Privacy Policy

Definitions

"Personal data" means information relating to an identified or identifiable person: a name, an email address, a phone number, a document, an IP address. "Processing" covers anything done with that data: collecting, storing, reading, sharing or deleting. "Controller" decides why and how data is processed; a "processor" acts on the controller's instructions, such as a hosting provider. You are the "data subject"; the data about you is yours, and this policy exists to keep that statement true in practice.

Personal data we collect

We collect the data the service genuinely needs. Account data: first and last name, email address, phone number, country of residence and a password. Identity data, collected at verification: your identity document, your address document and, where applicable, a liveness capture. Content data: the content of requests you send us, including the message text of support conversations. Agreement data: your acceptance of these policies, with timestamps.

We do not collect special-category data (such as health or biometric templates beyond the liveness frame used and discarded in verification), we do not collect data from children, and we do not buy profiles from data brokers. If a field is not listed here, we do not need it.

Usage data

When you use the website, standard technical data is recorded: the pages visited, the approximate timing, the browser and device type, the referring page and the IP address. This data keeps the service secure, helps diagnose faults and gives an aggregate picture of how features are used.

Usage data is statistical by nature. It does not track you across other websites, and it is not used to build a profile for sale to anyone. Server logs rotate on a short cycle; nothing in them outlives its diagnostic purpose.

Cookies and similar technologies

The platform uses a small set of cookies: a strictly necessary session cookie that keeps you signed in, a security cookie supporting protection against automated abuse, and, with your consent, an analytics cookie measuring aggregate usage. Marketing cookies are set only if you agree to marketing communication.

You can withdraw consent and delete cookies at any time through your browser settings and through the cookie notice presented on first visit. Refusing optional cookies does not restrict access to the website's content; only the strictly necessary pair remains.

Controller and processors

Lunexora, operating from Schottenring 12, 1010 Wien, Austria, is the controller for the data described here. Processors act only on our documented instructions under contracts that bind them to confidentiality and security: hosting and infrastructure providers, identity-verification providers, email-delivery providers and support tooling. The categories are listed under "Recipients" below.

Every processor receives only the data its function requires. Our instructions to them include the same prohibitions you see in this policy: no sale of data, no secondary use, no retention beyond the task.

How information is used

Your data is used to: create and operate your account; verify your identity under anti-money-laundering obligations; respond to your questions and requests, including the callback you request by registering; operate the trading features you activate; process deposits and withdrawals; keep the platform secure; meet accounting, tax and regulatory duties; and, with consent, send marketing you can opt out of.

Each of those purposes maps to a legal basis in the next section. Purposes do not silently grow: a new purpose requires either your consent or a new legal basis, and where that happens this policy and the in-platform notice say so before processing begins.

Legal bases for processing

Processing rests on four bases. Contract: account operation, deposits, withdrawals and the service itself, because you asked for them. Legal obligation: identity checks, record-keeping and reporting under the anti-money-laundering and tax rules applicable in our markets. Legitimate interest: security monitoring, fraud prevention, diagnostics and aggregate service improvement, balanced against your interests and limited to what is necessary.

Consent: marketing communication and optional analytics, each separately requested, each withdrawable at any time, and each given by a clear act, not by silence. Where we rely on legitimate interest, you may object as described under your rights below, and we weigh the objection seriously.

Data retention

Retention follows the purpose, not convenience. Account data is kept while your account is active and for a short wind-down period after closure, long enough to settle open matters. Identity-verification records are kept for the period anti-money-laundering rules require after the relationship ends, then deleted. Support conversations are retained while a matter is open plus a modest archive window for quality and dispute purposes.

Usage logs rotate within weeks; analytics aggregates, once anonymised, may persist as statistics because they are no longer personal data. Marketing consent records are kept to prove the consent existed, for as long as the consent remains valid plus a limitation window.

