Privacy policy

Last updated 30 October 2026

This policy explains what personal data SuperVest collects, why we hold it, how long we keep it and what rights you have over it.

What we collect

• Account data — name, username, email address, and country, phone number or other details if you provide them.
• Authentication data — a one-way hash of your password, session records, and failed sign-in attempts used to block brute-force attacks.
• Transaction data — amounts, networks, transaction hashes, destination addresses, plan allocations and payout history.
• Linked accounts — MetaTrader account number, broker and server. Investor passwords are encrypted before storage and are never displayed again or returned to your browser.
• Technical data — IP address, approximate location derived from it (country, region, city), browser and device information, and access logs.

What we never hold

• Your password in readable form. It is stored as a scrypt hash, so nobody — including our staff — can read it. A reset replaces it; it is never revealed.
• Card numbers or bank credentials. Card payments, where offered, are handled entirely by a licensed payment provider.
• MetaTrader master passwords. We ask only for read-only investor credentials.

Why we hold it

Each purpose below has a lawful basis under UK and EU data protection law:

• To operate your account and settle transactions — performance of our contract with you.
• To meet anti-money-laundering and record-keeping duties — legal obligation.
• To prevent fraud and secure the platform — our legitimate interest in running a safe service, balanced against your rights.
• To send service emails — deposit confirmations, payout notices, password resets. These are part of operating your account, not marketing, and cannot be switched off while your account is open.

Approximate location

We record the country, region and city suggested by your IP address at signup and sign-in, to help detect fraud and meet our obligations. This is an estimate only — a VPN or mobile network will place you somewhere else — and we do not treat it as proof of residence.

Where it lives

Account and transaction data are stored in a PostgreSQL database hosted by Supabase. The site is served by Vercel. Both may process data outside the UK and EEA; where they do, transfers rely on standard contractual clauses or an adequacy decision.

Who we share it with

• Infrastructure providers — hosting, database and email delivery, acting on our instructions.
• Payment and on-ramp providers — where you choose to use them, under their own privacy policies.
• Authorities and regulators — where we are legally compelled, or where we must report a suspicion.

We do not sell personal data, and we do not share it for third-party advertising.

How long we keep it

• Account and transaction records — for the life of the account and at least five years after closure, as anti-money-laundering rules require.
• Session records — until expiry, then deleted.
• Sign-in attempt logs — a rolling short window for rate limiting.
• Access logs — typically 30 days.

Your rights

Depending on where you live, you may ask us to:

• give you a copy of the personal data we hold about you;
• correct anything inaccurate;
• delete data we no longer have a lawful reason to keep;
• restrict or object to certain processing;
• provide your data in a portable format.

Records we must retain by law — transaction history in particular — survive a deletion request. In the UK you may also complain to the Information Commissioner’s Office.

Cookies

We set one cookie, which holds your session so you stay signed in. It is httpOnly, so scripts cannot read it, and it is removed when you sign out. We use no advertising or third-party tracking cookies.

Security

Passwords are hashed with scrypt and a per-user salt. Session tokens are stored only as hashes. Traffic is encrypted in transit. No system is perfectly secure, and we will tell affected users and the relevant regulator without undue delay if a breach puts personal data at risk.

Children

The service is not for anyone under 18 and we do not knowingly collect their data. If you believe a minor has opened an account, contact us and we will close it.

Contact

To exercise any right or ask a question, contact us. We respond within one month.