Logo

CCXT Terminal Privacy Policy

Effective date: 1 September 2026

Company: CCXT LTD

Registered office: Office A, Al Rifaa, Sheikh Mohammed Bin Zayed Road, Ras Al Khaimah, United Arab Emirates

Privacy contact: [email protected]

This Privacy Policy explains how CCXT Terminal collects, uses, stores, shares and protects personal data when you access or use our websites, web application, mobile applications, desktop applications, APIs, trading interface, exchange integrations, account-information displays, alerts, support channels, marketing pages and related services.

CCXT Terminal is designed as a non-custodial software interface and API connectivity layer. We do not hold user funds, virtual assets, wallet private keys, seed phrases, withdrawal credentials or wallets. We may process API credentials and exchange account data only to provide connectivity, account-information display, user-instruction transmission, synchronisation, alerts, security and related software functionality.

1. Who we are

For the purposes of this Privacy Policy, CCXT Terminal, we, us or our means CCXT LTD, a company incorporated in the United Arab Emirates.

We act as the data controller for personal data that we collect and determine how to process in connection with the CCXT Terminal services.

Where we process data on behalf of an enterprise, white-label partner, broker, exchange, reseller or other business customer under a separate written agreement, we may act as a processor or service provider for that customer. In that case, the relevant agreement or data processing addendum may contain additional terms.

The UAE Personal Data Protection Law, Federal Decree-Law No. 45 of 2021, provides a federal framework for protecting personal data and defining duties and rights of parties involved in data processing in the UAE. U.AE

2. Scope of this Privacy Policy

This Privacy Policy applies when you:

  1. visit our websites or landing pages;
  2. create or use a CCXT Terminal account;
  3. use our web, desktop, iOS or Android applications;
  4. connect an exchange, broker or other third-party platform account;
  5. connect or upload API credentials;
  6. view balances, orders, positions, charts, indicators or transaction history through CCXT Terminal;
  7. configure user instructions, order parameters, alerts or notifications;
  8. contact our support team;
  9. subscribe to newsletters or marketing communications;
  10. participate in surveys, beta tests, communities or promotions;
  11. interact with us on social media, Discord, Telegram, GitHub, X, LinkedIn or other channels;
  12. purchase or subscribe to paid services, if applicable.

This Privacy Policy does not govern the privacy practices of third-party exchanges, brokers, wallets, custodians, app stores, payment processors, analytics tools, cloud providers or other third-party platforms. Those third parties process your data under their own privacy policies.

3. Product-specific privacy position

CCXT Terminal allows users to interact with third-party cryptocurrency exchanges and other third-party platforms through APIs. You independently open your exchange account, complete KYC/AML directly with the exchange, deposit funds directly with the exchange, generate API credentials on the exchange, and connect those credentials to CCXT Terminal.

CCXT Terminal may process and store API credentials and exchange account-linking data so that you can use the service across multiple devices, maintain sessions, display exchange account information, transmit user-configured instructions and receive notifications.

Where technically available, CCXT Terminal is designed to accept only API credentials that do not permit withdrawals or transfers. You must not provide us with withdrawal-enabled API keys, private keys, seed phrases, wallet credentials or any credential that would allow us to withdraw, transfer or control your assets.

4. Personal data we collect

We collect different categories of personal data depending on how you use CCXT Terminal.

4.1 Account registration data

We may collect:

  1. name;
  2. email address;
  3. username;
  4. password hash or authentication credentials;
  5. account ID;
  6. country or region;
  7. language preference;
  8. referral code or invitation code;
  9. subscription status;
  10. account creation date;
  11. user preferences and settings.

4.2 Authentication and security data

We may collect:

  1. login history;
  2. IP address;
  3. device identifiers;
  4. browser type and version;
  5. operating system;
  6. session identifiers;
  7. two-factor authentication status;
  8. failed login attempts;
  9. suspicious activity signals;
  10. access logs;
  11. security event logs;
  12. fraud-prevention signals.

4.3 API credentials and exchange connection data

When you connect a third-party exchange or broker account, we may collect and process:

  1. exchange or platform name;
  2. API key;
  3. API secret or token;
  4. passphrase, if required by the exchange;
  5. OAuth token, if applicable;
  6. API permission metadata;
  7. API connection status;
  8. exchange account identifier;
  9. account type;
  10. available API endpoints;
  11. connection error logs;
  12. IP whitelist status, where technically available;
  13. exchange-generated API metadata.

API credentials are sensitive operational data. We use them only to provide connectivity and related CCXT Terminal functionality. We do not use API credentials to withdraw or transfer funds, and you must not provide withdrawal-enabled credentials.

