Privacy Policy

Effective date: October 16, 2026 Version: 1.2 Applies to: https://hyperfx.pro and all related HyperFX services, applications, and features (collectively, the "Service").

1. Introduction

This Privacy Policy explains how HyperFX ("HyperFX", "we", "us", or "our") collects, uses, discloses, and protects personal data when you visit https://hyperfx.pro, create an account, or otherwise use the Service.

HyperFX provides market-data analysis for a user-confirmed crypto or forex instrument and timeframe, token research and wallet-connected trading tools on eligible routes, a private analysis history, a journal and educational materials. Current Analyze checks live OHLCV and can return LONG, SHORT or NO TRADE; it does not accept a chart screenshot as the current analysis workflow. Outputs are informational, not personalized advice or a promise of returns. Public performance reporting is not currently published. Such tracking is informational only and does not guarantee the accuracy of any prediction or any future result (see our Risk Disclosure and Disclaimer). HyperFX does not provide financial, investment, or trading advice, personalized recommendations, solicitations, offers to buy or sell any asset, or portfolio management, and is not a broker, exchange, financial advisor, or fiduciary. HyperFX is not regulated or authorized by any financial authority unless expressly stated. Crypto and forex are high-risk; you can lose all of your capital, leverage magnifies losses, and past performance does not indicate future results. This Privacy Policy describes our data practices only; for the terms governing your use of the Service, please see our Terms of Service, and for risk-related disclosures, our Risk Disclosure and Disclaimer.

We have structured this policy in layers: each section begins with the essentials, followed by detail. Please read it together with our Cookie Policy, which describes our use of cookies and similar technologies.

By using the Service, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with it, please do not use the Service.

2. Data controller and contact details

The data controller responsible for your personal data is:

• Controller: HyperFX, owner of the domain hyperfx.pro (support@hyperfx.pro)
• Registration / VAT number (if applicable): Not applicable
• Privacy / data protection contact: support@hyperfx.pro

Based on our current assessment of Article 37 of the GDPR, we are not required to appoint a statutory Data Protection Officer (DPO). We keep this assessment under review, in particular in light of any large-scale processing, behavioural tracking, or AI processing we carry out, and we will appoint a DPO and update this policy if that becomes necessary. You may direct all privacy enquiries to support@hyperfx.pro.

EU/UK representative (Article 27 GDPR): We have not appointed a representative in the European Economic Area (EEA) or the United Kingdom under Article 27 GDPR. Not applicable. You may direct all privacy enquiries to support@hyperfx.pro.

3. Summary — at a glance

4. The personal data we collect

We collect the following categories of personal data. Not all of it applies to every user; the data we hold about you depends on how you use the Service.

4.1 Account and profile data

• Name or username, email address, and password (stored in hashed form).
• Account preferences, such as your interface language (EN/RU/ES/FR/AR/TR/KO/PT/zh-Hans/zh-Hant) and display settings.
• Authentication identifiers if you sign in via a third-party login provider (OAuth), such as your provider user ID and the email address associated with it.
• Referral data: your referral code, and the relationship between referring and referred accounts where you participate in our referral program.

4.2 Content you provide

• Analysis inputs and records: your confirmed instrument, timeframe, selected parameters and saved results. Existing image-analysis records may be retained from the former workflow; the current Analyze route does not request new screenshots. Do not include sensitive information in journal entries or support messages.

Wallet and transaction data. A connected public address, chain, quote/request identifiers, public transaction hashes and submission/confirmation status may be associated with your account to operate the requested flow and reconcile fees or rewards. Wallet, routing and RPC providers may receive the public address and network/transaction data needed for that flow under their own policies. HyperFX does not ask for a seed phrase or private key.

• Trade journal entries, notes, tags, strategies, setups, and other content you create or store in the Service.
• Communications you send us, such as support requests, feedback, and survey responses.

4.3 Usage and analytics data

• Pages and features viewed, actions taken, session duration, referring/exit pages, and interaction events.
• Aggregated and event-level product analytics used to understand and improve the Service.

4.4 Device and technical data

• IP address, approximate location derived from IP (e.g., country/region), browser type and version, operating system, device type, screen/viewport size, language settings, and time zone.
• Log data, including timestamps, requested URLs, status codes, and diagnostic information.
• Error and crash reports, which may include technical context and, occasionally, fragments of data present at the time of an error.

