Privacy Policy

1. Who we are

This Privacy Policy explains how Tufdog ("Tufdog", "we", "us" and "our" mean Tufdog and any entity acting on its behalf) handles personal information when you use the Tufdog website, web app and apps (the "Service"). It applies to visitors and to members. Tufdog's registered company details will be published on this page once Tufdog is registered. Until then, you can send any notice to us at support@tufdog.com.

Data controller: Tufdog is the data controller of your personal information. Our platform provider, Victoi, Inc., processes it on our behalf to provide the Service, and is responsible on its own account only for what it must do to meet its own legal obligations (for example payment, fraud-prevention and anti-money-laundering duties).

Tufdog runs on technology provided by Victoi, Inc., a Delaware corporation ("Victoi", our "platform provider"), which operates the ledger your balance is kept in, the order book your orders are matched on, the market maker and the deposit payment page. Victoi processes your information for those purposes as described below.

2. Information we collect

Information you give us

• Account details: your email address, the display name you choose, your preferred language, and your confirmation that you are 18 or older and accept our Terms.
• Support messages: what you tell us when you contact us.
• Identity information, only if we ask you to verify your identity in future (see "Identity checks").

Information from sign-in providers

• Google: if you continue with Google, Google sends us your Google account identifier and email address (and whether Google has verified it). We do not receive your Google password, contacts or other Google data.
• Apple: if you continue with Apple, Apple sends us an Apple identifier and an email address — which may be a private relay address if you choose to hide yours — and, the first time only, the name you share. We do not receive your Apple ID password.

Information created when you use the Service

• Trading and balance records: your deposits, balance, orders, trades, positions, settlements and fees.
• Security and session information: your IP address, browser and device type (user agent), a device identifier, how and when you signed in, your sessions, and records of sign-in codes we sent (we store the code only in a protected, non-reversible form).
• Acceptance records: the version of the Terms you accepted, when, and from which IP address, browser and locale.
• Approximate location: the country your connection comes from, worked out from your IP address, so we can apply the rules for where you are.
• Technical logs: requests to our servers, kept for security and to fix problems. We remove sign-in codes, tokens, cookies, email addresses and phone numbers from these logs.

Payment information

When you deposit, you enter your card or wallet details on a secure payment page operated by our platform provider. Those details go directly to its payment processor. We and our platform provider receive the result of the payment — such as the amount, currency and status, and the information the processor returns to identify the payment — but not your full card number or security code.

What we do not collect

We do not use advertising or cross-site tracking technologies, and we do not buy information about you from data brokers. We do not knowingly collect information from anyone under 18.

3. How we use your information, and our legal bases

If you are in the European Economic Area, the GDPR requires us to tell you the legal basis for each use of your information, and many other data protection laws do the same. The table below does both.

We do not use your information for advertising, and we do not make decisions about you based solely on automated processing that have legal or similarly significant effects. Automated checks (for example fraud or location checks) may block an action; you can ask us to review it.

4. Identity checks

We do not currently ask for identity documents. If we need to verify your identity in future — for example before withdrawals, or because the law requires it — a specialist verification provider may collect your name, date of birth, address, an identity document and a selfie, check them, and share the result with us and our platform provider. We will tell you before we ask, and update this policy.

5. Who we share your information with

• Our platform provider, Victoi, which runs the ledger, order book, market maker and deposit payment page the Service depends on. Victoi uses your information to provide those services to us, to keep them secure, and to meet its own legal obligations.
• Payment processor: the processor used by our platform provider receives the details you enter on the payment page.
• Service providers that host and run the Service for us, such as cloud hosting and email delivery. They may only use your information to provide their service to us.
• Google and Apple, only if you choose to sign in with them, to confirm your identity.
• Other members see your display name where the Service shows it. They do not see your email or your balance.
• Authorities, regulators and courts, when the law requires it, or to protect our rights, our members or the public — for example to prevent fraud.
• A buyer or successor, if the Service or our business is sold or reorganised. They must continue to protect your information as this policy describes.

We do not sell your personal information, and we do not "share" it for cross-context behavioural advertising as those terms are used in California law.

6. International transfers

The Service is hosted in the United States, and our platform provider and service providers may process your information in the United States and other countries. Their laws may not protect personal information in the same way as yours. When we transfer information from the EEA to a country without an adequacy decision, we rely on an adequacy decision where one applies (such as the EU-US Data Privacy Framework, for recipients certified under it) and otherwise use appropriate safeguards such as the European Commission's Standard Contractual Clauses. You can ask us for a copy.

