Privacy Policy

SECTION 1 – INTERPRETATION AND DEFINITIONS

Interpretation

Words with initial capital letters have meanings defined under the following conditions. These definitions shall have the same meaning regardless of whether they appear in singular or plural forms.

Definitions

For this Privacy Policy:

• Account means a unique account created for you to access our Service or parts of our Service.
• Affiliate refers to an entity that controls, is controlled by, or is under common control with the Company, as well as participants in our affiliate referral program.
• Company (referred to as either "the Company," "We," "Us," or "Our" in this Agreement) refers to Infinity Algo. For the purpose of the GDPR, the Company is the Data Controller.
• Cookies are small files that a website places on your computer, mobile device, or any other device. They contain details of your browsing history on that Website and are used for various purposes.
• Country refers to the Czech Republic.
• Data Controller, for the purposes of the GDPR (General Data Protection Regulation), refers to the Company as the legal person which alone or jointly with others determines the purposes and means of the processing of Personal Data.
• Privacy Contact refers to our team responsible for privacy matters, who can be reached at [email protected].
• Device means any device that can access the Service, such as a computer, cellphone, or digital tablet.
• GDPR refers to the EU General Data Protection Regulation.
• Personal Data is any information that relates to an identified or identifiable individual.
• Service refers to the Website, trading indicators, tools, and related services provided by Infinity Algo, including access to private community channels.
• Service Provider means any natural or legal person who processes data on behalf of the Company.
• Usage Data refers to data collected automatically, either generated by the use of the Service or from the Service infrastructure itself.
• Website refers to Infinity Algo, accessible from https://infinityalgo.com/.
• You means the individual accessing or using the Service, or the company, or other legal entity on behalf of which such individual is accessing or using the Service.

SECTION 2 – COLLECTING AND USING YOUR DATA

Data Minimization Principle: We collect only the minimum personal data necessary for the purposes described in this Privacy Policy, in line with data minimization principles under GDPR and other applicable privacy laws. We do not collect data that is not directly relevant to providing our Service.

Types of Data Collected

Personal Data

While using our Service, we may ask you to provide us with certain personally identifiable information that can be used to contact or identify you. Personally identifiable information may include, but is not limited to:

• Email address
• First name and last name
• TradingView username (for indicator access)
• Usage Data

Payment Information: If you make a purchase, your payment card details are collected and processed directly by our third-party payment processors (Stripe and PayPal). For cryptocurrency payments, we use NOWPayments as an intermediary. We do not collect or store your full payment card details or private crypto keys on our servers.

TradingView Data Processing: Our trading indicators process market data locally on your TradingView chart. We do not collect or have access to your personal trading data, account balances, or trading history on TradingView. For details on our AI system's local data processing, please see our AI System Disclosure.

Usage Data

Usage Data is collected automatically when using the Service. This data can be collected in two ways:

• Server Logs: When you visit our website, our servers automatically record information, including your IP address, the pages you visit, and the time of your visit. This is standard for most websites and is used for security and diagnostics.
• Analytics Scripts: We use client-side tracking scripts from services like Google Analytics to collect data about how you interact with our Service. This includes information like your browser type, device type, and the time you spend on pages. This data is typically associated with a pseudonymous identifier and not directly with your name or email.
• Geolocation Data: We derive your approximate location (country level) from your IP address for analytics, security monitoring, and compliance purposes. We do not collect precise location data.

When you access the Service by or through a mobile device, we may collect certain information automatically, including, but not limited to, the type of mobile device you use, your mobile device's unique ID, the IP address of your mobile device, your mobile operating system, the type of mobile Internet browser you use, unique device identifiers, and other diagnostic data.

We may also collect information that your browser sends whenever you visit our Service or access the Service by or through a mobile device.

Activity and Session Data

We collect detailed information about your interactions with our Service, including:

• Session Information: We track session IDs, start and end times, duration, and activities performed during each session for security and user experience purposes.
• Account Activities: Login attempts (successful and failed), password changes, username modifications, and account settings updates.
• Service Usage: Access grants and revocations, payment attempts and methods selected, invoice creation, and subscription changes.
• Communication Records: Contact form submissions, email delivery status, and customer support interactions.
• Security Monitoring: We monitor for suspicious activities and potential security threats to protect your account and our Service.

