1. Who We Are

RaStaBot is an automated cryptocurrency trading assistant operated by RaStaBot Technologies and Riff Raff Holding, LLC ("we", "us"). This policy describes what information we collect, why we collect it, and how it is handled. Questions should be directed to: admin@rastatradingbot.com.

2. Information We Collect and Store

• Account data: your username, email address, and password (stored only as a salted bcrypt hash - we cannot read your password).
• Exchange API keys: stored encrypted (Fernet: AES-128-CBC with HMAC-SHA256). We strongly recommend trade-only keys with no withdrawal or move permissions.
• Trading configuration: your strategies, risk-management settings, and coin pool.
• Trading activity: your account's trade history, positions, and activity logs.
• Billing status: only your subscription tier and status, and Stripe customer/subscription identifiers. Your full card details go directly to Stripe and never reach our servers.
• Security signals: the IP address observed at signup and a randomly generated device identifier cookie, used solely to prevent abuse such as repeat free-demo signups.
• Support requests: anything you include when contacting support.

3. Cookies

We use cookies only for core functionality: a login session cookie (keeping you signed in) and the security device identifier described above. We do not use advertising or third-party analytics cookies. Because these cookies are strictly necessary to operate and protect the service, they are set without a consent banner; this policy is their disclosure.

4. How We Use Information

To operate the service (executing the strategies and exits you configure), to secure accounts and enforce our account limits, to process subscription billing, to send account-recovery and service emails, and to respond to support requests. We do not sell personal data, and we do not use it for third-party advertising.

5. Service Providers

We share data only with the processors required to run the service: Stripe (payments), Brevo (transactional email), Render (hosting), and Cloudflare (network security). Trades are executed on your exchange account via your API keys with Bitunix. Each provider processes data under its own terms and only as needed to provide its function.

6. Data Retention

We keep your data while your account is active. After account termination, personal data is retained for 30 days and then deleted (see Terms of Service §10).

7. Security

API keys are encrypted at rest and only used when trading functions require them. Passwords are bcrypt-hashed, and all bot traffic is encrypted in transit (TLS). We conduct periodic internal security audits and harden the service against common attack vectors on an ongoing basis. However, no system is perfectly secure; you are responsible for keeping your RaStaBot credentials safe, for using trade-only exchange API keys, and for keeping your exchange API keys securely stored.

8. Your Choices

You can update your email address in the app at any time. You may request account deletion or a copy of your data by contacting admin@rastatradingbot.com. Depending on where you live, you may have additional statutory rights to access, correct, or delete your personal data - we honor reasonable requests regardless of jurisdiction.

9. Age Requirement

RaStaBot is for adults. You must be at least 18 years old (or the age of majority in your jurisdiction) to create an account.

10. Changes to This Policy

This policy is subject to changes and updates from time to time. Material changes will be communicated via the dashboard or email, and the "Last updated" date above will change.