Privacy policy

Last updated November 12, 2026

This policy explains how Bitlot ("we", "us") collects and uses personal data when you use our website and app.

Data we collect

Account data: your email address and the details you provide when you sign up or contact us.
Exchange API keys: the API keys you link. They are stored encrypted and used only to read your account and place trades you have configured.
Trading activity: balances, orders, positions and fills read from your exchange through your API key, and the settings you choose in Bitlot.
Fuel and payments: fuel top-ups, fees charged, withdrawals and referral earnings.
Technical data: IP address and device information, used for security and to apply geographic restrictions required by law and by exchanges.
Website analytics: this marketing site uses cookieless analytics (Cloudflare Web Analytics), which counts page views without setting cookies or building a profile of you.

Why we use it

To provide the service: link your exchange, run the tools you enable and show your results.
To charge fees, process fuel top-ups and withdrawals, and pay referral earnings.
To keep accounts and keys secure, prevent fraud and enforce restricted jurisdictions.
To meet legal obligations and respond to lawful requests.
To support you and tell you about important changes to the service.

We keep account and transaction data while your account is open and for as long as needed afterwards to meet legal, accounting and dispute-resolution requirements. API keys are deleted when you unlink an exchange or close your account.

Exchanges: we communicate with your exchange using your API key, to read your account and place orders.
Service providers: hosting, email and payment providers who process data on our behalf under contract.
Authorities: where required by law.

We do not sell your personal data.

Your rights

Depending on where you live, you may have the right to access, correct, delete or export your personal data, to object to or restrict certain processing, and to complain to a data protection authority. To exercise these rights, contact us.

Security

We encrypt API keys at rest, use encrypted connections, and limit internal access to personal data. No system is perfectly secure, so please also protect your login and revoke keys you no longer use.

Contact

Privacy questions or requests: [email protected].