Privacy Policy

Revision 1.0 of 22.09.2026. Effective from the moment of publication at https://sync.trade/legal/en/privacy.

Operator: Sync (the "Operator", "we"). Registration details and the address of the Operator are provided on request to info@sync.trade.

Contacts for personal data matters: e-mail info@sync.trade (subject line "Personal data"), support — https://t.me/sync_trading_support_bot.

1. General provisions

1.1. This Policy is issued pursuant to Part 2 of Article 18.1 of Federal Law No. 152-FZ of 27.07.2006 "On Personal Data" ("Law 152-FZ") and sets out the procedure for processing personal data and the security measures applied by the Operator. The Operator has filed a notification of personal data processing with the authorised body for the protection of the rights of personal data subjects in accordance with Article 22 of Law 152-FZ.

1.2. The Policy applies to all personal data that the Operator receives or may receive in connection with:

• the operation of the website https://sync.trade and its pages, and of the help centre https://help.sync.trade (together, the "Site");
• providing access to the Sync service — software that automates trading orders, running as bots in the Telegram messenger, and its related interfaces (the "Service");
• concluding and performing agreements with users of the Service ("Users"), with affiliate programme participants ("Partners") and with authors and administrators of signal channels ("Channel Authors");
• support requests, enquiries and other communication with the Operator.

1.3. The Operator has appointed a person responsible for organising the processing of personal data (Article 22.1 of Law 152-FZ). Requests to that person are sent to info@sync.trade marked "Personal data"; information about them is provided on request of the data subject and the authorised body.

1.4. The Policy is a publicly available document. The current revision is always published at https://sync.trade/legal/en/privacy; the revision number and publication date are stated in the text. Earlier revisions are kept by the Operator and provided on request.

1.5. By using the Site or the Service, submitting a request or entering into an agreement with the Operator, you confirm that you have read this Policy. Consent to the processing of personal data, where required by law, is given in a separate document (Consent) and is not part of this Policy or of any agreement — as required by Part 1 of Article 9 of Law 152-FZ as amended by Federal Law No. 156-FZ of 24.06.2025.

2. Definitions

Personal data — any information relating directly or indirectly to an identified or identifiable natural person (the data subject).

Processing — any operation on personal data: collection, recording, systematisation, accumulation, storage, clarification (updating, changing), extraction, use, transfer (provision, access), anonymisation, blocking, deletion, destruction.

Service — the Sync software described in the Terms of Service.

Exchange — the cryptocurrency exchange in whose account the User trades independently and to whose API the User voluntarily connects the Service.

API keys — application programming interface keys of the Exchange created by the User in their own Exchange account.

3. The Operator's role

3.1. The Operator is the controller (operator) of personal data in respect of all data listed in Section 4: it independently determines the purposes and means of processing.

3.2. The Operator is not the controller of, and is not responsible for, processing carried out by:

• the Exchange — in respect of your trading account, identification (KYC), balances and operations. The Exchange is an independent controller; your relationship with it is governed by its own documents;
• Telegram — in respect of your account, messages and messenger metadata. The Operator receives from Telegram only the information the messenger passes to the bot (Section 4.3);
• payment services — in respect of your payment instrument details. The Operator does not receive or store the full card number, its expiry date or security code;
• channel authors — in respect of the content they publish.

3.3. The Operator does not act as a processor on behalf of third parties and does not process personal data on the instructions of other controllers.

4. Data subjects, data, purposes, legal bases and retention

4.1. Site visitors

• Data: IP address, browser and device details (user-agent, language), addresses of visited pages, referrer, date and time of the request, a strictly necessary cookie with the chosen Site language.
• Purposes: keeping the Site running and secure, protection against attacks and automated abuse, diagnosing failures, rate-limiting form submissions.
• Legal basis: clause 7 of Part 1 of Article 6 of Law 152-FZ — the Operator's legitimate interests in running and protecting the Site.
• Retention: web server logs — up to 12 months; cookies — as set out in the table in the Cookie Policy.

4.2. Persons submitting a request or feedback via the Site

• Data: name, e-mail address, phone number (if provided), comment text, the address of the page from which feedback was sent, interface language, IP address and time of submission.
• Purposes: contacting the person, replying to the request, consultation, preparing an offer; evaluating the quality of help materials; protection against spam.
• Legal basis: the data subject's consent (clause 1 of Part 1 of Article 6 of Law 152-FZ), given in a separate document (Consent); processing necessary to conclude an agreement at the data subject's initiative (clause 5 of Part 1 of Article 6 of Law 152-FZ).
• Retention: 3 years from the date of the last contact or until consent is withdrawn — whichever comes first; if an agreement is concluded — for its term and 3 years after.

