PRIVACY
POLICY – GDPR

The data controller is:

Javlot
Single-member simplified joint-stock company (SASU)
Registered office: 50 avenue des Champs-Élysées, 75008 Paris, France

Contact: support@javlot.io

Javlot collects only data strictly necessary for providing its services.

Collected data may include:

• identification data (name, email address),
• contact information,
• technical usage data,
• billing-related information,
• onboarding and service configuration data,
• trading account identifiers (MetaTrader 5 login, server name, broker name),
• trading history and periodic balance snapshots for billing and performance reporting purposes,
• hashed identifiers used for fraud prevention (trial abuse detection).

Javlot never collects:

• banking information (handled by third-party payment providers),
• credentials allowing direct access to users' financial accounts.

For technical and billing purposes only, Javlot may access limited account information in read-only mode, such as account balance or equity, through secure integrations with third-party platforms. This access does not allow Javlot to execute trades, modify positions, or access user funds.

For fraud prevention purposes, Javlot may retain a cryptographic hash (SHA-256) of the user's email address and the associated trading account identifier. These records are retained indefinitely and are used solely to prevent repeated trial abuse.

Personal data is processed for the following purposes:

• account creation and management,
• service delivery and operation,
• technical support and communication,
• billing and payment management,
• service improvement and security,
• compliance with legal obligations.

Data processing is based on:

• performance of a contract (Terms of Use / Terms of Sale),
• legal obligations,
• Javlot's legitimate interests (security, service improvement),
• user consent where required.

Personal data may be shared with the following categories of recipients:

• Stripe, Inc. (United States) — payment processing,
• Supabase, Inc. (United States / European Union) — database hosting and authentication,
• Vercel, Inc. (United States) — website hosting and delivery,
• other technical partners strictly necessary for service execution.

These providers operate under appropriate safeguards in compliance with GDPR.

Javlot does not sell or rent personal data.

Personal data is retained only for the duration necessary to fulfill the purposes for which it was collected and in accordance with applicable laws.

Data is then deleted or anonymized.

Javlot implements appropriate technical and organizational measures to ensure data security, including:

• restricted access,
• encryption where appropriate,
• secure infrastructure,
• regular audits and controls.

Under the GDPR, users have the following rights:

• right of access,
• right to rectification,
• right to erasure,
• right to restriction of processing,
• right to object,
• right to data portability.

Requests can be sent to: support@javlot.io

Javlot.io may use cookies necessary for website operation, analytics, and user experience improvement.

Users may manage cookie preferences via browser settings or on-site tools.

Some of Javlot's service providers are located outside the European Union, including in the United States.

When such transfers occur, appropriate safeguards are applied, such as Standard Contractual Clauses (SCCs) approved by the European Commission, or reliance on adequacy decisions where applicable.

Javlot reserves the right to update this Privacy Policy at any time.
Users will be informed of any significant changes.

For any questions regarding personal data protection, users may contact: support@javlot.io

Users also have the right to lodge a complaint with their local data protection authority.