Privacy Policy

Account information. When you register, we collect your name, email address, a username, and a password. Passwords are never stored in plain text — they are hashed using an industry-standard one-way algorithm before storage, which means we cannot read your password. If you enable two-factor authentication, we store the associated secret and backup codes in encrypted or hashed form solely to operate that feature.

Wallet and payment information. The Service generates a dedicated bot wallet for your account and unique deposit addresses for your subscription payments. We store the public addresses of these wallets, the encrypted key material needed to operate them on your behalf, and records of your subscription purchases (plan, amount, payment status, associated addresses, and any coupon used). If you participate in the referral program, we also store your payout address and a ledger of commissions accrued and paid.

Usage and technical information. Like most online services, our infrastructure automatically records limited technical data when you interact with the Service, such as IP addresses, browser type, timestamps, and request logs. We use this information for security monitoring, rate limiting, abuse prevention, and debugging. We do not build advertising or behavioral profiles from this data.

We use the information described above to: create and manage your account; verify your email address; authenticate your sessions; provision and operate your bot wallet; process and confirm subscription payments on-chain; operate your trading configuration; calculate and pay referral commissions where applicable; send you transactional emails (such as verification links, password resets, and important service notices); provide customer support; monitor for fraud, abuse, and security incidents; and comply with legal obligations. We process your information because it is necessary to provide the Service you signed up for, because we have a legitimate interest in keeping the Service secure and functional, or because you have asked us to take a specific action.

The Service uses a small number of strictly necessary cookies to keep you signed in — specifically, session tokens issued when you log in. These cookies are essential for authentication and security and cannot be disabled while using your account. We do not use advertising cookies, cross-site tracking cookies, or third-party analytics trackers on the Service. Because we only use strictly necessary cookies, the Service does not display a cookie consent banner.

The Solana blockchain is a public, permanent, append-only ledger. Any transaction involving your bot wallet or a payment deposit address — including funding amounts, timestamps, counterparty addresses, and balances — is publicly visible to anyone and cannot be deleted, modified, or hidden by us or by anyone else. You should assume that any on-chain activity associated with addresses linked to your account is permanently public. This Policy does not, and cannot, apply to data recorded on a public blockchain.

We do not sell, rent, or trade your personal information. We share information only in the following limited circumstances: with infrastructure providers that we use to run the Service, such as hosting providers, Solana RPC node providers (which process the public addresses involved in your transactions), and our transactional email provider (which processes your email address in order to deliver verification and notification emails); with professional advisers where reasonably necessary; with law enforcement or regulators where we are legally required to do so or where disclosure is reasonably necessary to prevent fraud, abuse, or harm; and in connection with a merger, acquisition, or sale of assets, in which case this Policy will continue to apply to your information. Market data displayed on the Service (such as spot prices and candlestick data) is fetched from public third-party market data sources; these requests do not include your personal information.

We apply technical and organizational safeguards appropriate to the sensitivity of the data we hold. Wallet key material is encrypted at rest using strong authenticated encryption (AES-256-GCM) and is never exposed to your browser or to third parties. Passwords are hashed with bcrypt. Connections to the Service are encrypted in transit using TLS. Access to production systems and encryption keys is restricted. No method of transmission or storage is completely secure, however, and we cannot guarantee absolute security — please use a strong, unique password and enable two-factor authentication on your account.

We retain account information for as long as your account exists. Payment and commission records are retained for as long as needed to operate the Service, resolve disputes, and satisfy accounting and legal obligations. Security logs are retained for a limited period and then deleted or anonymized. If your account is deleted, we remove the personal information associated with it within a reasonable period, except where we are required or permitted to retain certain records (for example, payment records relating to completed transactions) and except for data that is permanently recorded on the public blockchain, which we cannot delete.

Depending on where you live, you may have rights regarding your personal information, such as the right to access the information we hold about you, to correct inaccurate information, to request deletion, or to object to certain processing. You can exercise these rights by contacting us at the address below from the email associated with your account; we may ask you to verify your identity before acting on a request. You can update your password and two-factor settings directly from your account at any time. Note that deleting your account while your bot wallet holds funds requires first arranging the return of those funds, and that we cannot erase data recorded on the public blockchain.

The Service is not directed at, and may not be used by, anyone under the age of 18 (or the age of legal majority in their jurisdiction, whichever is higher). We do not knowingly collect personal information from minors. If we become aware that a minor has created an account, we will terminate the account and delete the associated personal information.

The Service is operated from the location of our infrastructure providers, and your information may be stored and processed in jurisdictions other than your own, where data protection laws may differ from those of your jurisdiction. By using the Service, you understand that your information may be transferred to and processed in such jurisdictions as necessary to provide the Service. We apply the safeguards described in this Policy regardless of where the data is processed.

We may update this Privacy Policy from time to time to reflect changes to the Service, to applicable law, or to our practices. When we make material changes, we will take reasonable steps to notify you, such as posting the updated Policy on this page or sending a notice to the email address associated with your account. Your continued use of the Service after an updated Policy takes effect constitutes acceptance of the update.

Questions about this document can be sent to dev@lucidexbot.com. We aim to respond to all inquiries within a reasonable timeframe.