Privacy Policy
Version 2026-05-19 · Effective May 19, 2026
This Privacy Policy explains what personal data Smartbull ("we", "us") processes when you use our Software, why we process it, and what rights you have under the GDPR (EU/EEA/UK) and CCPA/CPRA (California).
1. Data we collect
Account & auth
Email, wallet address, Telegram chat_id
Technical
IP, user-agent, device metadata, timestamps
Trading data
Balances, orders, fills, PnL via your API keys
Telemetry
Request latency, error counts, feature usage (90d)
Billing
On-chain tx hashes — no card numbers stored
2. Data we do NOT collect
3. Why we process data (GDPR Art. 6)
4. Sub-processors
We share data only with vetted sub-processors, each under a Data Processing Agreement:
| Provider | Purpose | Region |
|---|---|---|
| Supabase | Postgres, auth, storage | EU |
| Cloudflare | Edge compute, CDN, DDoS | Global |
| Upstash | Redis cache, rate-limiting | EU |
| ClickHouse Cloud | Analytics & traces | EU |
| Telegram | Notifications (opt-in) | Global |
| Exchange APIs | Orders & balances | User keys |
5. Your rights
Under GDPR and CCPA/CPRA you have the right to:
Access
Request a copy of your personal data
Portability
Receive data in machine-readable format (JSON)
Rectification
Correct inaccurate data
Erasure
Request deletion ("right to be forgotten")
Restriction
Limit or object to certain processing
Withdraw consent
At any time for consent-based processing
You may also lodge a complaint with your local data protection authority.
6. Retention
| Data type | Retention period |
|---|---|
| Account data | While active + 30 days after deletion |
| Audit logs & trading records | 7 years (legal/tax obligation) |
| Telemetry & traces | 90 days (14 days for verbose spans) |
| Encrypted API keys | Deleted immediately on disconnect |
7. International transfers
Sub-processors may store or process data outside the EU/EEA. Where this happens we rely on EU Standard Contractual Clauses (SCCs) and equivalent safeguards.
9. Children
Smartbull is not intended for, and we do not knowingly collect data from, anyone under 18.
10. Contact & Data Subject Requests
Email us at privacy@smartbull.ai or submit a request below. We respond within 30 days (GDPR) or 45 days (CCPA).
11. Changes
We will notify material changes by email or in-product banner at least 30 days in advance. Prior versions are available on request.