Privacy Policy

Last updated: July 2026

This Privacy Policy explains how Arbitrage Agent ("we", "us") collects, uses, and protects your personal data. By using the Service, you agree to this policy.

1. Data We Collect

Email address — collected when you join the waitlist, play the blackjack discount game and claim a prize or ask to play again, or create an account
Telegram chat ID — optional; only if you enable Telegram alerts. Verified with a one-time code sent to that chat, used solely to deliver your alerts
Alert & sizing preferences — your ROI threshold, notification toggles, and bankroll figure used to size the guides
Exchange API keys — optional; only if you connect keys for the upcoming automated execution. Encrypted at rest with AES-256-GCM, never shared
Usage data — trade history, P&L, settings, and access logs (endpoint, IP, timestamp) kept for security monitoring
Payment data — processed by Stripe; we never store card details

2. How We Use Your Data

To operate and provide the Service
To send opportunity alerts by email or Telegram, when you enable them
To send waitlist confirmation and launch notifications
To give you your discount code from the blackjack game and, with your consent, to follow up with you about Arbitrage Agent (you can unsubscribe at any time)
To process payments via Stripe
To send service-related communications (no marketing without consent)

3. Data Sharing

We do not sell, rent, or share your personal data with third parties, except:

Stripe — for payment processing
Clerk — for authentication
Resend — for transactional emails
Telegram — to deliver alerts to the chat ID you configure
Railway — for infrastructure hosting
Google Analytics — anonymised usage analytics on the public site (see Cookies below)
PostHog — product analytics on the public site and the app (page views and a few funnel events such as starting sign-up, clicking checkout and plan activation, to see where visitors drop off). No session replay and no automatic click capture; loaded only after you accept cookies (see Cookies below)
Microsoft Clarity — session replay and heatmaps on the app (records clicks, scrolling and cursor movement to help us fix usability issues). Text you type into the bankroll and Telegram chat ID fields is masked before it leaves your browser — Clarity never sees those values (see Cookies below)
Cloudflare Turnstile — CAPTCHA verification on the waitlist form

All processors are bound by their own privacy policies and GDPR-compliant data processing agreements.

4. Your GDPR Rights

If you are in the EU/EEA, you have the right to:

Access — request a copy of your personal data
Rectification — correct inaccurate data
Erasure — request deletion of your data
Portability — receive your data in a machine-readable format
Object — object to processing of your data

To exercise any of these rights, email arbitrage.agent.support@gmail.com. We will respond within 30 days.

5. Data Retention

We retain your data for as long as your account is active. Access logs are automatically deleted after 30 days. Waitlist emails are retained until you request deletion or the waitlist closes. Emails collected through the blackjack game (kept in a separate contact list after the waitlist closes on 20 October 2026) are retained until you ask us to delete them or unsubscribe; we also keep a normalised form of the email and the discount code issued, to make sure each person gets only one code. Deleting your account (or your identity provider account) erases your profile, access logs, waitlist entry, and referral records. You may request deletion at any time.

6. Security

Exchange API keys are encrypted using AES-256-GCM with a master key stored in environment variables. Passwords and payment details are never stored by us. We use HTTPS for all data in transit.

7. Cookies

We use session cookies for authentication; these are strictly necessary and need no consent. Google Analytics 4, PostHog and Microsoft Clarity (Google Analytics is aggregate usage analytics; PostHog counts page views and a few funnel events, with no session replay; Clarity additionally records how you interact with the page — clicks, scrolling, cursor movement — to help us diagnose usability problems, which is session replay. We mask the bankroll and Telegram chat ID fields at the browser level so Clarity never receives their contents. All three set their own cookies/identifiers) are loaded only if you click Accept on the cookie banner; nothing from them is loaded before that, and if you click Reject they never load. We do not use advertising cookies and we do not sell analytics data.

Separately, we count visits to the public site with our own cookie-free counter. It sets no cookies and stores no IP address or user-agent: aggregate daily totals (page views, an approximate number of visitors, the page and the referring domain).

The same cookie-free counter also records which buttons and links on our public pages are clicked, how far visitors scroll, how they interact with our popup game, and where visitors arrive from (the referring domain or the campaign source in the link), together with the type of device (mobile, tablet or desktop). To follow a visit from the first page to a purchase, your browser stores a random anonymous identifier (in local storage, regardless of your cookie choice). It is not derived from your IP address, email or account, and it is not shared with third parties. We keep that identifier together with the steps taken, the device type and where the visit came from; the device type is worked out from your browser and then discarded. You can clear it at any time by clearing your browser's site data.

(withdraws any consent you gave and shows the banner again).

8. Changes

We may update this policy. We will notify registered users by email of material changes.

9. Contact

Data controller: Arbitrage Agent
Edifício Paris, Rua do Conde de Redondo 59, 1150-102 Lisboa, Portugal
Email: arbitrage.agent.support@gmail.com