Privacy Policy

Definitions

"Personal data" means data about an identified or identifiable individual, such as your name, contact details or account activity. "Processing" means anything done with that data: collecting, storing, reading, sharing or deleting it. A "data controller" decides why and how data is processed; a "data processor" processes it on the controller's instructions. You are the "data subject", the person the data describes.

Personal data we collect

Account data: your first and last name, email address, phone number, country of residence and password, collected at registration. Verification data: identity and address documents, and where applicable a liveness capture, collected under the AML / KYC policy. Financial data: deposit and withdrawal records, payment method identifiers and trading activity on your account.

Correspondence data: the content of messages you send us, including support and complaints correspondence. Technical data: IP address, device and browser information, and pages visited on the site. We deliberately keep the categories few: if a data field does not serve a purpose below, we do not ask for it.

Usage data

Usage data records how the site is used: pages opened, features clicked, session timing, referring page and approximate location derived from the IP address. It is collected through server logs and similar standard mechanisms, and it is used to keep the service secure, to diagnose faults and to understand which pages help users and which confuse them.

Usage data is aggregated for analysis: individual records are read when investigating a specific incident or a specific account's issue, not for browsing habits in general. Aggregated statistics do not identify you and cannot be traced back to you by us.

Cookie files

Cookies are small files a site stores on your device. We use strictly necessary cookies to keep you signed in securely and to remember your preferences, and security cookies that help detect abuse. These are set on use of the platform and are needed for it to function.

With your consent, analytics cookies help count visits and understand page performance, and marketing cookies, if the SEO team enables measurement, support advertising relevance. You can refuse or withdraw consent for these categories at any time through your browser settings or our cookie prompt; refusing them does not block access to the platform. The strictly necessary category cannot be switched off because the service cannot operate without it.

Controller and processors

StraitsVault AI is the controller for the personal data described in this policy: we decide the purposes and the means of processing. Where third parties process data on our instructions, such as hosting, identity verification and email delivery providers, they act as processors under written agreements that bind them to protect the data and to process it only for our stated purposes.

Where connected trading venues process your data for their own purposes, such as their own KYC, they act as independent controllers for that processing, under their own policies. We recommend reading the policy of any venue you connect, exactly as you are reading ours.

How your data is used

Your data is used to: create and administer your account; verify your identity as required by law; execute and service deposits, withdrawals and strategies; send service notifications and, with consent, marketing; secure the platform and investigate incidents; answer support questions and handle complaints; comply with legal obligations; and improve the service in aggregate.

Each purpose uses the minimum data it needs. A support answer does not read your verification documents; a withdrawal check does not read your marketing preferences. Access inside the platform follows the same principle and is logged.

Legal bases for processing

We process personal data on these bases. Contract: administering your account and providing the services you registered for, including account, verification, payment and strategy data. Legal obligation: identity checks, record keeping and reporting under the AML requirements applicable in Singapore, and responses to lawful authority requests. Legitimate interests: keeping the service secure and available, preventing fraud and abuse, and improving the service in aggregate.

Consent: marketing messages, non-essential cookies and, where chosen, liveness verification, each given freely and withdrawable at any time. Withdrawing consent does not affect processing already lawfully carried out, and never affects your right to use the platform's core service.

Data storage and retention

Account and correspondence data are kept for the life of the account and for two years after closure, for service continuity and dispute handling. Verification and AML records are kept for the period required by the applicable Singapore requirements for customer due diligence records, which extends beyond the end of the business relationship. Financial records are kept for the period required for accounting and tax purposes.

Usage data in identifiable form is kept for up to 12 months, after which it is aggregated or deleted. When retention periods end, data is deleted or anonymised securely. Keeping data only as long as its purpose lasts is a rule we apply to ourselves, not an aspiration.

Data transfers

The platform is operated with systems that may process data outside Singapore, including cloud infrastructure and verification providers with regional operations. Where data crosses borders, it travels under safeguards: agreements imposing protection standards no weaker than those described here, and, where applicable, approved transfer mechanisms.

We keep the list of locations deliberately small by choosing providers with regional data centres where practical. You may ask, through the contact address below, for the current general picture of where data is processed.