Recipients of data

Beyond processors, data may be shared with: the licensed entity that executes your trades, to the extent the service requires; affiliated companies involved in operating the service under the same protections; payment providers for the methods you choose; and regulators or public authorities where the law of a relevant market compels disclosure or a report.

We never sell personal data, never share it for third-party advertising, and never transfer it to a party whose handling would fall below this policy. Transfers outside your market, where they occur, use the recognised safeguards described in the next section.

Transfers and safeguards

Our infrastructure and providers operate in several countries. Where personal data crosses borders, transfers rely on adequacy decisions where available, or on standard contractual clauses with supplementary technical measures where not. The list of provider categories is available on request, and material changes to where data lives are reflected here.

The practical commitment: wherever your data sits, it travels encrypted, rests encrypted, and is reachable only by roles with a reason. Distance does not dilute the standard.

Disclosure

Disclosure beyond the recipients above happens only where the law compels it or where you instruct it. If we receive a legally binding request concerning your account, we review its validity and scope, and notify you where the law permits, which it usually does outside active investigations.

We publish nothing that identifies you individually: no reviews without your consent, no case studies naming clients, no screenshots of your dashboard. Aggregate statistics, where used, contain too few identifying details to single anyone out.

Security of processing

Protective measures are layered: encryption in transit and at rest, role-based access to personal records, separation between identity documents and general support tooling, logging of access to sensitive data, and review of processors' practices. The Security page describes the account-level features available to you.

No system is perfectly secure. If a breach affects your personal data, we notify the competent supervisory authority where required and inform you without undue delay with what happened, what data was involved and what you can do.

Your rights as a data subject

You may request access to your data, correction of inaccurate data, deletion where no retention duty applies, restriction of processing while a dispute is resolved, objection to processing based on legitimate interest, and a copy of your data in a portable format. Consent-based processing, such as marketing, stops when you withdraw consent, immediately and without justification required.

To exercise any right, write to [email protected]. We respond within the statutory period of your market, normally much sooner, and never charge for a first reasonable request. Where we cannot do exactly what you ask (a verification record, for example, that the law requires us to keep), we explain the specific obstacle and what we can do instead.

Service providers

The providers we rely on fall into a small number of categories: cloud hosting and infrastructure; identity-verification tooling; email and message delivery; analytics under consent; and support desk software. Each is bound by contract to process only on our instructions, to keep data secure and to delete it when the task ends.

We choose providers for their practices as well as their features, and we review the list when a provider changes. A provider's own marketing statements do not bind us; our contracts do.

Analytics

Where you consent, we measure aggregate usage of the website: which pages are visited, for how long, from which broad regions and device classes. The measurements are used to find broken journeys, slow pages and confusing wording, and nothing else.

Analytics runs only after consent, honours do-not-track signals in spirit as well as letter, and its data is not joined to your identity for advertising. If we ever add a measurement that changes this paragraph, the change will be announced, not slipped in.

Advertising and retargeting

We do not run retargeting campaigns that follow you across the web, and we do not share personal data with advertising networks. If you arrive at the site through an advertisement, the platform's own policies, not the advertiser's, govern what happens to your data from the moment you land.

Marketing messages we send ourselves go only to consenting accounts, carry an unsubscribe link in every copy, and stop the moment you use it.

Links to other websites

The website links to third-party pages for reference and convenience. Those pages have their own policies, which govern whatever you share with them; this policy ends where our domain ends. Be particularly careful with pages that imitate our design: the fraud warning page explains how to verify you are on the real site.

Children

The platform is intended for adults and is not directed at children. We do not knowingly collect data from anyone below the legal age of their jurisdiction. If we learn that a child's data has reached us, we delete it promptly. If you believe this has happened, tell us at the address below and the data will be removed.

Changes and contact

This policy may change to reflect the service or the law; the published version always applies, and material changes are announced inside the platform before they take effect. The date of the last review is available on request. Questions, requests and objections go to [email protected], handled by Client Support & Compliance, Monday to Friday, 9:00–17:30 CET.