Privacy Policy

1. Who we are

GVK DALROTI CLOUD SERVICES AND DATACENTERS PROVIDERS FZCO (DSO IFZA, IFZA Properties, Dubai Silicon Oasis, Dubai, UAE) is the controller of personal data processed through the DalRoti Services. Contact: support@dalroti.ae. We process data in line with applicable UAE law, including Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, and, where they apply to you, other laws such as the EU/UK GDPR.

2. Data we collect

Account data: name, email, phone number, country, password hash, verification and OTP records, two-factor settings.

Broker connection data: broker name, account identifiers, API keys, tokens or credentials you provide (stored encrypted), and positions, orders, balances and trades retrieved from your broker to show them to you and run the features you enable.

Usage and technical data: device, browser, IP address, log and security events, settings, watchlists, strategies, backtests, journal entries, alerts and content you post.

Communications: support messages and notification preferences (email, SMS, WhatsApp, Telegram, push).

Payment data: payments are made on the hosted pages of our payment providers (MamoPay, Telr), which process your card details; we never receive or store full card numbers or security codes. We keep the plan, billing cycle, amounts, payment status, provider references, invoices and, if the provider returns them, the card brand and last four digits. For recurring payments we also keep a record of your authorisation (date, time, IP address, browser, plan, amount, cycle and the text you agreed to) as card-network rules require.

3. Why we use it and our legal bases

To provide and secure the Services (performance of our contract with you); to verify identity, prevent fraud and abuse and keep accounts secure (legitimate interests and legal obligations); to send service messages and alerts you request (contract); to improve and troubleshoot the Services (legitimate interests); to send marketing only where you have agreed (consent, which you may withdraw at any time); and to comply with law and respond to lawful requests (legal obligation).

4. Sharing

With brokers and exchanges you connect, to place orders and read account data on your instructions; with service providers who process data for us under contract, such as cloud hosting and databases, market-data providers, messaging (email, SMS, WhatsApp, Telegram) and push-notification providers, and customer support tools; with mentors or other users only the profile and content you choose to make public; with authorities where required by law; and with a successor in a merger or acquisition. We do not sell personal data.

5. International transfers

Our providers may process data outside the UAE (for example cloud hosting and content-delivery networks such as Cloudflare, messaging providers and, with your consent, analytics). [Placeholder – list of processors and their locations to be confirmed.] Where we transfer data internationally we use appropriate safeguards such as adequacy decisions, contractual clauses and security measures, as required by applicable law.

6. Retention

We keep account data while your account is open and for a limited period afterwards to meet legal, accounting and dispute-resolution needs (typically up to 5 years for records of transactions and security logs, shorter for operational logs). Broker credentials are deleted when you disconnect the broker or close your account.

7. Your rights

Depending on your location you may have the right to access, correct, delete, restrict or object to processing of your personal data, to data portability, and to withdraw consent. Contact support@dalroti.ae; we will respond within the time required by law. You may also complain to the competent data-protection authority.

8. Security

We use encryption in transit and at rest for sensitive data, access controls, OTP and two-factor authentication, monitoring and dedicated infrastructure. No system is perfectly secure; please follow our Security Tips.

9. Cookies and analytics

We use essential cookies and similar storage to run the Services. Only if you choose "Accept all" do we load product analytics (PostHog, including session replay with form inputs masked) to understand how the website is used; the legal basis is your consent, which you can withdraw at any time via "Cookie settings" in the website footer. Chart-load diagnostics (whether a chart opened, load time, device type and app version, linked only to a one-way hashed account identifier) are collected to keep charts working, on the basis of our legitimate interests, and kept for 90 days. See our Cookies Policy.

10. Automated decisions and required data

We do not make decisions that produce legal or similarly significant effects about you solely by automated means. Account data marked as required is needed to open and secure your account; without it we cannot provide the Services. Automated trading features act only on rules you configure.

11. EU/UK representative

[Placeholder – where the EU/UK GDPR applies, details of our EU/UK representative (if required) and the lead supervisory authority will be added here after legal review.]

12. Children

The Services are not intended for anyone under 18 and we do not knowingly collect their data.

13. Changes

We will post updates to this policy with a new date and notify you of material changes.