Disclosure of data

We disclose personal data to: processors performing services for us (hosting, identity verification, screening, email delivery); affiliated companies involved in providing the service; payment providers and connected venues as needed to complete your transactions; and regulators, law enforcement or courts where the law requires or where disclosure is otherwise lawful and necessary.

We do not sell personal data, do not share it with data brokers, and do not disclose it for third-party advertising beyond the marketing consent categories described above. Where a disclosure is made in response to a legal demand, we provide the minimum the demand requires and record the disclosure.

Security of your data

Technical measures include TLS for data in transit, encryption at rest for stored records, scoped access rights, and audit logging of access and changes. Organisational measures include limited staff access on a need-to-know basis, staff training, and incident response procedures that prioritise containment and notification. The Security page describes the account-level protections available to you, including two-factor authentication.

No system is perfectly secure. If a breach affecting your personal data occurs, we notify the relevant supervisory authority as the law requires and inform affected users without undue delay, describing what happened and what to do next.

Your rights

You may request: access to the personal data we hold about you; correction of inaccurate data; deletion of data no longer needed for a lawful purpose; restriction of processing while a dispute about accuracy is resolved; objection to processing based on legitimate interests; and a copy of your data in a portable format. Consent-based processing can be withdrawn at any time.

Requests go to [email protected] and are answered within one month, extendable by two months for complex cases with notice to you. We may need to verify your identity before acting, using the same secure flow as account recovery. Rights are not absolute: verification and AML records, for example, cannot be deleted while the law requires their retention, and we will tell you plainly when and why a right is limited.

Service providers

Our processors include providers of: cloud hosting and infrastructure; identity verification, document authentication and screening; email delivery; analytics; and customer support tooling. Each processes data only on our instructions, under agreements covering security, confidentiality, sub-processing and deletion at the end of the service.

We choose providers for their security posture as much as their function, review the list periodically, and replace any provider that can no longer meet the standard. The current categories are listed here; specific vendor names are available on request through the contact address below.

Analytics

We use analytics to count visits, understand page flows and measure performance, on aggregated or pseudonymised data. An analytics measurement identifier may be configured by the SEO team after deployment; until then, no third-party analytics identifier is active on the site.

Analytics outputs are visible to the team in aggregate. They are not used to make automated decisions about you, and they are not combined with your verification or financial records.

Advertising and retargeting

If marketing measurement is enabled with your consent, retargeting partners may receive a pseudonymised identifier to measure whether an advert led to a registration, so campaigns can be improved. No verification, financial or correspondence data is ever shared for advertising purposes.

You can withdraw consent for marketing and measurement cookies at any time; the platform itself works identically without them. Adverts you see elsewhere are not targeted using your trading behaviour, because that data never leaves the purposes listed above.

Links to third-party sites

The site links to external pages, such as payment providers and educational resources. Those sites have their own policies; once you leave our domain, this policy no longer applies and the destination's rules govern. We link only to pages we consider useful at the time of linking, and we check them periodically, but their content remains their own.

When following any link that asks you to log in, type the destination address yourself. This habit protects you everywhere online, not only here.

Children's privacy

The platform is directed at adults. Accounts are available only to individuals aged 18 and over, and registration data includes a date of birth precisely so that age can be checked. We do not knowingly collect data from children.

If we learn that an account belongs to a person under 18, we close it and delete the associated personal data, except for records we must keep briefly for protective documentation. If you believe a minor has registered, write to the contact address below and we will act immediately.

Changes to this policy

This policy may change as the service or the law changes. Updates are published on this page with effect from publication; material changes are announced in the platform or by email to registered users beforehand. The date the current version took effect is always shown in the announcement accompanying any change.

Continuing to use the platform after a change takes effect means processing continues on the updated basis. If a change does not suit you, you may close your account; the retention rules above then apply and no new data is collected.

Contact us

Privacy questions, data requests and complaints about this policy go to [email protected], for the attention of the Client Support & Compliance department. Written correspondence reaches us at 10 Marina Boulevard, #21-01, Marina Bay Financial Centre Tower 2, Singapore 018983. Support hours are Monday to Friday, 9:00–18:00 SGT.

If you are dissatisfied with our answer to a privacy concern, the options in the complaints procedure, including external resolution channels, apply to privacy matters as well.