GDPR Rights

If you are a resident of the European Economic Area, the United Kingdom, or any jurisdiction with comparable privacy law (CCPA, PDPA, etc.), you have the rights below. Orca treats them as universal: anyone can request them regardless of location.

Your rights

• Right of access — request a copy of all personal data we hold on you.
• Right of rectification — correct inaccurate or incomplete data via Settings → Profile.
• Right of erasure — delete your account and all associated data within 30 days.
• Right of portability — receive your trading history (orders, trades, P&L) as JSON or CSV.
• Right to restrict processing — pause notifications or stop bots without deleting the account.
• Right to object — object to processing for analytics or marketing.
• Right to withdraw consent — revoke notification opt-ins at any time from Settings → Notifications.
• Right not to be subject to automated decision-making — Orca does not make legally significant automated decisions about you.

How to exercise them

Most rights can be exercised directly from your account:

• Export: Settings → Profile → "Export my data". Generates a JSON archive of your account, bots, orders, trades, and notification logs.
• Deletion: Settings → Profile → "Delete my account". All bots are stopped, encrypted API keys are erased, and all personal data is purged within 30 days.
• Manual requests: email privacy@orca.local with your registered email address. We respond within 30 days.

Data we are legally required to retain

Even after account deletion, we may retain anonymized aggregates and certain billing records where required by tax law (typically 5–7 years depending on jurisdiction). These records do not contain identifiable trading activity.

Lodging a complaint

If you believe we have not handled your data properly, you have the right to lodge a complaint with your local data protection authority. We strongly encourage you to contact us first so we can resolve the issue directly.

Data Protection Officer

Contact: dpo@orca.local.