Affiliate Program Data

If you participate in our affiliate program, we additionally collect:

• Referral codes and their usage
• Commission calculations and payout records
• Performance metrics related to your referrals

SECTION 3 – TRACKING TECHNOLOGIES AND COOKIES

We use Cookies and similar tracking technologies to track the activity on our Service and store certain information. The technologies we use may include:

• Cookies or Browser Cookies: A cookie is a small file placed on your Device. You can instruct your browser to refuse all Cookies or to indicate when a Cookie is being sent. However, if you do not accept Cookies, you may not be able to use some parts of our Service.
• Web Beacons: Certain sections of our Service and our emails may contain small electronic files known as web beacons that permit the Company, for example, to count users who have visited those pages or opened an email and for other related website statistics.

Cookie Categories and Consent

Cookies can be "Persistent" or "Session" Cookies. Persistent Cookies remain on your personal computer or mobile device when you go offline, while Session Cookies are deleted as soon as you close your web browser.

We use both session and persistent cookies for the purposes set out below:

• Necessary / Essential Cookies
  Type: Session Cookies
  Administered by: Us
  Purpose: These Cookies are essential to provide you with services available through the Website and to enable you to use some of its features. They help to authenticate users (e.g., `customer_session`, `admin_jwt`) and prevent fraudulent use of user accounts. Without these Cookies, the services that you have asked for cannot be provided. As they are strictly necessary, we do not ask for your consent to place these.
• Analytics / Performance Cookies
  Type: Persistent Cookies
  Administered by: Third-Party (Google Analytics)
  Purpose: These Cookies are used to track information about traffic to the Website and how users use the Website. The information gathered may indirectly identify you as an individual visitor. This is because the information collected is typically linked to a pseudonymous identifier associated with the device you use to access the Website. We may also use these Cookies to test new pages, features, or new functionality of the Website to see how our users react to them. We will only place these cookies if you give us your consent to do so.

For more information about the cookies we use and your choices regarding cookies, please visit our Cookies Policy or the Cookies section of our Privacy Policy.

Managing Cookie Preferences: You can manage cookies directly through your browser settings to block or allow cookies from our site. Essential cookies are necessary for the website to function properly. Analytics cookies help us understand how you use our site. If you have questions about our cookie usage, please email us at [email protected] with the subject line "Cookie Preferences".

SECTION 4 – USE OF YOUR DATA

The Company may use Personal Data for the following purposes:

• To provide and maintain our Service, including monitoring its usage.
  Legal Basis: Performance of a Contract. We need to process your information to deliver the service you signed up for.
• To manage your Account.
  Legal Basis: Performance of a Contract. We use your data to manage your registration as a user of the Service.
• For the performance of a contract.
  Legal Basis: Performance of a Contract. This includes the development, compliance, and undertaking of the purchase contract for the products you have purchased.
• To contact you.
  Legal Basis: Performance of a Contract & Legitimate Interest. We may contact you by email, phone, or other equivalent forms of communication regarding updates or informative communications related to the functionalities, products, or contracted services, including security updates, when necessary or reasonable for their implementation.
• To provide you with marketing news and offers.
  Legal Basis: Consent. We will only send you marketing communications about our products and services if you have explicitly consented. You can withdraw this consent at any time.
• To manage your requests.
  Legal Basis: Legitimate Interest. We process your data to attend to and manage your requests to us (e.g., for customer support).
• For business transfers.
  Legal Basis: Legitimate Interest. We may use your information to evaluate or conduct a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our assets.
• For data analysis and service improvement.
  Legal Basis: Legitimate Interest. We use Usage Data to identify usage trends, determine the effectiveness of our promotional campaigns, and to evaluate and improve our Service, products, marketing, and your experience.
• For security and compliance monitoring.
  Legal Basis: Legitimate Interest & Legal Obligations. We maintain detailed logs of system access, administrative actions, and user activities to ensure security, prevent fraud, comply with legal requirements, and maintain audit trails as required by data protection regulations.

We may share your personal information in the following situations:

