and the European Union. When we transfer personal data outside the country where it was collected, we take the steps required by applicable law, such as relying on the receiving country's adequate level of protection or using contractual safeguards, so that your data stays protected.
9. How long we keep your personal data
We keep personal data only for as long as we need it for the purposes in Section 4, including to meet legal requirements.
| Data | How long we keep it |
|---|---|
| Account information | For as long as your account is open, then for 5 years after it closes. After that, your name, email address, phone number and other details are deleted or replaced, and what remains (for example your username on past results) no longer identifies you |
| Records of your agreement (Terms, Privacy Policy, Pro automatic renewal) | For as long as your account is open, then for 5 years after it closes |
| Identity verification, wallet and transaction records | 5 years after your account closes or after the transaction, whichever is later, as required by anti-money laundering law |
| Profile picture | Until you remove it or change it (choosing initials deletes the uploaded photo), or your account closes |
| Event records and results | For as long as your account is open, then for 5 years after it closes. Public results may remain shown under your username in historical leaderboards |
| Login and security records | Up to 2 years. Records of logins that have ended are deleted 30 days after they end |
| Verification codes | Deleted 1 day after they are used or expire |
| Copies of emails we sent you, and in-app notifications | 2 years, or until you close your account (except the email that confirms the closing) |
| Website visit statistics (only with your consent) | 13 months |
| Support and contact messages | 3 years after the matter is closed |
| Job and partner applications, including CVs | 12 months after you apply, then deleted. A CV that was uploaded but never sent is deleted after 1 day |
| Newsletter subscription | Until you unsubscribe, then a record of the unsubscription so that we respect it |
| Self-exclusion records | For as long as needed to respect the exclusion, and at least 5 years |
When we no longer need personal data, we delete it or make it anonymous. These limits are applied automatically by our systems every day.
10. How we protect your personal data
We use technical and organisational measures appropriate to the risk, including:
- passwords and verification codes stored only as secure one-way hashes;
- encrypted connections (HTTPS) between your browser and the Platform;
- secure, HttpOnly session cookies, and session records stored as hashes;
- two-step login with an authenticator app for all staff accounts;
- limits on repeated login and code attempts;
- access to personal data limited to staff who need it, with an audit log of staff actions; and
- a double-entry ledger that records every money movement, checked automatically.
No system is completely secure. If a personal data breach is likely to put your rights at risk, we will tell you and the relevant authority as required by law.
11. Your rights
Depending on where you live, you have the right to:
- access the personal data we hold about you and receive a copy;
- correct personal data that is inaccurate or incomplete;
- delete your personal data, where we no longer need it and the law does not require us to keep it;
- restrict or object to our use of your personal data in certain cases, including for direct marketing at any time;
- data portability: receive data you gave us in a structured, commonly used format;
- withdraw consent at any time, where we rely on consent, without affecting earlier use; and
- not be subject to a decision based only on automated processing that significantly affects you, and to ask for a human review.
You can use the most common rights yourself, at any time, in Settings › Privacy and data:
- Download your data: "Download my data" gives you a file (JSON, a structured and commonly used format) with your account details, wallet transactions, Duels, Cups, Pro membership, affiliate records, notifications, login and security history, and every acceptance of our Terms.
- Close your account and delete your data: you confirm with your username and password. We log you out on every device and delete your profile picture, payout address, linked wallets, notifications and copies of emails straight away. Records that the law requires us to keep (identity checks, money and event records, and records of your agreement) are kept for the periods in Section 9 and then deleted or made anonymous. Before closing, your wallet must be empty and your events and payments finished, so that nothing of yours is lost.
- Cookies: "Cookie settings" in the website footer, or in Settings › Privacy and data, lets you change your choice at any time.
- Correct your details: most details can be changed in Settings › Profile Details; for the rest, contact us.
For any other request, or if you cannot log in, email support@tstrader.io from the email address registered to your account. We may need to verify your identity before acting. We will answer within one month, or tell you if we need more time as allowed by law.
Some rights are limited by law. For example, we cannot delete transaction and identity records that anti-money laundering law requires us to keep.
If you are not satisfied with our answer, you can complain to the data protection authority in your country. In the United Arab Emirates, this is the UAE Data Office.
12. Cookies
Cookies are small files that a website stores in your browser. All our cookies are our own (first-party): no other company can read them. When you first visit, our cookie banner asks for your choice. Optional cookies are only set if you allow them, and "Reject optional" is as easy as "Accept all". You can change your choice at any time with "Cookie settings" in the website footer or in Settings › Privacy and data. When you turn a group off, we delete its cookies from your browser.
Strictly necessary (always on). These are needed for the Platform to work and to keep it secure, so the law does not require consent for them.
| Cookie | Purpose | Duration |
|---|---|---|
tst_session |
Keeps you logged in to the client area securely | Up to 30 days, or until you log out |
tst_staff |
Keeps staff logged in to the back office securely (staff only) | Up to 12 hours |
tst_lang |
Remembers the language you chose | Until you close your browser, or 12 months if you opened a link to a page in a chosen language |
tst_consent |
Remembers your cookie choice, so we do not ask again on every page | 12 months |
Analytics (optional, only with your consent). These let us count visits and see which pages and links work, with a random number instead of your name.
| Cookie | Purpose | Duration |
|---|---|---|
tst_vid |
A random visitor number, so a returning visit is not counted as a new visitor | 12 months |
tst_sid |
The current visit | 30 minutes after your last activity |
tst_src |
Where you first came from (link code, campaign tags, referring website, first page) | 90 days |
Marketing (optional, only with your consent).
| Cookie | Purpose | Duration |
|---|---|---|
tst_ref |
Remembers the affiliate code from a referral link you followed, so the affiliate who referred you is credited if you sign up later. Without this cookie, the code is still credited if you sign up during the same visit | 30 days |
Browser storage. We also store a few settings in your browser's local storage, which never leave your device: your light or dark display choice (tst_theme), whether you folded the side menu (tst_sidebar), notices you have closed, and, on test networks only, a test wallet you create. We do not use advertising or social media tracking cookies.
Other services. Our fonts are served from our own website, so no outside font service receives your IP address. Our public forms use Cloudflare Turnstile to block automated programs (Section 7).
13. Children
The Platform is only for people aged 18 and over. We do not knowingly collect personal data from anyone under 18. If we learn that a person under 18 has opened an account, we will close it and delete their personal data, except where the law requires us to keep it. If you believe a child has given us personal data, please contact us.
14. Changes to this Policy
We may update this Policy from time to time. We will show the date of the latest version at the top of this page. For important changes, we will notify you by email or in the client area before they take effect, and we will ask you to accept the new version the next time you log in.
15. Contact us
For any question about this Policy or your personal data, please contact us:
The Select Trader Limited [REGISTERED ADDRESS] Dubai, United Arab Emirates
Email: support@tstrader.io