Privacy policy

Velynt Ltd is the data controller for personal data collected through velynt.co.uk and the Velynt agents. This policy explains what we collect, why, how long we keep it and your rights under the UK GDPR and the Data Protection Act 2018. Contact: privacy@velynt.co.uk.

What we collect and why

Account data

Email address, password hash, name if you give one, and the date you accepted the terms. Lawful basis: performance of a contract. Kept while your account exists and for 12 months after closure for dispute and fraud purposes.

Billing data

Handled by Stripe. We receive the last four digits of your card, its expiry, your billing country and invoices; we never see the full card number. Lawful basis: contract and legal obligation (tax records, kept 6 years).

Licence and device data

A fingerprint of each device running an agent (operating system, a hashed machine identifier), licence tokens issued and the times signals were requested. Lawful basis: contract and legitimate interest in preventing licence sharing. Kept for the life of the subscription plus 90 days.

Trade results (optional)

If you switch on “send my agent's trade results” in the dashboard, the agent sends the symbol, direction, size, prices, times, profit and loss and exit reason of each trade it places, and your broker's name. It never sends your login, balance or manually placed trades. Lawful basis: consent, which you can withdraw at any time in the dashboard. Used to show your dashboard and, in anonymised form, to measure execution quality across brokers. Deleted within 30 days of withdrawal or on request.

Waitlist

Email address and the time you consented. Lawful basis: consent. Deleted when you unsubscribe or 12 months after the last email.

Site usage

Essential cookies for sign-in and your cookie choice. Analytics only if you allow them in the banner; they record pages viewed and a rough location, not your identity. Server logs hold IP addresses for 30 days for security.

Who we share data with

Processors acting on our instructions: Supabase (database and authentication, UK or EU region), Stripe (payments), Netlify (hosting), Anthropic (only if you choose a Velynt-metered API key; the content of requests comes from the agent, not from your personal data), and our email provider for transactional email. We do not sell personal data and we do not share it with advertisers. We disclose data where the law requires.

International transfers

Some processors operate outside the UK. Transfers rely on the UK International Data Transfer Agreement or adequacy regulations.

Your rights

• Access, correct, delete or export your data: from the dashboard or by email.
• Withdraw consent at any time without affecting earlier processing.
• Object to processing based on legitimate interest.
• Complain to the Information Commissioner's Office at ico.org.uk if you are unhappy with how we handle your data.

Security

Data is encrypted in transit and at rest, access is limited by role, and each user's rows are isolated by database policy. No system is perfectly secure; if a breach affects you we will tell you and the ICO as the law requires.

Children

The Service is for adults. We do not knowingly collect data from anyone under 18.