Privacy Policy
Last updated 2026-07-22 · Effective immediately
Polymarket EA is an automated trading tool operated by EV Quant Lab. This page explains what data we collect, why, where it lives, and what rights you have. We aim to collect the minimum needed to operate.
What we collect
| Category | What | Why | Where it lives |
|---|---|---|---|
| Account | Email, bcrypt-hashed password, account creation date, last login timestamp | Authenticate you, send password-reset links | SQLite at data/pmbot.sqlite |
| Trading | Order history, fills, P&L, position snapshots | Provide paper/live trading, audit, tax records | Same SQLite, encrypted at rest for client wallets/keys |
| API keys (your own) | Label + SHA-256 hash of the key you generated | Authenticate your scripts when calling our API | Same SQLite; plaintext is shown to you ONCE at creation |
| Payment | Stripe customer ID, subscription ID, plan tier, payment status | Charge you, manage your subscription, prevent fraud | SQLite + Stripe (we never see your card number) |
| Operational | Server logs, IP addresses, browser user-agent | Debug, prevent abuse | stdout/journal/log files (rotated) |
We do not collect social security numbers, government IDs, or biometric data. KYC is delegated to Stripe (the payment processor).
What we do not collect
- We never see your Polymarket private key (paper mode generates ephemeral keys; live mode keys stay encrypted at rest, AES-256-GCM).
- We never sell your data to third parties.
- We never share your trading activity with other users (multi-tenant isolation enforced at the application layer).
- We never use your prompts or trades to train AI models.
Your rights (GDPR / EU users)
- Access: email
privacy@polymarket-bot.comfor an export of everything we hold on you. - Deletion: same address; we delete within 30 days. Trading records we are legally required to retain (tax / AML) survive.
- Portability: CSV export of orders + fills + P&L on request.
- Complaint: lodge with your country's data-protection authority (AEPD for Spain, CNIL for France, etc.).
Sub-processors
- Stripe Inc. — payment processing (card data, billing address). Their privacy policy applies: https://stripe.com/privacy
- Cloudflare — host of this app. Their privacy policy applies: https://www.cloudflare.com/privacypolicy/
- Polymarket (Polygon CLOB) — when live trading is enabled, blockchain transactions are public by design.
Retention
- Account data: kept while account is active + 30 days after deletion.
- Trading records: 7 years (Spanish tax law / EU AML directives).
- Server logs: 90 days rolling.
- Audit logs of billing events: 90 days (Stripe is the source of truth beyond that).
Contact
For any privacy-related request:
privacy@polymarket-bot.com (PGP key on request)
EV Quant Lab · Madrid, Spain