Privacy Policy

1. Data controller

Groupe Expert (Québec, Canada) is the data controller within the meaning of the GDPR, and the "person in charge of the protection of personal information" within the meaning of Quebec's Law 25.

Data protection officer contact: support@hypertrader.ca

2. Data we collect

3. Legal basis for processing (GDPR)

• Contract: performance of the Service (account, authentication, access to the signals)
• Legitimate interest: security, fraud prevention, internal analytics
• Consent: marketing communications (optional, opt-in)
• Legal obligation: retention of financial activity logs

4. Purposes of use

• Provide the Service (authentication, card display, leaderboards)
• Secure the Service (fraud and abuse detection, international sanctions)
• Improve the product (aggregated analytics, anonymous A/B tests)
• Communicate with you (support, service notifications)
• Meet our legal and tax obligations

5. Data sharing

We never sell your data. We share it only with:

• Resend (United States) — sends the magic link emails and notifications. Data: email only. Policy: resend.com/privacy
• HyperLiquid (public DEX) — public on-chain data (wallet address, transactions). Nothing private.
• OVHcloud (Canada, Beauharnois data center in Quebec) — hosting of the website, server and database. Policy: ovhcloud.com/privacy
• Zoho Corporation (Canada, Toronto and Montreal data centers) — support mailbox: the messages you send to support@hypertrader.ca. Policy: zoho.com/privacy
• Google LLC (United States) — Google Analytics, the website audience measurement (see section 8). Policy: policies.google.com/privacy
• Stripe Inc. (United States / Canada) — payment processing. Policy: stripe.com/privacy
• Competent authorities, only if required by law (subpoena, valid court order).

Transfers outside Canada (e.g. Resend, Stripe and Google, in the United States) are protected by standard contractual clauses (the European Commission's "Standard Contractual Clauses") and the equivalent safeguards of Law 25.

6. Retention periods

• Active account: for the duration of your registration.
• If you delete your account, we destroy your data within 30 days. We keep only the date of your request, a fingerprint of your IP address for 12 months, and, when a real payment took place, its proof for 6 years after the end of the tax year.
• Technical logs (IP, user agent): 30 days, then anonymized.
• Backups: erased after 8 days.

7. Your rights

Depending on your jurisdiction (GDPR, PIPEDA, CCPA, LGPD, etc.), you have the right to:

• Access: obtain a copy of your data
• Rectification: correct inaccurate data
• Erasure ("right to be forgotten"): delete your account and your data
• Portability: receive your data in a machine-readable format
• Objection: refuse certain processing (marketing, analytics)
• Restriction: freeze the use of your data while a dispute is resolved
• Withdrawal of consent: at any time, without retroactive effect
• Opt-out of sale (California): we do not sell your data, but you can confirm it to us in writing
• Complaint: with the CAI (Quebec), the OPC (Canada), or your local authority (CNIL France, ICO UK, etc.)

To exercise a right: support@hypertrader.ca. Response within 30 days.

8. Cookies and tracking

We only use:

• Session cookie (essential, JWT auth) — no opt-out possible (required for the service)
• Theme preference (localStorage) — cosmetic
• Google Analytics (Google LLC) — website audience measurement: page views, visit duration, referral source, device type (_ga cookies). Only with your consent, given in the consent window on the home page, and withdrawable at any time with the button below. Never in the local app.

No advertising cookies, no Facebook pixel.

9. Security

• HTTPS/TLS everywhere
• Passwords: we store none (email magic link)
• Random session tokens (256 bits) with a __Secure-httpOnly cookie
• Encryption at rest for the database
• Access audits and logs kept 90 days
• Breach notification within 72h (GDPR / Law 25)

10. Children and minors

The Service is restricted to people aged 18 or older. We do not knowingly collect data about minors. If you learn that a child has provided their data, contact us for immediate deletion.

11. Changes to this policy

We may update this policy. Substantial changes will be notified by email 30 days before they take effect. Your continued use of the Service after that date constitutes acceptance.

12. Contact and complaints

For any question about this policy:

• Email: support@hypertrader.ca
• Mail: Groupe Expert (Québec, Canada) (address provided on request)

Supervisory authorities by jurisdiction:

• 🇨🇦 Canada: Office of the Privacy Commissioner of Canada (OPC)
• 🇨🇦 Quebec: Commission d'accès à l'information (CAI)
• 🇪🇺 EU: your national authority (CNIL France, AEPD Spain, BfDI Germany, etc.)
• 🇬🇧 UK: Information Commissioner's Office (ICO)
• 🇺🇸 California: California Privacy Protection Agency (CPPA)
• 🇧🇷 Brazil: Autoridade Nacional de Proteção de Dados (ANPD)
• 🇦🇺 Australia: Office of the Australian Information Commissioner (OAIC)