4.3. Users of the Service

Information that the Telegram messenger passes to the bot when the User contacts it, and information the User enters themselves.

• Data:
• identification: numeric Telegram account identifier, username, first and last name from the Telegram profile, chat identifier, interface language;
• Exchange access: name and type of trading bot, Exchange API keys (stored in encrypted form, see clause 4.3.1);
• trading activity: trading settings (position size, leverage, margin mode, stop-loss and target levels, grid and averaging parameters), information about trades and orders received from the Exchange (instrument, direction, size, prices, time, fees, financial result), connected channels, bot status;
• subscription and payment: plan, term, number of bots, applied promo code, amount, currency, payment method and status, transaction identifier at the payment service, masked details of the saved payment method (for example, the last four digits of the card), the saved payment method identifier (in encrypted form);
• technical: registration date, activity log in the Service, error information, subscription and notification status.
• Purposes: performing the Terms of Service — providing access to the Service, generating and sending trading orders to the Exchange according to the User's rules, managing trades, notifications; subscription settlements and invoicing; support; ensuring the security of the Service, detecting abuse and violations; performing obligations imposed by law; protecting the Operator's rights in disputes.
• Legal basis: performance of an agreement to which the data subject is a party (clause 5 of Part 1 of Article 6 of Law 152-FZ); performance of obligations imposed by law (clause 2 of Part 1 of Article 6 of Law 152-FZ); the Operator's legitimate interests in securing the Service and protecting its rights (clause 7 of Part 1 of Article 6 of Law 152-FZ); the data subject's consent — for purposes beyond performance of the agreement.
• Retention: for the term of the agreement and 3 years after its termination (the limitation period); payment and settlement records — for the period set by accounting and tax law, but not less than 5 years; activity logs — 12 months.

4.3.1. On Exchange API keys. API keys are not personal data, but the Operator handles them as confidential information:

• keys are provided by the User voluntarily and are used solely to place and cancel orders and to read the state of the account and positions;
• the User must create keys without withdrawal permission; the Operator has no technical ability to withdraw the User's funds from the Exchange;
• keys are stored in the database in encrypted form; the encryption key is stored separately from the database;
• keys are not passed to third parties and are not displayed in the Operator's interfaces in clear text;
• the User may revoke the keys in their Exchange account at any time — after revocation the Service loses access to the account.

4.4. Affiliate programme participants

• Data: the data in Section 4.3 (as a User of the Service), plus the partner's name, contact details, promo code and links, anonymised statistics of referred Users, amounts accrued and paid out, payout details — crypto wallet address and network, or bank details — and information about payout requests and transfer confirmations.
• Purposes: performing the Affiliate Programme Terms, accounting for referred Users and accruals, paying remuneration, tax and accounting records, preventing abuse.
• Legal basis: performance of an agreement (clause 5 of Part 1 of Article 6 of Law 152-FZ); performance of obligations imposed by law (clause 2 of Part 1 of Article 6 of Law 152-FZ).
• Retention: the period of participation in the programme and 5 years after the last payout (retention periods for settlement documents).

4.5. Signal channel authors and administrators

• Data: Telegram account identifier, username, channel identifier and name, connection and activation details, channel statistics, correspondence about connection and support.
• Purposes: performing the Signal Channel Terms, connecting and supporting the channel, keeping statistics, resolving disputes.
• Legal basis: performance of an agreement (clause 5 of Part 1 of Article 6 of Law 152-FZ); the Operator's legitimate interests in ensuring the integrity of materials in the Service (clause 7 of Part 1 of Article 6 of Law 152-FZ).
• Retention: the period the channel is connected and 3 years after disconnection.

4.6. Persons contacting support

• Data: Telegram account identifier and username, or e-mail address, the content of the request and attached materials, date and time.
• Purposes: handling and replying to the request, confirming the fact of the request, improving the quality of support.
• Legal basis: performance of an agreement (clause 5 of Part 1 of Article 6 of Law 152-FZ); the data subject's consent — for requests from persons who are not Users.
• Retention: 3 years from the date of the last message.