4.5 Payment data

• Payments are made in cryptocurrency (USDT/USDC) through a direct on-chain invoice or, where available and configured, a third-party non-custodial crypto payment processor. HyperFX does not accept card payments and never receives or stores your card details or wallet private keys.
• We receive and retain limited payment metadata, such as subscription/plan type, status, transaction (including on-chain transaction) identifiers, the wallet address or network used, invoice records, and the start/renewal/cancellation dates of your subscription.

4.6 Cookies and similar technologies

• Essential storage supports authentication, security and cookie choices; device preferences and our own browser measurement/referral attribution require the corresponding opt-in. No third-party analytics or advertising cookies are used. A requested external wallet/sign-in session is separate and subject to its provider's notices. See Section 8 and our Cookie Policy.

We do not intentionally collect special categories of personal data (such as data revealing health, political opinions, or religious beliefs). Please do not include such data in chart screenshots, journal entries, or communications.

4.7 Whether providing data is mandatory, and consequences of not providing it

Some personal data is necessary to create an account and use the Service; without it, we cannot provide the Service or specific features. In particular:

• Account authentication: the email/password, wallet signature or configured sign-in identifier required for the method you choose. We do not request a seed phrase or private key.
• Payment metadata: required to reconcile a paid purchase, whether through a direct on-chain invoice or an available configured crypto processor. We do not receive card details.
• Confirmed instrument and timeframe: required to compute the requested current Analysis. A new chart screenshot is not required; declining market selection prevents that analysis, not use of the rest of the Service.
• Strictly necessary cookies: required for the Service to function securely. Other cookies are optional and depend on your consent.

Providing analytics consent, marketing consent, and optional profile details is voluntary; declining will not prevent you from using the core Service, though some optional features may be unavailable.

5. Sources of personal data

We obtain personal data from:

• You directly, when you register, upload content, configure settings, communicate with us, or use the Service.
• Automatically, through cookies and similar technologies, and through your interaction with the Service (usage, device, and log data).
• Third parties you choose to use, such as a configured payment processor (necessary billing metadata), wallet or OAuth/sign-in provider for the requested flow; direct on-chain invoices do not require a hosted processor.

6. How and why we use your data

We use personal data for the following purposes:

1. To provide the Service — operating your account, processing confirmed market-analysis requests, storing private history and journal content, and providing the requested research and wallet-connected tools. 2. To process payments and manage subscriptions — reconciling direct on-chain invoices or configured processor payments, paid access, manual renewals, cancellations, lifetime purchases and referral records. 3. To communicate with you — sending service and transactional messages (e.g., account, billing, security, and policy-change notices) and responding to your enquiries. 4. To secure the Service — authenticating users, preventing and detecting fraud, abuse, and unauthorized access, and maintaining the integrity and availability of the Service. 5. To improve and develop the Service — analyzing usage, diagnosing errors, performing research, and developing new and existing features. 6. To send marketing communications — where permitted, informing you about features, offers, and updates. You can opt out at any time (see Section 13). 7. To comply with legal obligations — meeting tax, accounting, and other statutory requirements, and responding to lawful requests from authorities. 8. To enforce our terms and protect rights — establishing, exercising, or defending legal claims and enforcing our Terms of Service.

6.1 AI processing and automated analysis

Current Analyze processes the instrument/timeframe you confirm and market-data snapshots, not a newly uploaded chart screenshot. Where an optional AI explanation is enabled and permitted, the necessary analysis context may be sent to its configured provider; this is not a general permission to send private account or journal data. Historical image-analysis records remain subject to the retention and deletion rules. Automated output is informational, may be inaccurate and is not financial advice or a guarantee of any result.

We do not consider this analysis to involve solely automated decision-making producing legal or similarly significant effects within the meaning of Article 22 of the GDPR: the analysis is a tool you choose to use, and we do not use it to make any decision about you. This reflects HyperFX's current view (subject to review by counsel) rather than a binding legal conclusion. To the extent that Article 22 GDPR is found to apply, you have the rights described in Section 15, including the right to obtain human intervention, to express your point of view, and to contest the decision.

6.2 Profiling and behavioural analytics

We do not use third-party web analytics, external error tracking or advertising trackers. Essential first-party operational/security logs support delivery, diagnostics, abuse prevention and availability. Optional browser product-usage events and campaign/referral attribution are separate: OFF until consent, stopped on withdrawal or expiry. Legitimate interests do not override that browser choice. We do not carry out automated profiling producing legal or similarly significant effects about you. You may object to legitimate-interest processing or withdraw optional consent through Cookie settings or support@hyperfx.pro (see Sections 8.1, 13 and 15).

