Legal
Privacy Policy
What we collect, why we hold it, and what we will never do with it. The two sections people care about most — your exchange keys and your prompts — are near the top.
1. What we collect
| Category | What it includes |
|---|---|
| Account | Email address, username, password hash. If you sign in with Google or a wallet, the identifier that provider returns. |
| Exchange access | API key, secret and passphrase for exchanges you connect. Encrypted — see section 2. |
| Trading configuration | Your trades: pair, timeframe, indicators, allocation, risk settings, which bot is assigned. |
| Bot configuration | Bot name, platform, webhook URL, prompt or rules, model, developer key. |
| Trading activity | Decisions received, orders placed, fills, stop movements, closed trades, and the market data behind each one. |
| Balances | Balances and positions read from your exchange, so we can show them and enforce your limits. |
| Payments | Handled by Paystack. We receive confirmation and the last four digits of a card — never full card numbers. |
| Technical | IP address, browser and device type, timestamps, error logs. |
We do not collect your national identification number, your bank account details, or documents proving your identity, because we do not hold money and do not need them.
2. Your exchange keys
API keys are stored encrypted at rest and are used only to read your balance and to place, manage and close orders on trades you configured. We ask you never to grant withdrawal permission, and we will not use it if you do.
Keys are never shown back to you in full after saving, never written to logs, never sent to any third party, and never used for anything outside your own trades.
Delete the key on your exchange and our access ends immediately. Delete the connection in Candleweb and we remove our stored copy.
3. Your prompts and strategies
The prompt or rules you give us are stored so that bot review can compare what your bot was told to do against what it actually did. That is the only purpose.
We do not run your prompt ourselves, we do not trade on it, we do not show it to other users, and we do not use it to train models — ours or anyone else's.
You can edit or delete a stored prompt at any time from the bot's settings. Deleting it removes it from future review; past trade records keep a note of which version was in use at the time, because a record you cannot reconstruct is not a record.
4. Why we use your data
- To run the service — deliver market data, relay decisions, place and monitor orders, enforce your limits. This is necessary to perform our contract with you.
- To keep it working — diagnose failures, investigate a bot that stopped responding, monitor for abuse. Our legitimate interest in a functioning, secure service.
- To produce your bot review — analyse your own trades and prompt to generate recommendations for you. Part of the service you asked for.
- To contact you — service notices, failure alerts you switched on, and, if you opted in, occasional product email. You can turn marketing email off without losing service notices.
- To meet legal obligations — tax, accounting, and lawful requests from authorities.
We do not sell your personal data, and we do not share it with advertisers.
5. Who we share with
| Who | What they receive, and why |
|---|---|
| Your exchange | The orders we place on your behalf, authenticated with your key. Governed by their own policy. |
| Your bot | Market data for your trades, sent to the URL you configured, carrying your developer key. |
| Paystack | Payment details when you buy a course or subscription. We never see full card numbers. |
| Yellow Card | Only if you choose to fund through them. You deal with them directly; we pass nothing across unless you initiate it. |
| Infrastructure providers | Hosting, database and email delivery, under contract and bound to confidentiality. |
| Authorities | Where we are legally required. We will tell you unless we are prohibited from doing so. |
6. Where your data is held
Candleweb operates from Nigeria and processes data in line with the Nigeria Data Protection Act 2023. Some of our infrastructure providers hold data outside Nigeria; where they do, we use providers that offer an adequate standard of protection and contractual safeguards.
7. How long we keep it
| Account data | While your account is open, then 90 days after closure. |
| Exchange keys | Deleted immediately when you remove the connection or close your account. |
| Trade records | Kept while your account is open so review and your own history stay intact. Exportable at any time. |
| Prompts | Until you delete them, or your account closes. |
| Payment records | As long as tax and accounting law requires, typically six years. |
| Technical logs | Up to 12 months. |
8. Your rights
You can ask us to give you a copy of your data, correct it, delete it, restrict how we use it, or object to a particular use. Most of this you can do yourself from the dashboard — export your records, edit or delete a prompt, remove an exchange connection, close your account.
For anything else, email privacy@candleweb.io. We will respond within 30 days. If you are not satisfied you may complain to the Nigeria Data Protection Commission, or to the data protection authority where you live.
9. Security
Exchange keys and developer keys are encrypted at rest. Traffic is encrypted in transit. Access to production systems is limited to staff who need it and is logged.
Your part matters too: use a strong, unique password, keep your developer key private, restrict your exchange key to our IP address where your exchange supports it, and never grant withdrawal permission.
If a breach affects your data, we will tell you and the regulator within the timeframes the law requires, and we will tell you what we know rather than waiting until we know everything.
10. Cookies
We use cookies that are necessary to keep you signed in and to keep the service secure. We use a small amount of privacy-respecting analytics to understand which pages are used. We do not use advertising cookies and we do not allow third parties to track you across other sites from ours.
11. Children
Candleweb is not for anyone under 18. We do not knowingly collect data from children. If you believe a child has given us data, contact us and we will delete it.
12. Changes and contact
If we change this policy materially we will tell you by email or in the product before it takes effect, and update the date at the top.
| Entity | Candleweb Ltd — [registration number] |
| Registered address | [registered address] |
| Data protection contact | privacy@candleweb.io |
Related: our Terms of Service set out the agreement between us, including how exchange access and trading risk work.