• With Service Providers: We share your information with third-party vendors, consultants, and other service providers who perform services on our behalf. These companies are our "Data Processors." We have contracts in place with these providers to ensure your data is protected. Our key service providers include:
  • Fly.io: Our website and application hosting provider.
  • Supabase: Our database and authentication provider. We host all customer data in Supabase's EU-central region to ensure data remains within the European Economic Area.
  • Stripe & PayPal: Our payment processors for handling fiat currency transactions.
  • NOWPayments: Our payment processor for handling cryptocurrency transactions.
  • Google Analytics: Our analytics provider to understand website traffic and usage. We use IP anonymization and have disabled all advertising and remarketing features to enhance privacy protection.
  • Nodemailer: The service we use to send transactional emails.
  • IP-API: Our geolocation service provider for deriving country information from IP addresses.
• For business transfers: We may share or transfer your personal information in connection with, or during negotiations of, any merger, sale of Company assets, financing, or acquisition of all or a portion of our business to another company.
• With Affiliates: We may share your information with our affiliates, in which case we will require those affiliates to honor this Privacy Policy. Affiliates include our parent company and any other subsidiaries, joint venture partners, or other companies that we control or that are under common control with us.
• With business partners: We may share your information with our business partners to offer you certain products, services, or promotions.
• With other users: When you share personal information or otherwise interact in public areas with other users, such information may be viewed by all users and may be publicly distributed outside.
• Community Features: Access to community features (e.g., private Telegram groups) may involve third-party platforms with their own privacy policies. We recommend reviewing their privacy practices before participating.
• With your consent: We may disclose your personal information for any other purpose with your consent.

Legitimate Interest Balancing: When we rely on legitimate interests as our legal basis for processing, we conduct documented balancing tests to ensure our interests do not override your fundamental rights and freedoms. Details of these assessments are available upon request by contacting our Privacy Contact.

SECTION 5 – RETENTION OF YOUR DATA

The Company will retain your Personal Data only for as long as is necessary for the purposes set out in this Privacy Policy. We will retain and use your Personal Data to the extent necessary to comply with our legal obligations (for example, if we are required to retain your data to comply with applicable laws), resolve disputes, and enforce our legal agreements and policies.

The Company will also retain Usage Data for internal analysis purposes. Usage Data is generally retained for a shorter period, except when it is used to strengthen security or improve the functionality of our Service, or we are legally obligated to retain it for longer periods.

Legal Basis for Retention: Our retention periods are based on Czech Civil Code statutes of limitations, Czech tax law requirements, and applicable EU data protection regulations. We anonymize or delete personal data when it is no longer needed for the specified purposes, unless longer retention is required by law.

Specific Retention Periods

• Account Data: Retained for the duration of your account plus 3 years after account closure, unless longer storage is required for legal claims based on Czech Civil Code limitation periods.
• Transaction Records: Retained for 7 years for tax compliance under Czech tax law and legal obligations.
• Security Logs: Retained for 2 years for security monitoring and compliance with data protection regulations.
• Marketing Data: Retained until you opt-out, plus 1 year for suppression lists to ensure we don't contact you again.
• Session Data: Retained for 90 days for security and performance analysis.
• Support Communications: Retained for 3 years or as needed to resolve ongoing issues and legal claims.
• Affiliate Program Data: Retained for 7 years for tax and legal compliance under Czech regulations. Legal Basis: Performance of contract and legal obligations.

SECTION 6 – TRANSFER OF YOUR DATA

Your information, including Personal Data, is processed at the Company's operating offices in the Czech Republic and at the locations of our third-party service providers. This means your information may be transferred to — and maintained on — computers outside your state, province, country, or other governmental jurisdiction where the data protection laws may differ from those in your jurisdiction (such as the United States).

Your consent to this Privacy Policy, followed by your submission of such information, represents your agreement to that transfer.

The Company will take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this Privacy Policy. When we transfer Personal Data outside the European Economic Area (EEA), we do so using legally-provided mechanisms, including the EU Commission's Standard Contractual Clauses (SCCs) and adequacy decisions. This includes transfers to the United States under the EU-U.S. Data Privacy Framework, transfers to the U.K. under the U.K. Extension to the EU-U.S. DPF, and transfers to Switzerland under the Swiss-U.S. DPF, where applicable. For transfers to the United Kingdom, we also rely on the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU SCCs. If the Data Privacy Framework is invalidated by courts, we will implement Standard Contractual Clauses with supplementary measures as our primary transfer mechanism.

Global Data Protection: For non-EEA users, we apply equivalent protections where required by local laws, including but not limited to U.S. state privacy laws, Brazilian LGPD, and other applicable international data protection frameworks. We maintain consistent security standards globally regardless of your location.

SECTION 7 – DISCLOSURE OF YOUR DATA

Business Transactions

Your data may be transferred if the Company is involved in a merger, acquisition, or asset sale. We will provide notice before your Personal Data is transferred and becomes subject to a different Privacy Policy.

Law Enforcement

Under certain circumstances, the Company may be required to disclose your data if required by law or in response to valid requests by public authorities (e.g., a court or a government agency).

