1. Data We Collect
- Account data: name, email, role, entitlements, password-derived credentials, MFA state, session metadata, and account status.
- Trading operations data: watchlists, model access, backtests, research reviews, risk approvals, orders, fills, cancellations, balances, venue responses, and reconciliation records.
- Support and notification data: support cases, messages, feedback, notification preferences, delivery status, and administrative notes.
- Security and device data: IP-derived security signals, user agent, app platform, device tokens, rate limits, audit logs, errors, and incident evidence.
- Files and exports: profile images, support attachments, research evidence, model manifests, reports, and operational artifacts.
2. How We Use Data
- To authenticate users, enforce role-based access, recover accounts, and protect sessions.
- To run research, backtesting, model governance, market monitoring, trading execution review, risk controls, and support workflows.
- To reconcile venue activity, investigate incidents, detect abuse, maintain audit trails, and satisfy operational or legal requirements.
- To improve performance, reliability, usability, and security across web, mobile, API, worker, database, queue, and cloud infrastructure.
3. Sharing
Authorized administrators may access data needed for their role. Infrastructure, notification, storage, observability, and venue providers may process data needed to deliver platform functions.
Data may be disclosed when required for security, incident response, tax, accounting, audit, legal process, venue compliance, or regulator requests.
4. Security
- The platform uses encrypted transport, HttpOnly cookies where applicable, role-based authorization, audit logging, upload limits, monitoring, and environment-specific secret handling.
- Users must not place private keys, API secrets, seed phrases, passwords, or production credentials in support messages, screenshots, exports, model notes, or browser-accessible storage.
- No system is perfectly secure; report suspected compromise promptly so access, keys, models, and venue permissions can be reviewed.
5. Retention And Deletion
Data is retained only as long as needed for platform operation, auditability, security, reconciliation, accounting, tax, venue review, dispute handling, backups, and legal obligations.
After an accepted deletion request, eligible profile and account data is deleted or de-identified. Operational records that must remain are limited and protected.
6. Your Choices
- You can update supported profile, security, notification, feedback, and account-deletion settings in the app.
- You may request access, correction, deletion, restriction, objection, portability, or information about processing where applicable.
- To exercise privacy rights, contact privacy@highwater.trading.
7. Updates And Contact
We may update this policy as venue integrations, infrastructure, laws, and platform capabilities change. For privacy questions, contact privacy@highwater.trading; for account or support questions, contact support@highwater.trading.