Privacy notice

OmniMarkets is operated by [legal entity name and registered address], which is the data controller. Our data protection contact is support@omnimarkets.app.

Our registration with [supervisory authority, and registration number] governs how you can complain about our handling of your data.

Everything below is either something you gave us or something your use created.

• Who you are. Your email address, the name you chose to display, your public handle if you set one, the country you told us you are in, and the currency you report in.
• Your password, as a hash. Never the password itself. We cannot read it and cannot tell you what it is.
• Your financial record. Every deposit, withdrawal, order, execution, holding, currency conversion and dividend, and the double-entry ledger behind them. This is the account itself rather than data collected about you.
• Payment details you enter. The mobile number a mobile-money payment is pushed to, and the reference or transaction code you quote for a bank transfer. Card numbers are entered on the payment provider’s own page and never reach us.
• Receipts you upload. Where you attach proof of a bank transfer, we store that file. It is often a bank statement or a screenshot of one, so it may show information about you we never asked for. It is visible only to staff reviewing that payment, it is never served to anybody else, and you can ask us to delete it once the payment is settled.
• Sign-in records. When a session started, when it expires, and the browser it was created from.
• What our staff did. Where a member of staff acts on your account (an adjustment, a suspension, approving a transfer), we record who did it, when, and why.

We do not run advertising trackers, we do not build a profile of you for marketing, and we do not sell or rent your data to anybody.

• To run your account: because we need it to perform the contract between us. Without it we cannot hold your money, execute an order, or show you what you own.
• To meet legal obligations: record keeping, tax, and financial-crime rules require us to keep certain records for certain periods, whether or not you remain a customer.
• To keep the platform safe: detecting fraud, stopping repeated sign-in attempts, and investigating misuse. This is our legitimate interest, and yours.
• Where you have chosen it: the public leaderboard shows your handle and your returns only if you opt in, and you can turn it off at any time under Settings.

We share the minimum necessary, with:

• Payment providers, to move your money. Which one is involved depends on how you pay, and each sees only what it needs to take or send that payment.
• Our email provider, to deliver messages about your account.
• Our hosting and infrastructure providers, who store the data on our behalf and do not use it for anything else.
• Authorities, where we are legally required to disclose something. We will tell you where we are permitted to.

Some of these operate outside the country you are in. Where your data is transferred abroad it is protected by [transfer mechanism: adequacy decision, standard contractual clauses, or equivalent].

Your account data is kept while your account is open. After it closes we keep the financial record (transactions, ledger entries, and the identity attached to them) for [retention period required in your jurisdiction, commonly five to seven years], because we are required to.

Sign-in sessions are deleted when they expire. Uploaded receipts are kept with the payment they belong to and can be deleted on request once it is settled.

Records of what our staff did are kept even where the account they concerned has been deleted. An audit trail that disappeared along with the person it was recording would not be one, and the entries that matter most are about accounts that are no longer here.

You can ask us to:

• give you a copy of what we hold about you;
• correct anything that is wrong;
• delete what we no longer need, though we cannot delete records the law requires us to keep;
• stop or limit a particular use, including turning off the leaderboard or objecting to processing based on our legitimate interests;
• send your data to somebody else in a portable form.

Write to support@omnimarkets.app. We will respond within the time the law allows and will not charge you for it. If you are unhappy with how we have handled your data you can complain to [supervisory authority and how to reach it].

We set one cookie, and it is the one that keeps you signed in. It holds a reference to your session, not your identity or your password, and it is marked so that other sites cannot read it and scripts on the page cannot either. It expires when your session does, and signing out deletes both it and the session behind it.

We do not set advertising or analytics cookies, which is why this site does not ask you to accept any.

Passwords are stored as one-way hashes using a memory-hard function, so a copy of our database would not reveal them. Payment provider credentials are encrypted. Access to customer data by staff is restricted and recorded. Repeated failed sign-in attempts are throttled.

No system is perfectly secure. If a breach affects you and is likely to put you at risk, we will tell you and the regulator, promptly and in plain words.

Where we change how we use your data we will update this page and, if the change matters to you, tell you directly. The date at the top is when it last changed. The terms of use cover the rest of our relationship.