This Privacy Notice describes how OBSIDIA collects, uses, stores, and protects the personal data of users of the platform available at obsidiachart.com (the "Service").

It complies with the requirements of Law 29733 (Personal Data Protection Law of Perú), its enabling regulation, Regulation (EU) 2016/679 (GDPR) for European users, and applicable international standards.

1. Data Controller

Jesús Calderón, individual natural person
Domicile: Av. Arenales 2252, Lince, Lima, Perú
Contact for data protection matters: Obsidialabs.sol@gmail.com

2. Data We Collect

Category	Specific data	Source
Identity	Full name, email, profile picture, Google user ID (sub)	Google OAuth 2.0 (provided by the User)
Session	JWT token (30-day duration), IP address, browser (User-Agent), timestamps of access	Automatic on login
Exchange credentials	API keys of Binance / WEEX / BitMart, encrypted with AES-256-GCM	Voluntarily provided by the User
Trading activity	Configured pairs, active indicators, bot mode (dry-run / real), bot signals and orders	Generated by the use of the Service
Payment	Transaction ID from Paddle, plan status, dates of charges (we do NOT store card numbers)	Paddle (payment processor)
Technical (potential future)	Google Analytics 4 metrics (page views, sessions, geographic region) — not currently implemented	Reserved for future implementation with explicit opt-in

3. Purposes of Processing

• Authentication and access: verify your identity and maintain your active session
• Service provision: execute your orders on exchanges via API
• Personalization: remember your indicator preferences, pairs, and bot configuration
• Billing: process your subscription via Paddle
• Security: detect and prevent fraud, brute force attacks, and abuse of the Service
• Legal compliance: respond to legitimate requests from Peruvian authorities or from jurisdictions where the User resides

4. Third Parties with Whom We Share Data

Third party	Purpose	Data shared
Google (OAuth)	User authentication	The User authenticates directly with Google; we only receive the profile provided by their consent
Paddle.com Market Limited	Processing of subscription payments (Merchant of Record)	Email, transaction identifier, subscription plan
Binance / WEEX / BitMart	Execution of the User's own orders using their API keys	The connection is between the User's browser and the exchange, proxied through our infrastructure only when necessary. No profile data is shared.
Contabo GmbH	Server hosting (Ubuntu VPS, Germany)	All operational data of the Service (in the physical location of the server)

We do not share data with advertising networks, data brokers, or trackers.

5. Data Security

OBSIDIA implements industry-standard technical measures:

• Symmetric encryption AES-256-GCM for API keys of exchanges stored at rest
• HTTPS/TLS 1.3 for all data in transit
• Signed JWT tokens with rotation of the SESSION_SECRET
• Restrictive firewall on the VPS (only ports 443 and 22 exposed)
• Encrypted backups of the credentials database
• Access logs retained for 90 days for forensic auditing

No system is 100% impenetrable. If we detect a security incident affecting the User's data, we will notify them within 72 hours of confirmation of the incident, as required by GDPR and Law 29733.

6. Data Retention

Data	Retention period
Active account	Until the User deletes it
Deleted account — identity data	Immediate deletion (within 30 days for hot backups)
Financial records (invoices, transactions)	5 years (Peruvian tax obligation)
Access logs	90 days
Trading activity — anonymized	May be retained indefinitely for statistical analysis, without link to the User's identity

7. Cookies and Local Storage

OBSIDIA uses:

• Session cookies (technical, essential): vc_session to keep the session active. Cannot be disabled.
• localStorage in the browser: to persist your UI preferences (chart theme, active indicators). Cannot be shared with third parties.
• Google OAuth cookies: managed by Google during the authentication flow (see the Google Privacy Policy).

We do NOT use tracking cookies, advertising cookies, or third-party analytics without your explicit consent.

If in the future we implement Google Analytics or a similar tool, we will request opt-in via a cookie banner before activating any tracking.

8. International Data Transfers

Your data is processed on servers located in Germany (Contabo) and, incidentally, in the countries where our providers operate:

• Google: United States and other jurisdictions
• Paddle: United Kingdom and European Union
• Exchanges: various jurisdictions (see the policies of each exchange)

For European users, these transfers are covered by Standard Contractual Clauses (SCCs) approved by the European Commission, when applicable.

9. Rights of the Data Subject

You have the following rights (recognized by Law 29733 in Perú, GDPR in the EU, and other equivalent regulations):

• Access — obtain a copy of the personal data we hold about you
• Rectification — correct inaccurate or outdated data
• Deletion ("right to be forgotten") — request the deletion of your account and associated data
• Opposition — object to processing based on legitimate interest
• Portability — receive your data in a structured, machine-readable format (JSON)
• Restriction — temporarily limit the processing of your data
• Withdraw consent — at any time, without retroactive effect

To exercise any right, write to Obsidialabs.sol@gmail.com with the subject "Data protection rights". We will respond within a maximum of 15 business days (or 30 calendar days in the EU per GDPR).

If you consider that we have not addressed your request properly, in Perú you may file a complaint with the National Authority for Personal Data Protection (ANPD) or in the EU with the supervisory authority of your country.

10. Minors

The Service is not directed at persons under 18 years of age. We do not knowingly collect personal data of minors. If we discover that a minor has created an account, we will delete it immediately.

11. Changes to This Notice

We may update this Notice. Material changes will be notified with at least 15 days' notice via email or a prominent banner. The "Last updated" date at the top reflects the current version.

12. Contact

For any question about this Notice or the processing of your personal data:

Jesús Calderón
Av. Arenales 2252, Lince, Lima, Perú
Email: Obsidialabs.sol@gmail.com