Other Legal Requirements

The Company may disclose your data in the good faith belief that such action is necessary to:

• Comply with a legal obligation
• Protect and defend the rights or property of the Company
• Prevent or investigate possible wrongdoing in connection with the Service
• Protect the personal safety of users of the Service or the public
• Protect against legal liability

SECTION 8 – MARKETING COMMUNICATIONS AND AUTOMATED PROFILING

Marketing Emails

We may send you service-related emails (such as purchase confirmations, password resets, and technical updates) as part of our contractual relationship. We do not currently send marketing emails or newsletters. If this changes in the future, we will only send marketing communications with your explicit consent.

Automated Profiling and AI

Our Service includes a feature, "AI Clustering," that uses automated analysis (a form of profiling) on historical market data to recommend indicator settings. This system does not make decisions on your behalf and operates solely as a decision-support tool. Infinity Algo does not use your personal data for any solely automated decision-making that produces legal or similarly significant effects on you. For detailed information on the logic, significance, and limitations of this system, please see our AI System Disclosure.

GDPR Article 22 Compliance: We do not engage in automated decision-making with legal or similarly significant effects as defined under GDPR Article 22. Our AI system provides recommendations only; all trading and financial decisions remain entirely under your control.

SECTION 9 – LEGAL BASIS FOR PROCESSING PERSONAL DATA UNDER GDPR

We may process Personal Data under the following conditions:

• Consent: You have given your consent for processing Personal Data for one or more specific purposes.
• Performance of a contract: Provision of Personal Data is necessary for the performance of an agreement with you and/or for any pre-contractual obligations thereof.
• Legal obligations: Processing Personal Data is necessary for compliance with a legal obligation to which the Company is subject.
• Legitimate interests: Processing is necessary for the purposes of the legitimate interests pursued by the Company, except where such interests are overridden by your interests or fundamental rights and freedoms.

SECTION 10 – YOUR DATA PROTECTION RIGHTS UNDER GDPR

If you are a resident of the European Economic Area (EEA), you have certain data protection rights. We aim to take reasonable steps to allow you to correct, amend, delete, or limit the use of your Personal Data.

If you wish to be informed what Personal Data we hold about you and if you want it to be removed from our systems, please contact us. In certain circumstances, you have the following data protection rights:

• The right to access, update or to delete the information we have on you.
• The right of rectification. You have the right to have your information rectified if that information is inaccurate or incomplete.
• The right to object. You have the right to object to our processing of your Personal Data.
• The right of restriction. You have the right to request that we restrict the processing of your personal information.
• The right to data portability. You have the right to be provided with a copy of the information we have on you in a structured, machine-readable and commonly used format.
• The right to withdraw consent. You also have the right to withdraw your consent at any time where the Company relied on your consent to process your personal information. To withdraw consent, please email us at [email protected] with the subject line "Withdraw Consent".

Exercising Your Rights

You can exercise your rights to access, rectification, erasure, and data portability by contacting us at [email protected]. Please use a clear subject line for your request (e.g., "GDPR Data Deletion Request") to help us process it efficiently. To opt-out of marketing communications, you can use the "unsubscribe" link provided in our emails or contact us.

We will respond to all legitimate requests within one (1) month as required by GDPR. We aim to respond within 14 days where possible for better service. We may ask you to verify your identity before responding to such requests to ensure the security of your data.

Request Fees: Requests to exercise your rights are free of charge unless they are manifestly unfounded or excessive, in which case we may charge a reasonable fee or refuse to act on the request as permitted by GDPR.

You have the right to complain to a Data Protection Authority about our collection and use of your Personal Data. For more information, please contact your local data protection authority in the European Economic Area (EEA). In the Czech Republic, you can lodge a complaint with the Office for Personal Data Protection (Úřad pro ochranu osobních údajů - ÚOOÚ) at ÚOOÚ, Pplk. Sochora 27, 170 00 Prague 7, www.uoou.cz.

Global Rights: Similar rights may apply under other jurisdictions' laws (e.g., Brazil's LGPD, U.S. state privacy laws). Contact us to exercise these rights where applicable.

SECTION 11 – SECURITY OF YOUR DATA

The security of your Personal Data is important to us. We use a variety of technical and organizational measures to help protect your information from unauthorized access, use, or disclosure. These measures include:

• Data Encryption: All data transferred between you and our Service is encrypted in transit using Transport Layer Security (TLS 1.3). Data at rest in our databases is also encrypted.
• Access Control: We enforce strict role-based access controls. Access to production data is limited to authorized personnel only for necessary purposes like customer support and system maintenance.
• Secure Infrastructure & Backups: Our services are hosted on secure, GDPR-compliant cloud infrastructure with hourly encrypted backups. We conduct annual vendor security due-diligence reviews.
• Payment Security: We do not store your credit card details. All payment processing is handled by Stripe, which is a certified PCI Level 1 Service Provider.
• System Monitoring: We conduct regular security monitoring, including annual penetration testing, to identify and address vulnerabilities.
• Staff Training & Incident Response: Our staff receive annual privacy and security training. We maintain a documented incident response plan to handle potential security breaches efficiently and in compliance with regulatory requirements.

