Last updated: April 13, 2026
ScalpEx ("we," "us," or "our") is committed to protecting your privacy and personal data. This Privacy Policy explains how we collect, use, store, share, and protect your information when you use our automated cryptocurrency scalping platform. We are committed to transparency and to complying with the General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA), and other applicable data protection laws.
This Privacy Policy applies to all users of the ScalpEx platform, including our website, dashboard, APIs, and any related services. It describes the types of personal data we collect, how we process it, the legal bases for processing, and your rights regarding your data.
By accessing or using ScalpEx, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with our data practices, please do not use our services.
We process personal data in accordance with the EU General Data Protection Regulation (Regulation 2016/679), the UK Data Protection Act 2018, the California Consumer Privacy Act (as amended by the CPRA), and other applicable privacy laws in the jurisdictions where we operate.
ScalpEx is the data controller responsible for your personal data. As the data controller, we determine the purposes and means of processing your personal data and are accountable for ensuring that processing complies with applicable data protection laws.
For any questions about this Privacy Policy or our data practices, you may contact our Data Protection Officer using the contact information provided in Section 17 of this policy.
When you create an account, we collect your name, email address, and authentication credentials provided through our OAuth login system. This data is necessary to create and manage your account.
To operate the trading bot on your behalf, you provide your Coinbase Advanced Trade API key name and private key. These credentials are encrypted using AES-256 encryption before storage and are never stored in plaintext. We use these credentials solely to execute trades and retrieve account data from Coinbase as directed by your bot configuration.
We collect and store records of all trades executed by the bot on your account, including trading pairs, entry and exit prices, position sizes, profit and loss figures, timestamps, and bot configuration parameters. This data is used to provide you with trade history, analytics, and performance metrics.
We record your subscription tier, billing cycle dates, payment status, and blockchain transaction hashes for USDT payments on Ethereum and Polygon networks. We do not store your cryptocurrency wallet private keys. Payment wallet addresses used for transactions are recorded for verification purposes.
We automatically collect technical information including your IP address, browser type and version, device information, operating system, pages visited, time spent on pages, referring URLs, and interaction patterns. This data is collected through server logs and analytics tools to improve our service.
If you contact us for support or feedback, we retain the content of your communications, your contact details, and any metadata associated with the communication to respond to your inquiries and improve our services.
Under the GDPR, we process your personal data on the following legal bases:
| Legal Basis | Processing Activity |
|---|---|
| Contract Performance | Account creation, bot execution, trade management, subscription processing, and providing the core service |
| Legitimate Interest | Service improvement, analytics, fraud prevention, security monitoring, and platform optimization |
| Legal Obligation | Compliance with financial regulations, tax reporting requirements, and responding to lawful data requests |
| Consent | Marketing communications, optional analytics cookies, and any processing not covered by the above bases |
Where we rely on consent, you have the right to withdraw your consent at any time without affecting the lawfulness of processing carried out before withdrawal.
We use your personal data for the following purposes:
We will never use your Coinbase API credentials for any purpose other than executing the trading operations you have configured and retrieving the account data necessary to display your dashboard information.
We do not sell, rent, or trade your personal data to third parties. We share data only in the following limited circumstances:
All third-party service providers are contractually bound to protect your data and may only process it for the specific purposes we have authorized.
We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include:
While we strive to protect your personal data, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security but are committed to promptly addressing any security incidents.
We retain your personal data only for as long as necessary to fulfill the purposes for which it was collected, or as required by law:
| Data Type | Retention Period |
|---|---|
| Account information | Duration of account + 30 days after deletion request |
| API credentials | Deleted immediately upon account deletion or key removal |
| Trading history | Duration of account + 7 years (financial record-keeping) |
| Payment records | 7 years (tax and financial compliance) |
| Usage & technical data | 12 months from collection |
| Communication records | 3 years from last communication |
When data is no longer needed, it is securely deleted or anonymized so that it can no longer be associated with you.
If you are located in the European Economic Area (EEA) or the United Kingdom, you have the following rights under the GDPR:
Right of Access (Article 15)
You have the right to request a copy of the personal data we hold about you, along with information about how it is processed.
Right to Rectification (Article 16)
You have the right to request correction of inaccurate personal data or completion of incomplete data.
Right to Erasure (Article 17)
You have the right to request deletion of your personal data, subject to legal retention requirements for financial records.
Right to Restriction (Article 18)
You have the right to request that we restrict the processing of your personal data in certain circumstances.
Right to Data Portability (Article 20)
You have the right to receive your personal data in a structured, commonly used, machine-readable format and to transmit it to another controller.
Right to Object (Article 21)
You have the right to object to the processing of your personal data based on legitimate interests or for direct marketing purposes.
To exercise any of these rights, please contact us using the information in Section 17. We will respond to your request within 30 days. You also have the right to lodge a complaint with your local supervisory authority.
If you are a California resident, you have the following rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):
To submit a CCPA request, please contact us using the information in Section 17. We will verify your identity before processing your request and respond within 45 days.
Your personal data may be transferred to and processed in countries other than your country of residence. These countries may have data protection laws that differ from the laws of your jurisdiction.
When we transfer personal data outside the EEA or UK, we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the European Commission, adequacy decisions, or other legally recognized transfer mechanisms under GDPR Article 46.
By using our service, you acknowledge that your data may be processed in jurisdictions with different data protection standards. We take all reasonable steps to ensure your data is treated securely and in accordance with this Privacy Policy regardless of where it is processed.
ScalpEx is not intended for use by individuals under the age of 18 (or the age of legal majority in your jurisdiction). We do not knowingly collect personal data from children. If we become aware that we have inadvertently collected personal data from a child, we will take immediate steps to delete such data from our systems.
If you are a parent or guardian and believe your child has provided us with personal data, please contact us immediately using the information in Section 17.
Our trading bot uses automated algorithms to make trading decisions based on technical indicators (EMA crossovers, RSI, Bollinger Bands) and your configured parameters. These automated decisions directly affect the trades executed on your Coinbase account.
Under GDPR Article 22, you have the right not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects. You maintain full control over the bot at all times: you can start, stop, or modify the bot's parameters, and you can override any automated decision by managing your positions directly on Coinbase.
The bot's trading decisions are based on market data analysis and your configured risk parameters, not on profiling of your personal characteristics. You may request human review of any automated trading decision by contacting us.
In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach, as required by GDPR Article 33. If the breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly without undue delay, as required by GDPR Article 34.
Our breach notification will include the nature of the breach, the categories and approximate number of individuals affected, the likely consequences, and the measures taken or proposed to address the breach and mitigate its effects.
We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will notify you by posting the updated policy on our platform with a revised "Last updated" date and, where appropriate, by sending you a notification through the platform or via email.
We encourage you to review this Privacy Policy periodically. Your continued use of ScalpEx after any changes constitutes your acceptance of the revised policy.
If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, including exercising your data protection rights, please contact us:
Data Protection Officer
ScalpEx
Email: [email protected]
For GDPR-related inquiries: [email protected]
For CCPA-related inquiries: [email protected]
We aim to respond to all legitimate requests within 30 days. If your request is particularly complex or you have made multiple requests, we may need up to 60 days, in which case we will notify you of the extension and the reasons for it.
If you are not satisfied with our response, you have the right to lodge a complaint with your local data protection supervisory authority.
© 2026 ScalpEx. All rights reserved.