Data controller and contact
The controller is the contracting Qaveta entity identified on the Contact page and order confirmation. Privacy enquiries, access, correction, deletion and objection requests: support@qaveta.com. We verify identity proportionately before disclosing account data.
What we collect and why
Account data includes email, hashed password, phone, country, language, verification state and terms acceptance. Contract performance supports account operation, service configuration, MT5 license binding, orders, support and transactional email. Billing, payment and audit records support contracts, fraud prevention and applicable record-keeping duties. We do not request wallet private keys or trading account passwords.
Marketing choice
The default selected registration preference records interest only. A separate affirmative email confirmation records marketing consent, version and time. You can unsubscribe in account settings at any time. Withdrawal stops marketing eligibility without affecting essential service emails. No campaign is sent merely because the registration box was preselected.
Website storage and analytics
Essential sessions use an HttpOnly cookie. Language preferences are saved on the device and, after sign-in, to your account. Optional analytics uses a random browser identifier hashed on the server, page category, referral hostname, device class, language and timestamp for up to 90 days. It does not store raw IP addresses or sensitive query parameters. Analytics stays off until you opt in and can be disabled at any time. Infrastructure access logs may separately contain IP addresses.
Recipients, transfers and retention
Hosting, SMTP/IMAP and payment RPC providers process the information required for their function. Public blockchains expose transaction addresses and amounts; those records cannot be erased by Qaveta. Provider names, locations and any required international-transfer safeguards must be documented before production. Support and account records are kept while needed for the service, disputes and mandatory retention; then deleted or minimised. Backups follow the operator’s documented retention schedule.
Your rights and security
Subject to applicable law, request access, correction, erasure, restriction, portability or object to processing. You may withdraw consent and complain to the Estonian Data Protection Inspectorate or another competent authority. Passwords are hashed, sessions expire, role restrictions protect administration, and license keys are encrypted at rest. No system can guarantee absolute security. Contact support promptly about suspected compromise.