Privacy Policy

1. Introduction & Scope

This Privacy Policy describes how Veltafi ("we", "us", "our"), operated from Montreal, Quebec, Canada, collects, uses, discloses, and protects your personal information in accordance with the Personal Information Protection and Electronic Documents Act (PIPEDA) and Quebec's Act Respecting the Protection of Personal Information in the Private Sector (Law 25). This policy applies to all users of the Veltafi platform, regardless of location.

2. Information We Collect

We collect the following categories of personal information:

• Account Information: Email address and password (cryptographically hashed) when you create an account
• Identity Information: Legal name, government ID number, and country of residence collected during KYC verification
• Payment Information: Cryptocurrency wallet addresses used for payments and payouts. We do not collect or store credit card numbers, bank account details, or fiat payment credentials
• Trading Data: Simulated trading activity, positions, orders, performance metrics, and account state within the platform
• Technical Data: IP address, browser type, device information, and session data collected automatically for security and fraud prevention
• Communication Data: Records of support requests, compliance inquiries, and other communications with Veltafi

3. Purpose of Collection & Use

We collect and use your personal information for the following purposes:

• To provide, operate, and maintain the simulated trading evaluation platform
• To process cryptocurrency payments and manage your account
• To verify your identity in compliance with PCMLTFA/FINTRAC anti-money laundering regulations
• To monitor compliance with evaluation rules and detect prohibited activities
• To process USDC payouts to your designated wallet address
• To communicate important updates about your account, rule changes, or the service
• To prevent fraud, abuse, money laundering, and ensure platform security
• To comply with applicable Canadian federal and provincial laws, including tax reporting obligations
• To enforce our Terms of Service and Rules & Prohibited Activities

We will not use your personal information for purposes beyond those stated above without obtaining your consent, except where required or permitted by law.

4. Consent

By creating an account on Veltafi, you consent to the collection, use, and disclosure of your personal information as described in this Privacy Policy. For KYC verification, you provide explicit consent when you submit your identity documents. You may withdraw your consent at any time by contacting privacy@veltafi.com, subject to legal or contractual restrictions. Withdrawal of consent may result in the inability to use certain features of the platform or process payouts.

5. Data Storage & Security

Your data is stored securely using Supabase infrastructure hosted in the United States (AWS), with row-level security policies enforced at the database level. Authentication is handled via industry-standard protocols (JWT tokens, bcrypt password hashing). All data transmission is encrypted via TLS 1.2+. We implement organizational and technical safeguards proportionate to the sensitivity of the information, including: access controls, encryption at rest, audit logging, and regular security reviews. Despite these measures, no method of electronic transmission or storage is 100% secure, and we cannot guarantee absolute security.

6. Third-Party Services & Cross-Border Transfers

We use the following third-party service providers who may process your personal information:

• Supabase (US): Database hosting, authentication, and real-time data
• Vercel (US): Application hosting and edge network
• Databento (US): CME Group market data feeds
• Sentry (US): Error monitoring and application performance tracking
• Upstash (US): Rate limiting and abuse prevention via Redis
• PayPal (US): Payment processing for evaluation fees
• Resend (US): Transactional email delivery

Your personal information may be transferred to and processed in the United States, where these providers operate. By using the platform, you acknowledge that your data may be transferred outside of Canada to jurisdictions that may have different data protection standards. Each provider is contractually obligated to protect your information in accordance with applicable privacy laws. We conduct due diligence on all third-party providers to ensure adequate data protection.

7. Data Retention

We retain your personal information for as long as your account is active and for a reasonable period thereafter. Specific retention periods: (a) Account and trading data: retained for the duration of the account plus 7 years (to comply with Canadian tax and AML record-keeping requirements under PCMLTFA); (b) KYC identity documents: retained for 5 years after the last transaction, as required by FINTRAC; (c) Technical logs: retained for up to 2 years for security and fraud prevention. You may request deletion of your account and associated data by contacting privacy@veltafi.com. Certain data may be retained beyond your request where required by law.

8. Your Rights Under PIPEDA & Law 25

As a user, you have the following rights regarding your personal information:

• Access: Request access to the personal information we hold about you
• Correction: Request correction of inaccurate or incomplete personal information
• Deletion: Request deletion of your personal information (subject to legal retention requirements)
• Portability: Request a copy of your personal information in a structured, commonly used format
• Withdrawal of consent: Withdraw your consent to the processing of your personal information at any time
• Complaint: File a complaint with the Office of the Privacy Commissioner of Canada (OPC) or the Commission d'accès à l'information du Québec (CAI) if you believe your privacy rights have been violated

To exercise any of these rights, contact us at privacy@veltafi.com. We will respond to your request within 30 days, as required by PIPEDA.

9. Cookies & Tracking

We use essential cookies for authentication and session management. These cookies are strictly necessary for the platform to function and cannot be disabled. We do not use advertising cookies, tracking pixels, or third-party analytics cookies. We do not sell or share your personal information with advertisers.

10. Children's Privacy

The Veltafi platform is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from minors. If we become aware that we have collected information from a person under 18, we will take steps to delete that information promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, legal requirements, or platform features. We will notify you of material changes by posting a notice on the platform or sending an email to your registered address. The "Last updated" date at the top of this page indicates when the policy was last revised.

12. Contact & Privacy Officer

For privacy-related inquiries, complaints, or to exercise your rights, contact our Privacy Officer at privacy@veltafi.com.

You may also contact the Office of the Privacy Commissioner of Canada:
30 Victoria Street, Gatineau, Quebec K1A 1H3
Toll-free: 1-800-282-1376
Website: priv.gc.ca