7. How long we keep your information

• Account details: while your account is open, then as described below.
• Balance, deposit and trading records, and Terms acceptance records: 7 years after your account closes, or longer if the law requires it or a dispute or investigation is still open. Financial and anti-money-laundering laws usually require these records to be kept for several years after an account closes.
• Security and access logs: 12 months.
• Sign-in codes expire within minutes; the protected record of a code is kept with the security logs.
• Your signed-in session ends after 30 minutes without activity and after 12 hours at most.

When you close your account, we stop using it to provide the Service and release your email and sign-in identifiers so they can be used again. We keep the records the law or our legitimate interests require for the period above, then delete or anonymise them.

8. How we protect your information

We use encryption in transit, encrypted storage for sensitive fields, secure session cookies that scripts cannot read, protection against cross-site request forgery, short-lived sign-in codes and access controls. No system is perfectly secure; if a breach affects you, we will tell you and the authorities as the law requires.

9. Your rights

Depending on where you live, you may have the right to:

• know what personal information we hold about you and get a copy of it;
• correct information that is wrong or incomplete;
• have your information deleted, unless we must keep it (for example trading records the law requires us to keep);
• receive your information in a portable format;
• object to, or ask us to restrict, how we use it — including any use based on our legitimate interests;
• withdraw consent where we rely on it;
• not be treated differently for exercising your rights.

To use any of these rights, email privacy@tufdog.com from the email address on your account. We may need to confirm it is you. We will reply within the time the law sets (usually one month in the EEA, and 45 days in California). An authorised agent may ask on your behalf with proof of your permission.

European Economic Area

If you are in the EEA, the GDPR gives you the rights above, and the right to complain to a data protection authority. Tufdog has no establishment in the EEA, so there is no lead supervisory authority: you can complain to the data protection authority of the EEA country where you live, work or think your rights were infringed. EU representative: because Tufdog is not established in the European Union, we will appoint a representative in the EU under Article 27 of the GDPR, and publish their name and contact details here. Until then, please contact us at privacy@tufdog.com; your request has the same effect. Data Protection Officer: we have not appointed a Data Protection Officer. Our privacy team answers every privacy question at privacy@tufdog.com.

Complaining to a data protection authority

Wherever you live, you can complain to the data protection authority of the country where you live or work. We would like the chance to deal with your concern first, so please contact us at privacy@tufdog.com before you do.

United States

If you live in California or another US state with a consumer privacy law, the categories of personal information we collect are those described in "Information we collect": identifiers (email, account and device identifiers, IP address), commercial information (deposits and trading records), internet activity (session and log information), and approximate geolocation. We collect them from you, your device and your sign-in provider, for the purposes in "How we use your information", and disclose them only to the recipients in "Who we share your information with". We do not sell or share personal information for targeted advertising, and we do not use sensitive personal information to infer characteristics about you. If you are refused a request, you may be able to appeal by replying to our decision.

10. Making a data request

1. Email privacy@tufdog.com from the address on your account, saying which right you want to use (for example "a copy of my data" or "delete my account data").
2. We confirm it is you — usually by a one-time code to your account email. If someone asks for you, we also need proof that you authorised them.
3. We reply within the time the law sets: usually one month in the EEA (extendable by two months for complex requests, in which case we tell you), and 45 days in California.
4. Copies of your data are sent in a common, machine-readable format. There is no charge, unless a request is clearly unfounded or excessive.
5. If we cannot do all you ask — for example because the law requires us to keep trading records — we tell you why and what we did do.

11. Children

The Service is only for people aged 18 or over. If we learn we have information about someone under 18, we close the account and delete what the law allows us to.

12. Cookies and local storage

We use only cookies and browser storage that the Service needs to work, such as keeping you signed in securely. Our Cookie Policy lists each one.

13. Changes to this policy

We will update this policy when how we handle personal information changes. The version and effective date are at the top. We will tell you about material changes by email or on the Service before they apply.

14. Contact us

Privacy questions and requests: privacy@tufdog.com. Tufdog's registered company details will be published on this page once Tufdog is registered. Until then, you can send any notice to us at support@tufdog.com.