Privacy Policy

This Privacy Policy explains how Alto Smart Solutions, Ajman Free Zone, United Arab Emirates ("Company", "we", "us") collects, uses, and protects your personal data when you use the GTA platform (the "Service").

1. Data We Collect

• Account data: email address and name (from Google OAuth when you sign in).
• Waitlist data: email address you submit to join early access.
• Usage data: pages visited, features used, and basic analytics (anonymized).
• Technical data: IP address, browser type, and device information (access logs).
• Trading configuration: your chosen risk profile, trading mode, and connected exchanges (metadata only).

2. Data We Do NOT Collect

• Your funds. We never hold or custody your money.
• Your passwords. Authentication is handled by Google OAuth; we never see your password.
• Payment card details. Billing is processed by Stripe; we never store your card number.

3. About Your Exchange API Keys

If you connect an exchange account, your API key and secret are encrypted and stored in Google Cloud Secret Manager. They are:

• Validated to be trade-only (withdrawal access is rejected).
• Encrypted at rest with AES-256 and in transit with TLS.
• Accessed for under 200 milliseconds per trade, then discarded from memory.
• Never stored in our database, logs, or backups.
• Never shared with third parties.
• Deleted when you disconnect your exchange or delete your account.

4. How We Use Your Data

• To provide and operate the Service.
• To communicate with you about your account and early-access status.
• To improve the Service and develop new features.
• To comply with legal obligations.

We do not sell your personal data. We do not use it for third-party advertising.

5. Data Sharing

We share data only with service providers necessary to run the Service (e.g., Google Cloud for hosting, Stripe for billing, Google OAuth for sign-in), each bound by their own data-protection obligations, and where required by law.

6. Data Retention

• Account and trading data: retained while your account is active.
• Access logs: retained up to 90 days.
• API keys: deleted immediately on disconnect or account deletion.

7. Your Rights

Depending on your jurisdiction (including under GDPR and UAE data protection law), you may have the right to:

• Access the personal data we hold about you.
• Request correction or deletion of your data.
• Export your data in a portable format.
• Object to or restrict certain processing.
• Withdraw consent at any time.

To exercise any of these rights, contact us at info@altosmartsolutions.com. We respond within 30 days.

8. Security

We use industry-standard safeguards: encryption at rest and in transit, access controls, audit logging, and regular security review. No method of transmission or storage is 100% secure, but we work to protect your data using commercially acceptable means.

9. International Transfers

Your data may be processed in countries other than your own (including Google Cloud regions in the US and EU). We rely on appropriate safeguards for such transfers.

10. Cookies

We use only essential cookies required for authentication and session management. We do not use tracking or advertising cookies.

11. Changes

We may update this policy from time to time. Material changes will be announced on the Service. Continued use after changes constitutes acceptance.

12. Contact

Privacy questions or requests: info@altosmartsolutions.com