Privacy Policy

1. Data we collect

When you use Yielox, we keep the following:

• Account details: your email address and a hash of your password (argon2id). Your password itself is never stored.
• Sessions and tokens: your login sessions and the API tokens you create, stored only as hashes.
• Exchange API keys: encrypted with AES-256-GCM, with a separate data key for each record.
• Trading data: orders, fills, balance snapshots, profit and loss, and bot events.
• Security log: a record of sensitive actions such as sign-ins, password changes, token changes and key changes.
• Payment records: once billing launches, details of subscription transactions such as amount, date, plan and reference number.

2. Why we keep it

We use your data only to:

• Sign you in and protect your account.
• Run the bot, place and cancel orders in your exchange account, and calculate profit and loss.
• Show status, trade history and reports in your dashboard.
• Detect abuse, investigate security events and fix problems.
• Manage subscriptions and payments, and meet legal obligations.

3. Where it is stored

All data is stored on servers in Iran. This is because Nobitex requires API requests to come from an Iranian IP address.

4. How we protect it

We protect your data in several layers:

• Passwords are hashed with argon2id, and sessions and tokens are stored only as hashes.
• Exchange keys are stored with AES-256-GCM envelope encryption, and no part of the system returns them as plain text.
• Each user sees only their own accounts, and this separation is also enforced inside the database.
• Traffic to the site is encrypted over HTTPS.
• The key we ask for has no withdraw permission, so even in the worst case it cannot be used to move funds out of your account.

5. How long we keep it

We keep account and trading data while your account is active. If you ask us to delete your account, we delete your account details, exchange keys, sessions and trading data.

Payment records and parts of the security log may be kept for as long as the law or the handling of disputes requires. Backups are erased on their normal cycle.

6. Sharing

We do not sell your data and we do not use third-party ad trackers. Data leaves our systems only in these cases:

• The exchange: the bot sends requests to the exchange on your behalf, using your own API key, to read balances and place or cancel orders.
• The payment gateway: when you buy a subscription, the details needed to complete the payment go to the bank payment gateway.
• Legal requirements: when a competent authority makes a formal request, and only as far as the law requires.

7. Cookies

We use one strictly necessary session cookie that keeps you signed in. The site needs it to work, and it is not used for advertising or tracking. We use no analytics or advertising cookies.

8. Your rights

At any time you can:

• See your account data, trading data and security log in the panel.
• Remove your exchange API key from the panel, or revoke it directly on the exchange.
• Sign out of all active sessions and revoke your API tokens.
• Change your password.
• Ask us to delete your account completely.

9. Changes to this policy

We may update this policy. The date of the latest update is shown at the top of this page, and we will tell you about important changes by email or in the panel.

10. Contact

For any privacy question, or to ask for your account to be deleted, email support@yielox.ir.