Privacy Policy

Last updated: 2 October 2026

This policy explains how Risbot ("Risbot", "we", "us") handles personal data when you use risbot.io, any Risbot Telegram bot, or the service behind them (together, the "Service"). We are responsible for that data as its controller.

Questions, or requests about your data, go to support@risbot.io.

This policy does not cover services we do not run, even when you use them with Risbot. Your exchange, Telegram, Google and TradingView each handle your data under their own privacy policies.

1. What we collect

Your website account

Email address and password. Your password is handled by our authentication provider and stored only in hashed form. We never see it.
Display name, which you can change on your account page, and, if you sign in with Google, the name and profile picture link Google provides.
Time zone. We detect it from your browser on your first visit and use it to show dates. You can change it.
Two-factor authentication. Your authenticator app is registered with our authentication provider. Recovery codes are stored only as hashes.
Sign-in records. Our authentication provider may record when you sign in, together with your IP address and device details, to keep accounts secure.

Your Telegram account

When you message a Risbot bot, Telegram gives us, and we store:

your Telegram user ID, username (and the date you last changed it), first and last name, language setting and whether you have Telegram Premium;
your chat ID with the bot;
when you last used each bot, and how many times you have used it;
the settings and values you enter in the bot's panels, and a record of the actions you take there;
your App Lock password, if you set one, stored only as a salted hash.

Messages the bot deletes. The bot automatically deletes free-form messages typed into its chat. When it does, we keep the text of that message together with the sender's Telegram details, so that we can review misuse and security problems. Please do not type anything sensitive into a bot chat.

Telegram does not share your IP address or location with bots, so we never receive them through Telegram.

Your exchange account

Your API key and secret. They are encrypted in your browser before they are sent, and stored encrypted.
Your exchange account ID, the key's label, and the permissions your exchange reports for it.
Data we read from your exchange using your key: balances, positions, orders, fills, fees and closed profit and loss, including daily balance snapshots.

We never ask for or store your exchange password, and we never ask for a wallet seed phrase.

Your trading

your risk settings, trading rules, symbol lists and presets;
a collateral balance and wallet address, if you enter them;
a record of every trade the Service places or refuses, including prices, sizes, fees, the reason for a refusal, and your exchange's response.

Payments

the deposit address assigned to your account;
for each payment: the transaction hash, the address it was sent from, the amount, the token and the network;
invoices and credit notes, which show your name and email address;
your account credit history, refunds (including the address a refund was sent to), coupons and gift cards you used, and the payment reminders we sent you.

Blockchain payments are public. Anyone can see a transaction on a public blockchain, and no one, including us, can change or delete it.

Support and verification

the emails and Discord messages you send us;
messages you send with the form on our Contact page: your name, the topic and the message, and your email address and Profile ID if you give them. They are delivered to our support mailbox as an email. We keep only a reference number and the topic in our own database;
codes we use to confirm you own an account or link your Telegram account, stored only as hashes, together with a record of which account used each one.

Activity logs

We keep a log of what happens on accounts, linked to the account it concerns. For example: trades placed or refused, errors, the text of messages you send to a bot (but not App Lock passwords or link codes), the buttons you press, and changes such as your display name or time zone, a changed password, two-factor authentication being turned on or off, or recovery codes being used.

Website usage

Analytics. We use Vercel Web Analytics and Speed Insights, which record pages visited, the referring page, and general information about your browser, device, country and page performance. They do not use cookies.
Server requests. Like any website, the servers that deliver the Service receive your IP address. Our hosting providers may keep it in their logs for a short time. We do not store it in our own database. The one exception is the contact form: to stop it being flooded, we keep a one-way code made from your IP address, which cannot be turned back into it, and clear it once that limit no longer needs it.

What we do not collect

We do not collect government ID, your phone number, your precise location, payment card details, your exchange password or your wallet seed phrase.

2. Why we use it

Purpose	Data used	Legal basis
Running your account, your bots and your trades	Account, Telegram, exchange and trading data	Performing our contract with you
Taking payments, issuing invoices and refunds	Payment data, name, email	Performing our contract; our legal obligations (tax and accounting)
Sending you messages about your account, plan and payments	Email, Telegram ID	Performing our contract
Keeping the Service and accounts secure, and preventing fraud and misuse	Sign-in records, activity logs, deleted bot messages, verification codes	Our legitimate interest in protecting you, other users and the Service
Investigating problems and answering support requests	Activity logs, trade records, support messages	Performing our contract; our legitimate interest in fixing problems
Complying with the law, including sanctions	Any relevant data	Our legal obligations
Keeping trade records after you erase your account	Trade records	To meet our legal obligations and to establish, exercise or defend legal claims
Understanding how the website is used, and improving it	Website usage data	Our legitimate interest in improving the Service

Where we rely on legitimate interests, we have weighed them against your rights, and you can object (see section 6).

We do not sell your personal data, do not share it for advertising, and do not show you ads. We do not send marketing messages. If that ever changes, we will ask for your consent wherever the law requires it, and you will always be able to opt out.

Automated decisions. The Service automatically decides whether to place each trade, using the rules you set and the limits of your plan. It tells you when it refuses one, and why. If you think a decision was wrong, contact us and a person will review it.

