Oqiron Privacy Policy

Effective Date: July 26, 2026

Important Notice

This policy explains how the operator of the Oqiron platform (“Oqiron,” “the Platform,” or “we”) collects, uses, stores, shares, and protects personal information when providing website, account, quantitative trading, fund management, and customer support services, as well as how you may exercise your relevant rights.

We adhere to the principles of purpose limitation, data minimization, security, and auditability. We do not sell your personal information, nor do we require you to provide mnemonic phrases or private keys to the general platform backend. Normal access to personal accounts does not require exchange withdrawal permissions.

1. Scope of Application

This Policy applies to the Oqiron website, customer dashboard, registration and login, email verification, exchange API integration, personal and integrated accounts, on-chain deposits and withdrawals, subscriptions, revenue sharing, referral rewards, security audits, and customer support.

Services independently provided by exchanges, blockchain explorers, wallets, stablecoin issuers, and other third parties are subject to their own privacy policies. We will describe necessary data interactions but cannot control data processed independently by third parties.

2. Information We Process

2.1 Registration and Account Information

Name or display name, email address, customer ID, password hash, registration date, and account status;
Email verification records, CAPTCHA results, versions of legal documents to which you have consented, and the date of consent;
Referral codes, first- and second-level referral attributions, and related reward records;
Language, profile picture, preference settings, and customer support content you actively provide.

We do not store email verification codes in plain text, nor do we store login passwords in plain text.

2.2 Security and Device Information

IP addresses or their anonymized/hashed versions, browser and device categories, User-Agent, and login and operation times;
Records of failed logins, password changes, device changes, anomalous behavior, rate limiting, and security incidents;
CAPTCHA verification results returned by Cloudflare Turnstile and necessary technical parameters.

2.3 Exchange and Trading Information

Exchanges you have authorized access to, account identifiers, API permission verification results, and encrypted API credentials;
Account balances, positions, orders, trades, fees, funding rates, exchange transaction logs, and reconciliation results;
Records of bots, strategies, risk parameters, operational status, user intervention, and order lifecycle;
Errors, limits, API status, and necessary audit evidence returned by the exchange.

Personal account API credentials are used exclusively for the accounts you have authorized. The platform will not display full private keys in the frontend, backend, logs, or emails. Normal integration does not require withdrawal permissions.

2.4 Funds, Ledger, and Blockchain Information

Deposit and withdrawal addresses, chains, token contracts, transaction hashes, amounts, block confirmations, and on-chain events;
Customer-specific integrated deposit addresses, derived IDs, and read-only address ownership information;
Subscription orders, payments, refunds, service wallets, integrated account ledgers, fund batches, and reconciliation records;
Realized P&L, revenue-sharing statements, reward wallets, referral rewards, and withdrawal audit records;
Abnormal deposits, wrong chain or wrong coin, freezes, rescan requests, manual reviews, and audit records.

Addresses and transactions on the blockchain are typically public, irreversible, and may be permanently stored by third parties. We cannot delete records on public blockchains.

2.5 Communication and Support Information

Emails, support tickets, attachments, complaints, feedback, and survey results you send to customer service;
Delivery status of verification codes, security alerts, billing notifications, service updates, and essential business notifications sent to you by the system;
Bounced emails, complaints, unsubscriptions, and email delivery events.

2.6 Automatically Collected Usage Information

Page visits, feature usage, request times, API status, error logs, and performance metrics;
Local tokens, necessary cookies, or browser storage stored to maintain login status and security features;
Public market data, on-chain data, and sentiment analysis information. Public market data not associated with identifiable customers generally does not constitute personal information.

3. Sources of Information

We may obtain information from the following sources:

Information you directly provide during registration, setup, trading, fund deposits, withdrawals, and customer service interactions;
Exchanges, wallets, or other account services you have authorized;
Public blockchains, nodes, blockchain explorers, and public market data sources;
Cloudflare, Brevo, hosting providers, and other service providers that offer security or communication capabilities to the platform;
Risk information sources used in accordance with the law to prevent fraud, sanctions evasion, or security attacks;
Public sources permitted by law or authorized authorities.

4. Purposes and Legal Basis for Processing

We process necessary information for the following purposes:

To create and manage accounts, complete email verification, logins, and identity verification;
To fulfill the Terms of Service and provide trading, order processing, risk control, ledger management, subscriptions, revenue sharing, rewards, fund deposits, and withdrawals;
To protect accounts, detect fraud and attacks, enforce rate limits, investigate security incidents, and maintain audit records;
To reconcile exchange, on-chain, and internal ledger records to prevent duplicate entries, cross-account transfers, or unauthorized fund transactions;
To send verification codes, security alerts, statements, service changes, and other necessary business notifications;
Respond to inquiries, handle complaints, and resolve disputes;
Improve reliability, performance, availability, and risk control, without conducting irrelevant analyses using unnecessary personal information;
Comply with sanctions, anti-money laundering, tax, record-keeping, court orders, and other applicable legal obligations;
Send marketing or promotional information after obtaining consent as required by applicable law.

Under applicable law, the legal basis for processing may include the performance of a contract, taking steps prior to entering into a contract, compliance with legal obligations, the protection of your or another person’s vital interests, the legitimate interests of the Platform or a third party, and your consent. Where consent is the legal basis, you may withdraw your consent; however, such withdrawal does not affect the lawfulness of processing carried out prior to withdrawal, nor does it affect processing necessary for the performance of a contract or compliance with a legal obligation.

5. Automated Processing

The Platform uses rules, algorithms, and models for strategy selection, risk scoring, order execution, rate limiting, anomaly detection, and service access control. These automated processes may affect whether a trade is executed, whether an account can run a bot, or whether a particular action requires manual review.