7. Legal bases for processing (GDPR)

Where the GDPR applies, we rely on the following legal bases under Article 6(1):

Where we rely on legitimate interests, we have balanced those interests against your rights and freedoms. You may object to such processing at any time (see Section 15). Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.

8. Cookies and similar technologies

Strictly necessary storage supports authentication, security, cookie choices and recovery of actions you initiate. Device preferences and first-party browser measurement/referral attribution are optional, OFF until you opt in and can be refused or withdrawn. We do not use third-party analytics or advertising cookies. Refusing optional categories does not block the core Service.

For a full description of the cookies we use, their categories, purposes, durations, and how to manage your preferences, please see our Cookie Policy.

8.1 Do Not Track (DNT) and Global Privacy Control (GPC)

"Do Not Track" (DNT) is a browser setting that signals a preference not to be tracked. There is currently no industry or legal consensus on how to interpret DNT signals, and we therefore do not respond to DNT signals at this time.

Some browsers and extensions transmit a Global Privacy Control (GPC) signal, which communicates a request to opt out of the "sale" or "sharing" of personal information and of certain targeted advertising. Where required by applicable law (including the California Consumer Privacy Act as amended by the CPRA, and other US state privacy laws that recognize such signals), we treat a recognized GPC signal received from your browser or device as a valid opt-out request for that browser or device. Because such signals are tied to a specific browser/device and are typically not associated with a logged-in account, the opt-out may not extend across all of your devices or sessions.

As an implemented product safeguard, recognized GPC disables optional first-party measurement/attribution for that browser/device even over an earlier opt-in. Essential storage and separately selected interface preferences remain available.

9. Data retention

We keep personal data only for as long as necessary for the purposes set out in this policy, after which it is deleted or anonymized. The retention periods below are indicative ranges that will be confirmed against final legal and operational requirements:

• Uploaded chart images: retained only briefly (typically deleted within 24–72 hours, or sooner) to perform the requested AI analysis and deliver the result to you. Under our agreement with the AI provider, uploaded images are processed only to generate your analysis and, per that provider's terms in force, are not used to train the provider's AI models. We do not control the provider's internal practices in perpetuity and will update this statement if the provider's terms change. Where you save analysis output to your journal, the saved output (not necessarily the original image) is retained as part of your account content. This paragraph concerns historical records from the retired image workflow, not a current request for screenshots or permission to send new private content to an AI provider.
• Account and profile data: retained for the life of your account and deleted (or anonymized) typically within 30–90 days after account closure, subject to legal retention requirements.
• Journal entries and user content: retained while your account is active; you may delete individual entries at any time, and remaining content is removed when your account is deleted (typically within 30–90 days of deletion).
• Payment and billing metadata: retained as required for tax, accounting, and audit purposes, typically 6–10 years depending on applicable law.
• Usage, analytics, and log data: retained for a limited period sufficient for security, troubleshooting, and analysis — typically up to 12–24 months — then deleted or aggregated. Security and access logs may be kept for a shorter period (e.g., 30–90 days) unless needed for an investigation.
• Support communications: retained for as long as needed to handle your request and typically up to 24 months thereafter.
• Consent and opt-out records: the current browser choice, timestamp and policy version are stored for up to 12 months, then a new choice is required. Refreshing another cookie never extends that original consent timestamp. Records of separately handled consent/privacy requests may be retained only as needed for compliance or legal claims; they do not reactivate optional browser processing.
• Browser transaction recovery: requested wallet actions may store quote/request IDs, public addresses, hashes and status; signed Solana transaction bytes may be kept for uncertain-broadcast recovery, not a seed phrase/private key. Eligible windows are 20 minutes (signed Solana), 2 hours (EVM approval) and 7 days (EVM submission). Completed/reconciled entries are cleared by their flow. These are read-time eligibility limits, not guaranteed physical erasure at the deadline: expired copies can remain until the recovery journal is rewritten or browser storage is cleared. Refusing/withdrawing optional consent never deletes authentication, payment-return state or pending transaction/approval recovery. Clearing browser storage may prevent recovery but cannot erase blockchain/server payment records.

Where exact periods are not stated, we determine retention based on the criteria above: the purpose of processing, the sensitivity of the data, legal obligations, and the need to defend legal claims.

9.1 Closing your account and deleting your data

You can close your account and trigger deletion of your account data at any time by:

• using the in-Service account settings / "Delete account" option (self-service), where available; or
• emailing support@hyperfx.pro with a deletion request from the email address associated with your account.

On account closure or a valid deletion request, we will delete or anonymize your account and content within the timeframes in Section 9, except where we are required or permitted by law to retain certain data (for example, payment and tax records) or where retention is necessary to establish, exercise, or defend legal claims. We may retain anonymized/aggregated data that no longer identifies you.