We share personal data only with the service providers that run parts of the Service for us, and only as much as each needs:

Provider	What it does for us	Where
Supabase	Database and sign-in	European Union (Germany)
DigitalOcean	Hosting for the bot server	European Union (Germany)
Vercel	Hosting for the website; website analytics	United States, and a global network
Telegram	Delivering bot messages	Telegram's own infrastructure
Your exchange (Bybit)	Receiving the orders and requests we send with your API key	Your exchange's own infrastructure
Resend	Sending emails	European Union (Ireland)
Zoho	Our support mailbox	Zoho's infrastructure
Google	Sign in with Google, if you use it	Google's infrastructure
Alchemy and public blockchain nodes	Reading blockchains to detect your payments	Their infrastructure
Cloudflare	Relaying trading alerts to our server	A global network
Discord	Our community and support server, if you contact us there	Discord's infrastructure

We may also share personal data:

with authorities, when the law, a court or a regulator requires it, or when it is needed to protect someone's safety or to establish, exercise or defend legal claims;
as part of a business change, such as a merger, reorganisation or sale of the Service. This policy would continue to protect your data, and we would tell you.

A small team operates Risbot. Team members can see account data where they need it to run the Service and help you, and they are bound to keep it confidential.

4. International transfers

Risbot is available worldwide, and our providers are in several countries. Our database and bot server are in the European Union, but your data may also be handled in other countries, including the United States and the United Arab Emirates, where data protection laws may differ from yours.

Where the law requires it, we rely on appropriate safeguards for these transfers, such as the Standard Contractual Clauses that our providers offer in their data processing terms.

5. How long we keep it

Data	How long
Website account: email, name, picture, time zone, two-factor details	Until you delete your profile or erase your account
Exchange API key and secret	Until you remove the key, or delete your profile or erase your account
Telegram details, bot settings, panel actions and the deleted bot messages we keep for review	Deleted when you choose Erase everything, except your Telegram ID, which stays attached to the trade records kept below. Delete profile keeps them, linked to your Telegram account, so they come back if you link it again
Trade records	Kept after you delete your profile or erase your account, to meet our legal obligations and to establish, exercise or defend legal claims. Delete profile keeps them linked to your Telegram account, so they come back if you link it again. After Erase everything they are kept together with the Telegram ID and account identifiers they belong to, and are never returned - not to you, and not to a new account made with the same email or Telegram account
Invoices, credit notes and payment records	At least as long as tax and accounting laws require, which is generally five years. They are not deleted when you delete your account, and a payment sent to your old deposit address afterwards is still recorded
Activity logs	As long as they are needed to keep the Service secure and to investigate problems and disputes. They are kept after your account is deleted, including when you choose Erase everything. They can include messages you sent to a bot and names you used, but nothing that could sign in or trade as you
Sign-in and verification codes	Each code stops working within minutes. A record that a code was used, and which account used it, may be kept with the logs above
Support emails and messages	As long as needed to deal with your request

Deleting your account explains exactly what each of the two ways to delete removes and keeps. Deleting your account does not delete anything held by your exchange, Telegram, Google or a blockchain.

6. Your rights

Depending on where you live, including under the UAE's Personal Data Protection Law, the EU and UK General Data Protection Regulation, and California's privacy laws, you may have the right to:

access the personal data we hold about you, and get a copy;
correct data that is wrong;
delete your data;
restrict or object to how we use it, including where we rely on legitimate interests;
receive your data in a portable format;
withdraw consent, where we rely on it;
complain to a data protection authority, such as the UAE Data Office or the authority where you live or work.

You can correct your profile and delete your account yourself, from your account page. For anything else, email support@risbot.io.

How we handle your request:

We may first need to confirm that the account is yours, for example by sending a code to your bot chat.
We respond within 30 days. If a request is complex, we may take longer where the law allows, and we will tell you.
We do not charge for requests, unless the law allows a fee because a request is clearly unfounded or excessive.
We may keep data we are legally required to keep, such as payment records and trade records, even if you ask us to delete it. If we do, we will tell you what we kept and why.

California residents. In the last 12 months, we collected the categories of data listed in section 1:

identifiers, such as your email, Telegram ID and wallet addresses;
commercial information, such as payments and plans;
financial information from your exchange account;
internet activity on our website;
account credentials, which count as sensitive personal information.

We collected them from you, from Telegram, from Google if you sign in with it, from your exchange, and from public blockchains. We use them for the purposes in section 2, and use sensitive personal information only to provide the Service. We have not sold or shared personal data for cross-context behavioural advertising, and we do not treat you differently for using your rights. You may ask someone to make a request for you, and we may need to confirm they have your permission.

7. How we protect it

Connections to the Service are encrypted.
Your exchange API key and secret are encrypted in your browser before they are sent, and are stored encrypted.
Passwords, recovery codes and verification codes are stored only as hashes.
Access to our internal tools requires multiple security factors.

No system is completely secure, so we cannot guarantee that your data will never be accessed without permission. If a breach affects your personal data, we will tell you and the relevant authorities where the law requires.

You can help: use a strong, unique password, turn on two-factor authentication, and never give your exchange API key withdrawal permission.

8. Cookies and browser storage

We only use cookies and browser storage that the website needs to work:

Name or type	Why	How long
Sign-in session cookies	Keep you signed in	Until you sign out or your session ends
`risbot_recovery`	Confirms a password reset you started	15 minutes
Pending code (browser session storage)	Remembers the email a sign-in code was sent to	Until you close the tab
Notice and theme preferences (browser local storage)	Remember that you closed a notice, and your light or dark theme	Until you clear your browser storage

Google. On some pages, visitors who are not signed in may see Google's "Sign in with Google" prompt. It loads a script from Google, which may set or read its own cookies under Google's privacy policy.

We do not use advertising or cross-site tracking cookies. You can block or delete cookies in your browser settings, but you will not be able to stay signed in without them.