Privacy Policy

01Who we are

[Legal entity name] ("Halcira", "we") is responsible for the personal data described in this policy. You can contact us at [privacy@yourdomain.com], or by post at [Registered business address].

This policy explains what we collect when you use the Halcira website, dashboard and engine, why we collect it, and the choices you have.

02What we collect

You give us

• Account details: display name, email address and a securely hashed password. When you sign up we also record that you confirmed you are 18 or older and which version of the Terms you accepted, with the date.
• Venue connections: which venues you've linked, account labels, balances and positions read through the venue APIs so the dashboard can show them.
• Your settings: strategies, minimum edge, risk limits and auto-execute status.
• Messages: anything you send us, such as support requests or feedback.

Created when you use the Service

• Trading activity: the orders, fills, hedges, settlements and transfers the engine places or records for you, which make up the execution log.
• Technical data: IP address, browser and device type, and error and security logs. These are needed to run and protect the Service.
• Analytics, only if you accept them: pages viewed, features used and approximate location based on your IP address. See the Cookie Policy.

03Venue API keys

We never ask for withdrawal permissions, and we recommend that you don't enable them on keys you connect.

04Halcira app (desktop)

Kept on your PC only

• Keys and logins: your Halcira sign-in (only if you tick Remember me), your Novig API keys, your Anthropic key and your Discord alert link. They're encrypted with Windows for your user account and never sent to us. They can't be shown again in the app.
• The bot's ledger of what it tried, placed or skipped, and its activity log.

Saved to your Halcira account

• Bets it places, in your My bets, so results and charts work.
• Your Halcira app settings (limits, checks and alert choices), so they follow you to another PC. Never keys, passwords or links; settings tied to one PC stay on it.

Sent to others, only to do what you asked

• Novig: your orders, signed with your key, and the market lookups needed to place them. Novig runs its own location check.
• Anthropic, only if you turn on the Claude features: the pick and, for the browser slip builder, the text of Novig's bet slip page.
• Discord, only if you add a link: the text of each alert you chose.
• Windows shows alerts by the clock only if you turn them on.

05What we don't collect

• Payment card or bank account numbers for venue deposits. Those go directly to the venue or its payment processor.
• Government ID documents. Identity checks for trading are done by each venue.
• Special categories of data, such as health, religion or political views.

06How we use your data

We don't use your data for advertising, and we don't make decisions with legal or similarly significant effects about you based solely on automated processing of your personal data. The engine trades only under settings you choose.

07Who we share it with

• Venues you connect. The engine sends orders and API requests to them on your behalf.
• Service providers that host, secure or support the Service under contract and only on our instructions: [hosting provider, email provider, error monitoring, analytics provider].
• Authorities, when the law requires it or to protect rights, safety and security.
• A buyer or successor if Halcira is merged or sold. This policy keeps applying to your data.

We do not sell your personal information, and we do not "share" it for cross-context behavioral advertising as those terms are defined in California law.

08How long we keep it

• Account data: while your account is open, then [e.g. 30 days] after deletion.
• Trading activity and execution logs: [e.g. 5 years], for your records and our legal obligations.
• Security logs: [e.g. 90 days].
• Analytics data: [e.g. 13 months], and only if you consented.

09Security

We use encryption in transit, access controls and the principle of least privilege to protect your data. No system is perfectly secure, so please also protect your own devices and keys. If a breach affects you, we'll tell you as the law requires.

10Your rights

Depending on where you live, you may have the right to:

• access your personal data and get a copy of it;
• correct it, or have it deleted;
• restrict or object to some uses, including uses based on legitimate interests;
• receive your data in a portable format;
• withdraw consent at any time, for example by switching analytics off in Cookie settings;
• know, delete and correct personal information, and opt out of its sale or sharing, under California (CCPA/CPRA) and other US state laws. We don't sell or share it, and we won't treat you differently for using your rights;
• complain to your data protection authority.

To exercise a right, email [privacy@yourdomain.com]. We'll verify your request and reply within the time the law requires, normally 30 to 45 days.

Global Privacy Control. If your browser sends a GPC signal, we treat it as an opt-out and keep analytics off unless you turn them on yourself.

11International transfers

Our providers may process data in countries other than yours, including [e.g. the United States]. Where the law requires it, we use safeguards such as the EU Standard Contractual Clauses.

12Children

Halcira is not for anyone under 18. We don't knowingly collect data from minors, and we'll delete it if we learn we have.

13Changes to this policy

If we make material changes, we'll update the date at the top and tell you in the Service or by email.