10. How we share your data — third parties, processors, and sub-processors

We do not sell your personal data, and we do not share it for cross-context behavioural advertising or with third parties for their own independent marketing.

We share personal data with carefully selected service providers ("sub-processors") who process it on our behalf under contractual obligations (including, where the GDPR applies, data processing agreements). The categories and current key providers are:

We may also disclose personal data:

• to professional advisers (e.g., lawyers, accountants, auditors) under confidentiality;
• to authorities, regulators, or courts where required by law or to protect our rights, users, or the public;
• in connection with a merger, acquisition, financing, or sale of assets, in which case we will require the recipient to honour this policy or notify you of any material change.

10.1 Sub-processor list and change notifications

We maintain a current list of our sub-processors, which we make available at https://hyperfx.pro/subprocessors (or on request at support@hyperfx.pro). Where the GDPR applies and we act as a processor, or where we have otherwise committed to do so, we will give advance notice (where reasonably practicable, at least 14–30 days) before adding or replacing a sub-processor that processes your personal data, and you may object to a new sub-processor on reasonable, data-protection-related grounds within the notice period. If we cannot reasonably accommodate a valid objection, you may be entitled to terminate the affected paid service in accordance with the Terms of Service.

11. International data transfers

We and relevant providers may process personal data outside your country, including outside the EEA/UK. Locations depend on the selected flow and activated provider; an external processor or AI provider is not assumed to use our hosting region. See Section 10 and applicable provider disclosures; the safeguards below still apply.

Where we transfer personal data internationally, we rely on appropriate safeguards, such as:

• transfers to countries covered by an adequacy decision of the European Commission (or the relevant authority); or
• Standard Contractual Clauses (SCCs) approved by the European Commission (and the UK International Data Transfer Addendum, where applicable); together with
• supplementary technical and organizational measures where appropriate.

You may request more information about the safeguards applied to a specific transfer, including a copy of the relevant clauses, by contacting support@hyperfx.pro.

12. Service availability and your eligibility

The Service is offered on a global basis, but its legal and regulatory availability is not guaranteed in every jurisdiction. Some countries and regions restrict or prohibit access to crypto- and forex-related information services, tools, or trading. We make no representation that the Service, or your trading or use of crypto/forex more generally, is lawful or appropriate in your location.

You are solely responsible for determining your own eligibility and for complying with all laws applicable to you, including those governing access to crypto/forex services and the use of such information. By using the Service, you confirm that doing so is lawful in your jurisdiction. We may restrict or block access from certain jurisdictions at our discretion. Our processing of data about cross-border users is carried out in accordance with this policy and the safeguards in Section 11.

13. Data security

We implement appropriate technical and organizational measures designed to protect personal data against unauthorized access, loss, misuse, alteration, or destruction. These include, as appropriate: encryption in transit (and at rest where applicable), access controls and authentication, the principle of least privilege, network and application security controls, logging and monitoring, and vendor due diligence.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You are responsible for keeping your account credentials confidential and for using a strong, unique password.

13.1 Marketing opt-out

Where we send marketing communications based on your consent or, where permitted, our legitimate interests, you can opt out at any time by using the unsubscribe link in our messages or by contacting support@hyperfx.pro. Opting out of marketing does not affect service or transactional messages necessary to operate your account.

14. Data breach handling and notifications

We maintain procedures to detect, assess, and respond to personal data breaches.

EEA/UK (GDPR): Where a breach is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority without undue delay and, where feasible, within 72 hours of becoming aware of it, as required by Article 33 of the GDPR. Where a breach is likely to result in a high risk to you, we will also inform affected individuals without undue delay, in accordance with Article 34.

United States and other regions: Where applicable US state breach-notification laws (or other laws applicable to you) require it, we will notify affected residents and any relevant authorities within the timeframes and by the methods those laws require. As a general commitment, regardless of your location, where a confirmed breach is likely to materially affect you, we will take reasonable steps to notify you (for example, by email or in-Service notice) and to describe the nature of the breach, the likely consequences, and the measures we are taking.

Security contact: To report a suspected security issue or vulnerability, or if you believe your account has been compromised, contact us at support@hyperfx.pro.

