Privacy Policy
What we collect, why we need it, and who else sees it.
Last updated 21 July 2026 · Version 1.0
The short version. We collect what we need to run your account and pay you, and nothing else. We do not sell your data, we do not run advertising, and we do not store your identity documents. Where we use another company to do something — verify your identity, take a payment, send an email — we have listed them below by name.
1Who is responsible
LEVAFX FZ-LLC, registered in Dubai, United Arab Emirates under registration number 47029689, at FBC51, Compass Building, Al Shoala Road, Dubai, UAE, is the controller of the personal data described here.
For any privacy question, or to exercise a right under section 7, email [email protected].
2What we collect
When you register
| Data | Why |
|---|---|
| Name | To identify your account and address you correctly |
| Email address | To sign you in and send account notifications |
| Phone number | Optional. To contact you about your account |
| Country | To determine whether we can offer you the service |
| Password | Stored only as a cryptographic hash. We cannot read it |
When you use the platform
| Data | Why |
|---|---|
| Trading activity | Positions, orders, balances and history — this is the service |
| Account records | Which evaluations you hold, their phase and status |
| Sign-in attempts | To detect and slow down attempts to guess a password |
When you pay us
| Data | Why |
|---|---|
| Payment amount and status | To create your account when payment clears |
| Blockchain transaction reference | To confirm the payment and provide proof |
We do not receive or store card numbers or bank details. Cryptocurrency payments are processed by our payment provider.
When we pay you
| Data | Why |
|---|---|
| Cryptocurrency address | To send your payout |
| Network | To send it on the right chain |
| Transaction reference | So you can verify the transfer yourself |
Identity verification
Before your first payout we are required to verify who you are. This is carried out by our verification provider, who collects a photograph of an identity document and a short liveness video.
LEVAFX never receives or stores your identity documents. Our provider performs the check and returns only a result — verified, or not — together with a reference number. Their handling of your documents is governed by their own privacy policy, linked in section 4.
Technical data
Our hosting and security providers process your IP address and browser information as part of delivering the site and protecting it from abuse. We do not use this to build a profile of you.
3Why we are allowed to hold it
Depending on the data, we rely on one of the following:
- Performing our contract with you — your account, trading records, payments and payouts. Without these we cannot provide the service.
- Legal obligation — identity verification and the records we must keep in connection with it.
- Our legitimate interests — protecting the platform from fraud and abuse, keeping a record of administrative actions, and improving the service. We balance this against your interests and use the minimum needed.
- Your consent — where we ask for it separately, such as optional marketing. You can withdraw consent at any time.
4Who else sees your data
We use the following companies to operate the service. Each processes data only on our instructions and only for the purpose described.
| Provider | What they handle |
|---|---|
| Supabase | Database and authentication. Holds your account, trading records and email address |
| Render | Hosts the service that runs price data, payments, verification and email |
| Cloudflare | Website delivery, security, and sending our emails |
| Resend | Sends sign-in and password reset emails |
| Didit | Identity verification. Receives and holds your identity documents. We receive only the result |
| PayGate.to | Processes cryptocurrency payments to us |
| Finnhub | Supplies market price data. Receives no personal data |
We will also disclose data where we are legally required to — for example in response to a valid order from a court or regulator — and where necessary to establish or defend a legal claim.
We do not sell your personal data. We do not share it with advertisers. We do not run advertising on this platform.
5Where your data goes
Our providers operate in several countries, including the United States and within the European Union. Where data leaves the United Arab Emirates, we rely on the contractual protections our providers offer, including standard contractual clauses where applicable.
6How long we keep it
| Data | Kept for |
|---|---|
| Account and profile | While your account exists, then up to 5 years |
| Trading records | Up to 5 years, so we can answer a dispute about a past account |
| Payment and payout records | Up to 7 years, for accounting and regulatory purposes |
| Verification result | Up to 5 years after your last payout |
| Sign-in attempt logs | 24 hours |
| Email delivery records | 3 days |
These periods reflect the time during which a dispute could reasonably arise or a legal obligation could apply. Where a shorter period applies under law that governs you, we will apply the shorter period.
7Your rights
Depending on where you live, you may have the right to:
- Access the personal data we hold about you
- Correct anything inaccurate
- Delete your data, where we are not required to keep it
- Object to or restrict how we use it
- Receive a copy in a portable format
- Withdraw consent where we relied on it
- Complain to your data protection authority
To exercise any of these, email [email protected]. We will respond within 30 days. We may need to verify your identity first, so that we do not disclose your data to someone else.
Some data we cannot delete on request — for example payment records we are required to retain. Where that applies we will tell you which data and why.
8Cookies and similar technology
We use only what the platform needs to work:
- Session storage to keep you signed in and to remember an in-progress payment while you complete it
- Security cookies set by Cloudflare to distinguish visitors from automated traffic
We do not use advertising cookies, tracking pixels, or third-party analytics that profile you. There is nothing here to opt out of, because we are not collecting anything for that purpose.
9Security
We protect your data with:
- Encryption in transit on every connection
- Passwords stored only as cryptographic hashes, never in readable form
- Database rules that scope every record to its owner, enforced by the database itself rather than by the website
- An append-only log of administrative actions on accounts
- Restricted access to production systems
No system is completely secure. If a breach occurs that is likely to affect your rights, we will notify you and any relevant authority without undue delay.
10Children
This service is for adults. We do not knowingly collect data from anyone under 18. If you believe a child has registered, contact us and we will delete the account and its data.
11Changes to this policy
If we change this policy materially, we will email you and publish the change here with a new version number and date. Minor clarifications may be made without notice.
12Contact
LEVAFX FZ-LLC
FBC51, Compass Building, Al Shoala Road
Dubai, United Arab Emirates
[email protected]