4.7. What we do not collect

The Operator does not request or process: special categories of personal data (health, political opinions, religious beliefs and the others listed in Article 10 of Law 152-FZ); biometric personal data; data about minors (the Service is intended for persons over 18); passport details — except where expressly required by law for paying remuneration to a Partner; full bank card numbers and their security codes.

5. Legal bases and consent

5.1. The Operator processes personal data on the bases listed in Section 4 — separately for each category of data subjects and each purpose.

5.2. Where the basis is consent, it is given in a separate document, the text of which is published at https://sync.trade/legal/en/consent. The consent tick is placed by the data subject themselves, is not pre-ticked and is not combined with acceptance of other documents.

5.3. Consent to receiving advertising and informational messages (Article 18 of Federal Law No. 38-FZ of 13.03.2006 "On Advertising") is given separately from consent to the processing of personal data and is not a condition of providing the Service. A refusal of such messages is accepted at any time and acted on immediately.

5.4. Withdrawal of consent. The data subject may withdraw consent by sending a request to the contacts in the preamble. After withdrawal the Operator stops the processing for which consent was the sole basis. If the Operator has another legal basis (performance of the agreement, a legal requirement, protection of rights in court), processing continues to that extent — with the specific basis and term stated to the data subject.

5.5. The parties recognise actions performed by the data subject in the Service interface from their Telegram account as a simple electronic signature within the meaning of Article 5 of Federal Law No. 63-FZ of 06.04.2011. The fact and time of consent are recorded in the Service: the subject's identifier, the document revision number, and the date and time are stored.

6. Processing procedure and conditions

6.1. Operations performed: collection, recording, systematisation, accumulation, storage, clarification (updating, changing), extraction, use, transfer (provision, access) to the extent set out in Section 7, anonymisation, blocking, deletion, destruction.

6.2. Processing is carried out with and without the use of automation tools. The Operator does not make decisions producing legal consequences for the data subject solely on the basis of automated processing of their personal data (Article 16 of Law 152-FZ). The operation of the Service's trading algorithms is based on parameters set by the User and does not constitute such a decision.

6.3. Processing is limited to the stated purposes; the scope of data is not excessive in relation to those purposes.

6.4. When the purposes of processing are achieved, retention periods expire, consent is withdrawn (in the absence of another basis) or unlawful processing is identified, the data is destroyed or anonymised within the time limits set by law.

6.5. Destruction is confirmed by a record drawn up by the Operator. Where destruction within the set time is impossible, the data is blocked and destroyed within no more than six months.

7. To whom and why data is transferred

7.1. The Operator does not sell personal data and does not pass it to third parties for their own marketing purposes.

7.2. Data is transferred only to the extent necessary for the purpose, to the following categories of recipients:

7.3. With persons engaged in processing personal data, the Operator concludes agreements containing an obligation of confidentiality and compliance with Article 19 of Law 152-FZ.

7.4. The names and addresses of the specific persons engaged in processing are provided to the data subject upon written request to the contacts in the preamble.

7.5. A Partner receives information about the Users they referred in anonymised form: date, plan, payment amount and remuneration — without Users' names, contacts or identifiers.

8. Cookies and analytics

8.1. The Site uses cookies and similar technologies. Their composition, purpose, retention periods and the opt-out procedure are described in the Cookie Policy.

8.2. As of the publication date of this revision, the Site does not use third-party web analytics or advertising trackers. Only strictly necessary data is stored. On the first visit the Site shows a cookie notice with the equivalent buttons "Necessary only" and "OK"; the choice is stored in the visitor's browser. If analytics systems are connected, they will not start for those who chose "Necessary only".

8.3. The Operator does not apply automated profiling of Site visitors for advertising purposes.

9. Localisation and cross-border transfer

9.1. Localisation. The initial collection, recording, systematisation, accumulation, storage and clarification of the personal data of citizens of the Russian Federation are carried out using databases located in the territory of the Russian Federation (Part 5 of Article 18 of Law 152-FZ as amended by Federal Law No. 23-FZ of 28.02.2025).

9.2. Cross-border transfer. The operation of the Service inevitably involves transferring part of the data outside the Russian Federation, because the Service runs in the Telegram messenger and interacts with the Exchange:

9.3. The transfer is carried out after notifying the authorised body for the protection of the rights of personal data subjects in accordance with Article 12 of Law 152-FZ. Where the recipient's state is not on the list of states providing adequate protection of the rights of personal data subjects, the transfer is carried out subject to the conditions set out in Parts 5–12 of Article 12 of Law 152-FZ.