Algorithmic trading itself may have significant financial implications. You may choose not to activate or to discontinue related services, and you may consult customer service regarding specific account details. For decisions involving account freezes, terminations, major funding disputes, or cases where applicable law requires manual review, the Platform will provide reasonable channels for appeal or review.

6. Information Sharing and Service Providers

We share information only to the extent necessary:

Sharing order and account requests with exchanges you have authorized;
Interacting with blockchain networks, nodes, wallets, or custodial components to generate addresses, monitor transactions, and process funds;
Using Cloudflare Turnstile for human-machine verification and security protection;
Using Brevo to send verification codes and necessary notifications, and to handle delivery, bounce notifications, and complaints;
Using hosting, database, network, monitoring, auditing, and customer support service providers to operate the platform;
Sharing information with professional advisors, auditors, insurers, or dispute resolution personnel on a confidential and necessary basis;
Provide information in response to valid requests from legal, judicial, regulatory, or law enforcement authorities;
Investigate fraud, security breaches, or illegal activities to protect the legitimate rights and interests of customers, the platform, or third parties;
Share necessary information in the event of a reorganization, merger, financing, or asset transfer, provided that the recipient continues to comply with applicable data protection obligations.

We do not sell personal information, nor do we share your trading account, API credentials, or fund data for the purpose of third-party targeted advertising.

7. Cross-Border Processing

Exchanges, blockchain nodes, email systems, security authentication, and hosting services may be located in different countries or regions; therefore, information may be processed outside your country of residence. We will implement contractual measures, access controls, encryption, data minimization, or other reasonable safeguards in accordance with applicable laws.

Digital asset trading and public blockchains are inherently cross-border in nature. If necessary cross-border processing is prohibited in your region, certain services may not be available.

8. Retention Periods

We do not retain all information indefinitely but determine retention periods based on purpose, risk, and legal requirements:

Verification codes for incomplete registrations are typically deactivated after 24 hours and subject to cleanup; the verification codes themselves are valid only for a short period and are not stored in plain text;
Account information is retained for the duration of the account’s validity; after closure, it is retained for as long as necessary to address disputes and fulfill financial, tax, security, and legal obligations;
API credentials are retained until you revoke authorization, the account is terminated, or the platform no longer requires them, except where audit evidence must be retained as required by law;
Records of orders, trades, funds, ledgers, settlements, revenue sharing, rewards, consents, and audits may be retained long-term for financial, anti-fraud, dispute resolution, and legal compliance purposes;
Customer service records are retained for the period necessary to resolve issues, conduct quality audits, and handle disputes;
Security logs are retained based on risk levels and legal requirements, with access restricted;
Public blockchain records are not controlled by the Platform and may exist permanently.

Upon expiration of the retention period, we will delete, anonymize, or isolate the information, unless continued retention is required by law.

9. Cookies, Local Storage, and Similar Technologies

The Platform may use strictly necessary cookies or browser storage to preserve login status, language, theme, security status, and session information. Cloudflare Turnstile may use necessary technologies to distinguish human from bot behavior and prevent abuse.

Non-essential analytics or marketing technologies will only be enabled if permitted by applicable law or after obtaining the required consent. You may clear local data through your browser settings, but this may result in being logged out or certain features becoming unavailable.

10. Information Security

We implement measures commensurate with the sensitivity of the data and the risks associated with our services, including transmission protection, password hashing, credential encryption, permission isolation, least privilege, rate limiting, human-machine verification, log auditing, database constraints, backups, and incident response.

Exchange API keys, wallet keys, and other highly sensitive credentials are managed within a separate security perimeter. These secrets must not be displayed on regular web pages, in logs, or in emails. No internet or digital asset system can guarantee absolute security, and you must also protect your email, devices, passwords, and exchange accounts.

In the event of a security incident that may affect your rights and interests, we will investigate, mitigate the impact, and notify affected individuals and relevant authorities through reasonable channels in accordance with applicable laws.

11. Your Rights

Under applicable laws, you may have the right to:

Know whether we process your information and obtain a copy of it;
Correct inaccurate or incomplete information;
Request the deletion of information that is no longer needed and for which there is no legal basis to continue retaining it;
Restrict or object to specific processing;
Obtain data in a portable format;
Withdraw consent or opt out of marketing communications;
Request an explanation, review, or object to specific automated decisions;
File a complaint with a competent data protection, consumer protection, or other authority.

These rights are not absolute. Public blockchain records, transactions and ledgers retained as required by law, anti-fraud records, legal requests, and the rights of others may limit the ability to delete or modify information. To protect your account, we will verify your identity before processing your request.

You may submit a request via support@oqiron.com. We will respond within the timeframe required by applicable law or within a reasonable period.

12. Marketing Communications

Verification codes, security alerts, billing statements, transaction notifications, and essential service notifications are not considered marketing emails; opting out of marketing emails will not stop these essential notifications.

Marketing or promotional emails must provide a clear opt-out method. You may stop receiving marketing communications by clicking the opt-out link in the email or by contacting customer service. The platform may not use opt-out as a reason to withhold essential account notifications.

13. Minors

The Service is not intended for individuals who have not reached the legal age for transactions in their jurisdiction or who lack full legal capacity. We do not knowingly or intentionally collect personal information from children. Upon discovering an account that does not meet the age requirements, the Platform may suspend the Service and handle the relevant information and outstanding matters in accordance with the law.

14. Policy Updates

We may update this Policy due to changes in laws, products, service providers, or data processing methods. Significant changes will be reasonably notified via the platform, your account, or your registered email address, and will specify the new version and effective date. When applicable laws require renewed consent, we will obtain your confirmation before proceeding with the relevant processing.

15. Contact Us

For inquiries regarding privacy, data rights, security, or complaints, please contact: support@oqiron.com.