4.4 Exchange account and trading-interface data

When you connect a third-party platform, we may retrieve, display, process or store data received through that platform’s API, including:

  1. balances;
  2. positions;
  3. open orders;
  4. closed orders;
  5. order status;
  6. transaction history;
  7. deposits and withdrawals as reported by the exchange;
  8. fills and execution reports as reported by the exchange;
  9. trading fees as reported by the exchange;
  10. account type;
  11. margin information;
  12. funding or borrowing information;
  13. liquidation-related data;
  14. API response data;
  15. timestamps;
  16. symbols, instruments, markets and trading pairs;
  17. error messages returned by the exchange;
  18. rate-limit information.

We process this data to display account information, support the user interface, transmit user-configured instructions, maintain synchronisation between devices, provide alerts, troubleshoot errors, improve reliability, and protect the service.

4.5 User instruction and order-communication data

When you configure or submit an instruction through CCXT Terminal, we may process:

  1. selected exchange or third-party platform;
  2. selected market, asset, pair or instrument;
  3. order type;
  4. side;
  5. quantity;
  6. price;
  7. trigger condition;
  8. time-in-force;
  9. reduce-only, post-only or similar flags;
  10. cancellation or amendment request;
  11. timestamps;
  12. request payload sent to the exchange;
  13. response payload received from the exchange;
  14. order status returned by the exchange;
  15. error or rejection messages.

CCXT Terminal does not make trading decisions for you. We process this data to transmit user-configured instructions and display information received from the relevant third-party platform.

4.6 Alerts and notification data

If you enable alerts or notifications, we may process:

  1. alert settings;
  2. price levels;
  3. percentage-change thresholds;
  4. order-status notification settings;
  5. balance-change notification settings;
  6. device push tokens;
  7. notification delivery status;
  8. notification logs;
  9. user preferences for email, push, Telegram, web push or other channels.

Notifications are informational and may be delayed, unavailable, duplicated or inaccurate.

4.7 Payment and subscription data

If CCXT Terminal offers paid services, we may collect:

  1. billing name;
  2. billing email;
  3. billing address;
  4. subscription plan;
  5. payment status;
  6. invoice history;
  7. tax information;
  8. payment provider customer ID;
  9. limited payment metadata.

We generally do not store full card numbers. Payment information is processed by third-party payment processors under their own terms and privacy policies.

4.8 Support and communications data

When you contact us, we may collect:

  1. name;
  2. email address;
  3. support ticket content;
  4. screenshots;
  5. logs that you provide;
  6. device and app information;
  7. correspondence history;
  8. Telegram, Discord, GitHub, X, LinkedIn or other social handle, if you contact us there;
  9. call or meeting notes, if applicable.

4.9 Device, usage and technical data

We may automatically collect:

  1. IP address;
  2. device model;
  3. device ID;
  4. operating system;
  5. browser type;
  6. app version;
  7. screen resolution;
  8. time zone;
  9. language;
  10. approximate location derived from IP address;
  11. pages viewed;
  12. features used;
  13. buttons clicked;
  14. session duration;
  15. crash logs;
  16. diagnostic logs;
  17. performance data;
  18. latency data;
  19. API request statistics;
  20. error reports.

4.10 Marketing and analytics data

Where permitted by law, we may collect:

  1. marketing preferences;
  2. newsletter subscription status;
  3. campaign source;
  4. referral source;
  5. advertising ID;
  6. cookie identifiers;
  7. attribution data;
  8. email open and click data;
  9. survey responses;
  10. product feedback.

4.11 Compliance data

Where necessary, we may process:

  1. country or region;
  2. sanctions-screening results;
  3. fraud-risk signals;
  4. legal requests;
  5. records of account restrictions;
  6. records of terms violations;
  7. identity or entity information, if required for compliance, security, payments or enterprise onboarding.

CCXT Terminal does not generally perform exchange-level KYC/AML for your trading account. That is handled by the relevant exchange or third-party platform. We may, however, request information where needed for our own legal, security, sanctions, fraud-prevention or payment obligations.

5. Data we do not want you to provide

You must not provide CCXT Terminal with:

  1. private keys;
  2. seed phrases;
  3. wallet recovery phrases;
  4. withdrawal-enabled API keys;
  5. transfer-enabled API keys;
  6. exchange passwords;
  7. email passwords;
  8. bank passwords;
  9. identity documents unless we specifically request them;
  10. third-party personal data unless you have the right to provide it;
  11. sensitive personal data unless strictly necessary.

If you provide data that we did not request, we may delete, restrict or ignore it.

6. How we collect personal data

We collect personal data:

  1. directly from you;
  2. automatically when you use the Services;
  3. from third-party platforms connected by you through APIs;
  4. from payment processors;
  5. from app stores;
  6. from support and communication tools;
  7. from analytics and attribution providers;
  8. from security and fraud-prevention tools;
  9. from enterprise customers, if you are an authorised user of an enterprise account;
  10. from publicly available sources, where relevant for security, fraud prevention or support.