9.4. The transfer of data to the Telegram messenger and to the Exchange takes place at the initiative and in the interest of the User and is necessary to perform the agreement concluded with the User (clause 5 of Part 1 of Article 6, clause 3 of Part 4 of Article 12 of Law 152-FZ).

9.5. The current list of states to which transfers are made is provided on the data subject's request.

10. Data subject rights and requests

10.1. The data subject has the right to:

• obtain information about the processing of their personal data to the extent set out in Part 7 of Article 14 of Law 152-FZ: confirmation of processing, legal bases and purposes, methods used, the data processed and its source, retention periods, the procedure for exercising rights, and information about persons engaged in processing;
• demand clarification of data that is incomplete, inaccurate or outdated;
• demand blocking or destruction of data that was obtained unlawfully or is not necessary for the stated purpose;
• withdraw consent to processing (clause 5.4);
• object to processing based on the Operator's legitimate interests;
• demand that processing for the purposes of promoting goods, works and services be stopped;
• appeal the Operator's actions or omissions to Roskomnadzor or in court.

10.2. How to make a request. A request is sent to info@sync.trade or via https://t.me/sync_trading_support_bot. The request must contain information allowing the applicant to be identified — as a rule, a request from the same Telegram account that is used in the Service is sufficient. Where that is not possible, the Operator may request additional information confirming identity, solely to verify the right to receive the data.

10.3. Response times: information about processing — within 10 business days of the request (the period may be extended by no more than 5 business days with notice to the applicant); clarification, blocking or destruction of data — within 7 business days of the supporting information being provided.

10.4. Account deletion. The User may request the deletion of their account and associated data by sending a request from the same Telegram account. Before making the request, the User should close open positions, stop the bots and revoke the API keys in their Exchange account themselves: the Operator does not perform operations on the User's account and does not manage their keys on the Exchange. After deletion, only information whose retention is required by law (settlement documents, records of acceptance of documents) is kept — to the minimum necessary extent and for the prescribed periods.

10.5. The Operator may refuse to provide information in the cases set out in Part 8 of Article 14 of Law 152-FZ, with a reasoned written reply.

11. Security measures

11.1. The Operator takes the legal, organisational and technical measures required by Article 19 of Law 152-FZ, including:

• appointing a person responsible for organising the processing of personal data;
• issuing internal regulations governing the processing procedure and access procedure;
• restricting the circle of employees with access to personal data and differentiating access rights by role;
• encrypting Exchange API keys and saved payment method identifiers at rest, with the encryption key stored separately;
• transmitting data between the User, the Site and the Service over secure protocols (TLS);
• backing up data and verifying that it can be restored;
• keeping access and activity logs, monitoring errors and anomalies;
• verifying the authenticity of incoming notifications from payment services;
• rate-limiting requests to public forms and protecting against automated abuse;
• regular internal review of compliance of processing with the law and this Policy;
• assessing the harm that may be caused to data subjects and identifying current security threats.

11.2. No security measure provides absolute protection. The Operator is not responsible for the consequences of a compromise of a Telegram account or an Exchange account that occurred for reasons on the data subject's side.

12. Incidents and breach notification

12.1. Upon establishing an unlawful or accidental transfer of personal data that has resulted in a violation of data subjects' rights, the Operator notifies the authorised body within 24 hours of discovering the incident — about what happened, the presumed cause, the presumed harm and the measures taken — and within 72 hours reports the results of the internal investigation and information about the persons responsible (Part 3.1 of Article 21 of Law 152-FZ).

12.2. The Operator informs affected data subjects of the incident if it may cause them harm, and advises what steps they should take.

13. Changes to the Policy

13.1. The Operator may amend this Policy. A new revision takes effect upon publication at https://sync.trade/legal/en/privacy unless a later date is stated in it.

13.2. The Operator notifies Users in the Service of material changes — an expansion of the data processed, new purposes, new categories of recipients or new destinations of cross-border transfer — at least 10 calendar days before the new revision takes effect.

13.3. Earlier revisions are kept by the Operator and provided on request.

14. Language

This Policy is drawn up in Russian. This English translation is published for convenience; in the event of a discrepancy, the Russian text prevails.