Arbitrage Gap
Log in

Privacy policy

1. Who we are

This policy covers arbitragegap.com and the Arbitrage Gap Telegram bot ("we"). For anything about your data write to support@arbitragegap.com.

2. What we collect and why

  • Account: email, name if you give one, a hash of your password (never the password itself), your Google or Telegram account id when you sign in with them, the language you use. To run your account and sign you in.
  • Sessions and security: session tokens, the IP address and browser of a session, sign-up and request counts per IP address. To keep accounts safe and stop abuse; we keep at most two sessions per account.
  • What you set up: watchlists, hidden coins, screener filters and templates, your own fee rates, alert rules, route alerts, paper bots. To provide those features and send your alerts to your Telegram chat.
  • Exchange API keys (paid plans), stored only encrypted, and the balances and fee rates read with them. To show your balances and narrow the scanners to your exchanges.
  • Payments: invoices, amounts, the network, and the wallet a payment came from (blockchain payments are public). To switch your plan on, settle disputes and keep accounting records.
  • Partner program: which partner's link or code brought you, visits of partner links (time and page, no IP address), commissions and payouts, the wallet you give for payouts. To credit and pay partners.
  • Visit statistics: the pages you open, the site you came from, your browser, operating system, device type, screen size, language and country, and how fast the pages loaded and responded for you. Counted on our own servers without cookies or anything stored in your browser; your IP address only gives the country and is not stored, and visits are not linked to your account. To see which pages are useful, which are slow, and what to improve.

We do not sell personal data and do not use advertising trackers. Visit statistics stay with us: no third party receives them (see also the cookie policy).

3. Who processes data for us

  • Hetzner (servers in Finland, EU): hosting of the site, the database and backups.
  • Cloudflare: delivery and protection of the site; it sees requests as they pass.
  • Mailgun (EU region): sign-up confirmations and password reset emails.
  • Google and Telegram: when you choose to sign in with them, and Telegram for the bot's messages.
  • Public blockchains (TRON, BNB Smart Chain) and their public nodes: we read incoming payments from them.

Exchanges receive requests made with your API keys only for the accounts those keys belong to.

4. How long we keep it

Account data, settings and keys are kept while your account exists. Sessions end when you sign out or when they expire. Technical logs are kept for a limited time and rotated automatically. Visit statistics contain nothing that identifies you and are kept to compare periods. When an account is deleted, its personal data is deleted; payment and partner commission records are kept as long as they are needed for accounting and disputes, without the account's other data.

5. Your rights

You can ask us for a copy of your data, to correct it, to delete your account and its data, or to stop a processing you object to: write to support@arbitragegap.com from the email of your account (or tell us your Telegram account). We answer within 30 days. You can remove exchange keys, alerts and bots yourself on your account page at any time. If you live in the EU you can also complain to your data protection authority.

6. Security

We protect data with encryption and restricted access: passwords are kept only as hashes, exchange keys only encrypted. No system is perfectly safe; if a breach affects your data we will tell you.

7. Changes

The date of the last change is at the top of this page.