While we strive to use commercially acceptable means to protect your Personal Data, remember that no method of transmission over the Internet or method of electronic storage is 100% secure, and we cannot guarantee its absolute security.

Data Breach Notification

In the unlikely event of a data breach that risks your rights and freedoms, we are committed to notifying the Czech Data Protection Authority (Úřad pro ochranu osobních údajů) within 72 hours of becoming aware of the breach, unless the breach is unlikely to result in a risk to your rights and freedoms. Where the breach is likely to result in a high risk to your rights and freedoms, we will also notify you without undue delay. This notification will include details of the breach, our mitigation steps, and any actions you should take to protect yourself.

SECTION 12 – CHILDREN'S PRIVACY

Our Service does not address anyone under the age of digital consent in their jurisdiction (15 in the Czech Republic, 16 in most EU countries, 13 in the United States, or as otherwise specified by local law). We do not knowingly collect personally identifiable information from anyone under these ages. If you are a parent or guardian and know that your child has provided us with Personal Data, please contact us. If we become aware that we have collected Personal Data from anyone under the applicable age without verification of parental consent, we will take steps to remove that information from our servers.

If we need to rely on consent as a legal basis for processing your information and your country requires consent from a parent, we may require your parent's consent before we collect and use that information.

Age Verification: We may require proof of age or parental consent for suspected underage users. Verification methods may include requesting identification documents or parental email confirmation, as required by applicable laws including COPPA in the United States.

SECTION 13 – LINKS TO OTHER WEBSITES

Our Service may contain links to other websites that are not operated by us. If you click on a third-party link, you will be directed to that third party's site. We strongly advise you to review the Privacy Policy of every site you visit.

We have no control over and assume no responsibility for the content, privacy policies, or practices of any third-party sites or services.

SECTION 14 – CHANGES TO THIS PRIVACY POLICY

We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page.

We will notify you via email and/or a prominent notice on our Service prior to the change becoming effective and update the "Last updated" date at the top of this Privacy Policy.

You are advised to review this Privacy Policy periodically for any changes. Changes to this Privacy Policy are effective when posted on this page.

SECTION 15 – ADDITIONAL RIGHTS FOR U.S. STATE RESIDENTS

If you are a resident of certain U.S. states, such as California (under the CCPA/CPRA), Colorado (under the CPA), Connecticut (under the CTDPA), Virginia (under the VCDPA), or other states with comprehensive privacy laws, you may have additional rights regarding your personal information. These rights may include:

• The right to know what personal information we collect, use, and disclose.
• The right to delete your personal information.
• The right to correct inaccurate personal information.
• The right to opt-out of the "sale" or "sharing" of your personal information (as defined by applicable law).
• The right to limit the use of sensitive personal information.
• The right to not be discriminated against for exercising these rights.

We honor the Global Privacy Control (GPC) signal as a valid request to opt out universally across all applicable state laws. To exercise any of these rights, please contact our privacy team at [email protected] or submit a request through our contact form. We will verify your request using the information associated with your account.

Similar Rights Under Other State Laws: Similar rights apply under other state privacy laws (e.g., Colorado's CPA, Virginia's VCDPA, Connecticut's CTDPA). We apply consistent standards and honor privacy requests from residents of all U.S. states with comprehensive privacy legislation.

Sensitive Personal Information: We do not collect or process Sensitive Personal Information as defined under the CPRA, such as precise geolocation, racial or ethnic origin, religious beliefs, genetic data, biometric data, health information, or sexual orientation.

CCPA/CPRA Categories of Personal Information

The following table describes the categories of personal information we have collected in the past 12 months, as defined by the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA):

Disclosure of Personal Information: We do not "sell" or "share" personal information as those terms are defined under the CCPA/CPRA. We do not knowingly sell or share the personal information of minors under 16 years of age.

SECTION 16 – CONTACT US

If you have any questions about this Privacy Policy, you can contact our privacy team at:

Email: [email protected]

Company: Infinity Algo, Czech Republic