15. Your rights

Subject to applicable law, you have the following rights in respect of your personal data:

• Access — obtain confirmation of whether we process your data and a copy of it.
• Rectification / correction — have inaccurate or incomplete data corrected.
• Erasure ("right to be forgotten") — have your data deleted in certain circumstances.
• Restriction — limit how we process your data in certain circumstances.
• Portability — receive certain data in a structured, commonly used, machine-readable format, and have it transmitted to another controller where technically feasible.
• Objection — object to processing based on legitimate interests, including profiling, and to direct marketing at any time.
• Withdraw consent — where processing is based on consent, withdraw it at any time without affecting prior lawful processing.
• Rights relating to automated decisions — to the extent Article 22 GDPR applies, the right not to be subject to a solely automated decision producing legal or similarly significant effects, and to obtain human intervention, express your view, and contest the decision (see Section 6.1).

15.1 How to exercise your rights

To exercise any of these rights, contact us at support@hyperfx.pro, or use the self-service tools in your account settings where available. We may need to verify your identity before acting. We will respond within one month of receipt (or within the timeframe required by your local law); this period may be extended by up to two further months for complex or numerous requests, in which case we will inform you. We do not charge a fee unless your request is manifestly unfounded or excessive.

15.2 Right to complain

If you are in the EEA, the UK, or another jurisdiction with a data protection authority, you have the right to lodge a complaint with your local supervisory authority. We would, however, appreciate the chance to address your concerns first — please contact us at support@hyperfx.pro.

15.3 United States — California (CCPA/CPRA) and other state privacy rights

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA/CPRA), provides the rights described below. Residents of other US states with comparable laws may have similar rights.

Categories of personal information we collect (mapped to CCPA/CPRA statutory categories), and whether each is disclosed to a service provider for a business purpose:

We collect this information from the sources described in Section 5 and disclose it to the categories of service providers described in Section 10 for the business purposes in Section 6.

We do not "sell" personal information and do not "share" it for cross-context behavioural advertising as those terms are defined under the CCPA/CPRA. We do not knowingly sell or share the personal information of consumers under 16.

Your California rights:

• Right to know the categories and specific pieces of personal information we have collected, the sources, the purposes, and the categories of third parties to whom it is disclosed.
• Right to delete personal information we have collected, subject to legal exceptions.
• Right to correct inaccurate personal information.
• Right to opt out of any sale or sharing of personal information (we do not sell or share; we also honour recognized GPC signals — see Section 8.1).
• Right to limit the use and disclosure of sensitive personal information to what is necessary to provide the Service.
• Right to non-discrimination — we will not discriminate against you for exercising any of these rights (for example, by denying service, charging different prices, or providing a different level of quality).

How to exercise: submit a request to support@hyperfx.pro, or use the in-Service controls where available. We will verify your request as required by law.

Authorized agents: you may use an authorized agent to submit requests on your behalf. We may require the agent to provide proof of your written authorization (or a valid power of attorney) and may require you to verify your own identity directly. We will respond to verifiable consumer requests within the timeframes required by the CCPA/CPRA (generally 45 days, extendable by a further 45 days with notice).

15.4 Other regional rights

Depending on your location, you may have additional rights under local law. To make a request under any such law, contact support@hyperfx.pro.

16. Children

The Service is intended for adults and is not directed to children. We do not knowingly collect personal data from anyone under the age of 18 (or the higher minimum age required in your jurisdiction). If you believe a minor has provided us with personal data, please contact support@hyperfx.pro and we will take steps to delete it.

17. Third-party links and content

The Service may contain links to third-party websites, brokers, exchanges, or content (including affiliate/referral links and tracking of public traders). Affiliate and referral links to brokers or exchanges may earn us commissions, are disclosed as such, and are not endorsements, recommendations, or advice. This Privacy Policy does not apply to third-party sites or services, which have their own privacy practices. We encourage you to review their policies before providing personal data.

18. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, sub-processors, or legal requirements. When we make material changes, we will update the "Effective date" and version above and notify you by appropriate means (for example, by email or an in-Service notice). Where required, we will seek your renewed consent. Continued use acknowledges an informational update; it is never affirmative consent to optional cookies, measurement or a new processing purpose. Where fresh consent is required, we obtain a separate affirmative choice before that optional processing starts.

We keep prior versions on record and can provide them on request.

19. Language

This Privacy Policy is provided in multiple languages. In a conflict or inconsistency, the English version prevails only to the extent permitted by applicable law.

20. Contact us

If you have any questions, requests, or concerns about this Privacy Policy or our data practices, please contact:

• HyperFX
• Email: support@hyperfx.pro
• Operator: HyperFX, owner of the domain hyperfx.pro (support@hyperfx.pro)
• Governing jurisdiction for data-protection purposes: the jurisdiction in which the owner of hyperfx.pro is established