How TrackBTC handles personal data.

1. Organisation and DPO contact

Merino Advisory PTE. LTD. (UEN 202553778E), of 160 Robinson Road, #14-04, Singapore 068914, operates TrackBTC and is the organisation responsible for the personal data described here.

Our public data-protection officer and privacy contact is support@trackbtc.bot. Use that address for access, correction, consent withdrawal, or privacy complaints.

2. Information we collect

• Account and authentication: email address, passkey credential metadata, verification and sign-in events, sessions, and security records. TrackBTC does not receive your biometric data or a passkey private key.
• Contract and access: the accepted legal-document versions, acceptance time, account snapshot, business-use and named-seat confirmations, subscription and entitlement state, manual reviewer approvals and revocations, and reports made available to the account.
• Transactions: customer, transaction, subscription, tax, refund, dispute, and status information made available through Stripe Managed Payments and Link. TrackBTC does not store a full card number or card security code.
• Communications: support messages and information you provide when requesting help or a correction.
• Public-site analytics: only after you choose Accept analytics, the information described below.

Operational Reports use public Bitcoin blockchain information, accepted market-price information, and qualified organisation or service associations. This reporting material is separate from subscriber account data. TrackBTC publishes entity names rather than natural-person identities.

3. Cookies and Google Analytics 4

The public site offers an Accept analytics or Reject analytics choice. Before acceptance, TrackBTC does not load Google Analytics. We store your choice in your browser's local storage so the site can remember it. You can reopen Analytics choices from the footer.

If you accept, Google Analytics 4 may set a first-party _ga cookie and receive browser and device information, page and interaction activity, and approximate geographic information. Google states that an internet protocol address is used at collection to derive location information and is then discarded rather than logged or stored. Do not send personal or confidential information through public-page addresses or fields intended for analytics.

If you reject, the analytics script is not loaded. If you later change a granted choice to rejected, TrackBTC removes known first-party Google Analytics cookies it can reach and reloads the page without analytics. Browser controls may also block or delete local storage and cookies.

4. Why we use personal data

We use personal data to create and secure accounts; authenticate users; record contract acceptance; verify subscription and access status; approve or revoke invited reviewer access; deliver reports; administer payments, cancellations, refunds, and disputes with transaction providers; respond to support and correction requests; prevent abuse and fraud; diagnose failures; measure the public site's use when consent is granted; maintain records; and meet legal obligations.

Where consent is the basis for analytics, you may withdraw it for future collection. Other processing may be necessary to perform the contract, provide requested services, protect legitimate business and security interests, or comply with law.

5. Service providers and overseas transfers

We disclose personal data only as reasonably needed for the purposes above. Providers include Google Cloud services for application hosting, databases, object storage, and task processing; Mailgun for account and service email delivery; Stripe and Sold through Link for paid-subscription Managed Payments, billing, transaction support, refunds, and disputes; and Google Analytics for consented public-site measurement.

These providers may process information outside Singapore. We use contractual and operational measures intended to provide protection comparable to Singapore's Personal Data Protection Act where required. Providers also handle information under their own applicable terms and privacy notices.

Invited reviewer registration and approval do not require a Stripe or Link checkout. TrackBTC does not send reviewer-registration or reviewer-approval information to Stripe or Link for that purpose.

We may disclose information to advisers, authorities, or counterparties where reasonably necessary to establish, exercise, or defend legal rights; comply with law; protect users or the service; or complete a corporate reorganisation or transfer subject to appropriate safeguards. We do not sell customer personal data.

6. Retention and security

We keep personal data only while it serves the purpose for which it was collected or a business, security, accounting, dispute, contract, or legal requirement. Authentication challenges are short-lived; signed-in sessions have a maximum lifetime of 30 days; analytics retention follows the configured Google Analytics property settings; and contract-acceptance and transaction records may be retained longer to establish the agreement and meet financial or legal obligations. We delete or anonymise data when it is no longer needed and retention is not required.

We use access controls, encryption in transit, authentication controls, logging, backups where appropriate, and limited staff or provider access. No security measure eliminates all risk.

7. Access, correction, withdrawal, and complaints

Subject to applicable law, you may ask for access to personal data we hold about you, information about its use or disclosure, or correction of inaccurate or incomplete data. You may withdraw consent for future consent-based processing. Withdrawal does not affect earlier lawful processing and may affect a feature that depends on that consent.

Email support@trackbtc.bot with enough detail for us to identify the request. We may verify identity and may decline or limit a request where law permits or requires. You may also raise a complaint with Singapore's Personal Data Protection Commission.

We may revise this Policy prospectively. A material revision will receive a new document version and an updated effective date. Document version: trackbtc_privacy_policy_v2.