7. Why we process personal data

We process personal data for the following purposes:

  1. creating and maintaining your account;
  2. authenticating you;
  3. providing the web, desktop and mobile applications;
  4. connecting your third-party platform accounts;
  5. storing API credentials securely for synchronisation and connectivity;
  6. displaying balances, orders, positions, transaction history and market data;
  7. transmitting user-configured instructions to third-party platforms;
  8. receiving and displaying API responses from third-party platforms;
  9. sending user-selected alerts and notifications;
  10. providing customer support;
  11. processing payments and subscriptions;
  12. managing trials, promotions and referrals;
  13. securing the Services;
  14. detecting fraud, abuse, malware, account compromise and unauthorised access;
  15. debugging, analytics and product improvement;
  16. monitoring system performance and reliability;
  17. enforcing our Terms of Service;
  18. complying with law, sanctions, court orders, regulator requests and legal obligations;
  19. communicating service updates and legal notices;
  20. sending marketing communications where permitted;
  21. protecting our rights, users, systems and business;
  22. facilitating corporate transactions such as mergers, acquisitions, financings, reorganisations or asset sales.

8. Legal bases for processing

Depending on your jurisdiction, we rely on one or more of the following legal bases:

  1. Performance of contract: to provide the Services you request, including account creation, exchange connectivity, synchronisation, account-information display, support and subscription management.
  2. Legitimate interests: to secure and improve the Services, prevent fraud, troubleshoot errors, understand product usage, protect legal rights, and operate our business.
  3. Consent: for optional marketing, non-essential cookies, certain analytics, push notifications or optional features where consent is required.
  4. Legal obligation: to comply with applicable laws, sanctions, tax, accounting, security, court, regulator or law-enforcement obligations.
  5. Vital or public interests: only where applicable and required by law.

Where we rely on consent, you may withdraw your consent at any time. Withdrawal does not affect processing that occurred before withdrawal.

9. API credentials and exchange data security

We treat API credentials and exchange account data as highly sensitive.

We may use technical and organisational measures such as:

  1. encryption in transit;
  2. encryption at rest;
  3. access controls;
  4. separation of duties;
  5. logging and monitoring;
  6. key-management controls;
  7. limited employee access;
  8. security reviews;
  9. vulnerability management;
  10. infrastructure security controls;
  11. incident response procedures.

No system is perfectly secure. You are responsible for securing your devices, email, exchange accounts, passwords, API permissions, two-factor authentication and networks.

You should revoke and regenerate API credentials if you suspect compromise.

10. When we share personal data

We may share personal data with the following categories of recipients:

  1. Third-Party Platforms connected by you: to transmit user-configured instructions, retrieve account data, display status and provide connectivity.
  2. Cloud and infrastructure providers: for hosting, storage, networking, security and backups.
  3. Analytics providers: for product analytics, diagnostics and performance monitoring.
  4. Error monitoring and crash reporting providers: to detect and fix bugs.
  5. Push notification providers: to send mobile, web or other notifications.
  6. Email and communication providers: to send transactional, legal, support and marketing messages.
  7. Payment processors: to process subscriptions, invoices and payments.
  8. App stores: for mobile app distribution and subscription handling.
  9. Customer support tools: to manage support requests and communications.
  10. Security and fraud-prevention providers: to detect abuse, malware, unauthorised access and suspicious activity.
  11. Professional advisers: including lawyers, auditors, accountants, tax advisers and insurers.
  12. Authorities and courts: where required by law, legal process, sanctions, regulator request or to protect rights.
  13. Corporate transaction parties: in connection with a merger, acquisition, financing, restructuring, insolvency, asset sale or business transfer.
  14. Affiliates and group companies: where necessary to operate, support, secure or improve the Services.

We do not sell your API credentials. We do not sell your exchange account data.

11. Third-party platforms and independent controllers

Third-party exchanges, brokers, wallets, custodians, payment processors, app stores and other platforms are independent from CCXT Terminal.

They may collect and process your personal data, account data, trading data, KYC data, AML data, deposits, withdrawals, balances, transaction history and other information under their own terms and privacy policies.

CCXT Terminal is not responsible for the privacy, security or data practices of third-party platforms.

12. International transfers

We are based in the United Arab Emirates, but we may process and store personal data in other countries where our service providers, infrastructure, employees, contractors, affiliates or support providers are located.

Those countries may have data-protection laws that differ from the laws of your country.

Where required, we use appropriate safeguards for international transfers, which may include contractual protections, transfer assessments, security measures, processor obligations, consent, or other mechanisms available under applicable law.

13. Data retention

We retain personal data for as long as necessary for the purposes described in this Privacy Policy, including to provide the Services, maintain your account, secure the Services, comply with law, resolve disputes, enforce agreements, keep business records and protect legal rights.

Retention periods may depend on:

  1. whether your account is active;
  2. the type of data;
  3. legal, tax, accounting or regulatory requirements;
  4. fraud, security or abuse-prevention needs;
  5. dispute or enforcement needs;
  6. backup and disaster-recovery schedules;
  7. whether the data can be anonymised.

API credentials are retained while your exchange connection remains active or as otherwise needed to provide the Services. If you disconnect an exchange account or delete your CCXT Terminal account, we will delete or disable associated API credentials subject to backup, legal, security and fraud-prevention retention requirements.

We may retain anonymised or aggregated data that no longer identifies you.

14. Your rights

Depending on your jurisdiction, you may have rights to:

  1. access your personal data;
  2. correct inaccurate personal data;
  3. delete personal data;
  4. restrict processing;
  5. object to processing;
  6. withdraw consent;
  7. receive a copy of personal data in portable form;
  8. opt out of marketing communications;
  9. object to certain automated processing;
  10. lodge a complaint with a data-protection authority.

To exercise rights, contact us at [email protected].

We may need to verify your identity before responding. We may refuse or limit a request where permitted by law, including where fulfilling the request would affect security, legal obligations, fraud prevention, trade secrets, other users’ rights, or our ability to establish, exercise or defend legal claims.

15. Account deletion and disconnection

You may request deletion of your CCXT Terminal account by contacting us or using in-app account deletion features where available.

You may also disconnect exchange accounts and revoke API credentials directly on the relevant exchange or Third-Party Platform.

We recommend revoking API credentials directly on the exchange whenever you stop using a connected exchange account with CCXT Terminal.

After account deletion, we may retain limited information where necessary for legal, security, fraud-prevention, accounting, dispute-resolution or enforcement purposes.

16. Marketing communications

We may send you service-related communications, such as security alerts, technical notices, account notices, legal updates and support messages. These are not marketing communications and may be necessary to provide the Services.

We may also send newsletters, product updates, promotions or marketing communications where permitted by law. You may opt out by using the unsubscribe link or contacting us.

Even if you opt out of marketing, we may still send you service-related communications.

17. Cookies and similar technologies

We may use cookies, local storage, SDKs, pixels, tags and similar technologies to:

  1. keep you logged in;
  2. remember preferences;
  3. secure the Services;
  4. measure performance;
  5. understand usage;
  6. improve products;
  7. detect fraud and abuse;
  8. support marketing and attribution, where permitted.

Where required by law, we will request consent for non-essential cookies or similar technologies.

You can control cookies through your browser settings and, where available, through our cookie banner or cookie preferences tool.

18. Mobile app data

When you use our mobile applications, we may collect:

  1. device model;
  2. operating system;
  3. app version;
  4. device language;
  5. crash logs;
  6. diagnostic data;
  7. push notification token;
  8. usage events;
  9. security signals;
  10. mobile attribution data, where applicable.

You can control certain permissions through your device settings, including push notifications.

19. Children

The Services are not intended for children or anyone under 18 years old.

We do not knowingly collect personal data from children. If we learn that we have collected personal data from a child, we will take reasonable steps to delete it.

20. Automated processing

We may use automated systems to detect fraud, security threats, abuse, suspicious logins, unusual API activity, sanctions risk, product errors or service misuse.

We do not use automated processing to make investment decisions for you or to provide personal trading recommendations.

21. Aggregated and anonymised data

We may create aggregated or anonymised data from personal data and usage data.

Aggregated or anonymised data may be used for analytics, research, reporting, product improvement, benchmarking, security, business planning and marketing, provided it does not identify you.

22. Business transfers

If CCXT Terminal is involved in a merger, acquisition, financing, reorganisation, bankruptcy, sale of assets, spin-off, restructuring or similar transaction, personal data may be disclosed or transferred as part of that transaction.

We will take reasonable steps to require the recipient to protect personal data in a manner consistent with this Privacy Policy, unless otherwise permitted by law.

23. Changes to this Privacy Policy

We may update this Privacy Policy from time to time.

If we make material changes, we may notify you by email, in-app notice, website notice or other reasonable means.

The updated Privacy Policy will be effective when posted unless a later effective date is stated.

Your continued use of the Services after the updated Privacy Policy becomes effective means that you acknowledge the updated policy.

24. Contact us

For privacy questions, requests or complaints, contact:

CCXT Terminal Privacy Team

Email: [email protected]

Address: Office A, Al Rifaa, Sheikh Mohammed Bin Zayed Road, Ras Al Khaimah, United Arab Emirates