Privacy Policy
Last updated: 27 October 2026 · Version: 2026-10-27
1. Who we are
LayTrader (laytrader.com), Türkiye ("we", "us") is the controller of the personal data processed through LayTrader: the website and web app, our e-mails and the Telegram bot @Laytrader_bot. Privacy contact: info@laytrader.com.
We process personal data in accordance with the Turkish Personal Data Protection Law No. 6698 ("KVKK") and, where it applies to you, the EU General Data Protection Regulation ("GDPR").
2. In short
- We collect only what we need to run your account and your simulation.
- No real money, no exchange API keys, no payment data.
- No advertising or tracking cookies and no third-party analytics. Our pages load no third-party scripts, fonts or trackers. We only measure, inside our own service, which features are used (section 3: usage measurement). We do not sell your data or use it for advertising.
- You can download your data and delete your account at any time in your account settings.
3. Data we process
| Category | What | Source |
|---|---|---|
| Account data | E-mail address; password (stored only as a salted PBKDF2 hash, never in readable form); preferred language; account status and plan; e-mail verification status; sign-up date; last sign-in | You; the Service |
| Your choices | Traders (Binance UIDs) you follow and the notification setting for each; display preferences (theme, hiding amounts, onboarding choices) | You |
| Simulated account | Virtual balance, simulated positions and ledger | The Service |
| Sessions and security | Session records (created, last active); anti-forgery (CSRF) tokens; IP address for rate limiting; log of administrator actions on accounts (for example suspension or plan change) | Automatic; our administrators |
| E-mail records | For each e-mail we send you: recipient, type, subject, sending status | The Service |
| Telegram (only if you link the bot) | Telegram chat ID and the time you linked the bot | You, via Telegram |
| Messages to us | What you write to us | You |
| Usage measurement | Which first-time steps you completed and when (for example sign-up, e-mail verification, first sign-in, first trader followed, first settings change, first simulated position, second day of use, Telegram link); per UTC day, how many times you used each feature (for example opened the dashboard or Following page, signed in or out, followed or unfollowed a trader, changed copy settings - only WHICH setting changed, never its value). No time of day, no e-mail address, IP address, browser details, setting values or search text. Separately, anonymous daily counters that are not linked to any account (for example sign-up page views and failed sign-in counts, sign-up refusal reasons, how many users follow each public trader) | The Service |
We do not ask for or process payment details, identity documents, exchange API keys or special categories of data (such as health data).
4. Why we use it (purposes and legal bases)
| Purpose | Legal basis (GDPR) |
|---|---|
| Creating and running your account: sign-up, sign-in, e-mail verification, password reset, account e-mails | Contract (Art. 6(1)(b)) |
| Providing what you asked for: trader feed, simulated copy, in-app and e-mail notifications, data export, account deletion | Contract (Art. 6(1)(b)) |
| Telegram notifications | Consent (Art. 6(1)(a)). You can withdraw it at any time by unlinking the bot; this does not affect earlier processing |
| Keeping the Service secure: rate limits, preventing abuse and fraud, enforcing the Terms, administrator log | Legitimate interests (Art. 6(1)(f)) in a secure, working service |
| Backups and recovery | Legitimate interests (Art. 6(1)(f)) |
| Aggregated statistics that do not identify you, such as "X users follow this trader" | Legitimate interests (Art. 6(1)(f)) |
| Usage measurement: understanding which features are used and where people drop off, so we can improve LayTrader. We do not use it for advertising or profiling and do not share it | Legitimate interests (Art. 6(1)(f)) |
| Complying with the law; establishing or defending legal claims | Legal obligation (Art. 6(1)(c)); legitimate interests (Art. 6(1)(f)) |
Under KVKK, the corresponding legal bases are those in Article 5(2): performance of a contract, legal obligations, data made public by the data subject and our legitimate interests; for Telegram notifications, your explicit consent (Article 5(1)).
We do not make decisions about you based solely on automated processing that have legal or similarly significant effects. We do not send marketing e-mails.
5. How long we keep it
| Data | Retention |
|---|---|
| Account data, your choices, simulated account | While your account is active. When you delete your account they are deleted immediately; records we keep for the periods below no longer contain your e-mail address (they are anonymised). |
| Sessions | Until you sign out, or after 30 days without activity |
| Usage measurement | Daily usage lines: 400 days, then deleted. First-time steps: while your account is active. Both are deleted with your account. Anonymous counters (not linked to any account) are kept as aggregate statistics |
| E-mail records | 30 days after sending |
| Administrator action log | 1 year |
| IP addresses for rate limiting | Held in memory only for short time windows; not stored in the account database. Web server access logs: 90 days |
| Telegram link | Until you unlink the bot or delete your account |
| Backups | Daily backups, kept for 14 days and then overwritten; deleted data disappears from all backups within 30 days at the latest |
| Messages to us (support and e-mail correspondence) | 2 years |
We keep data longer only where the law requires it or to establish or defend legal claims.
6. Who receives data
We do not sell or rent personal data. We use these service providers:
| Provider | Role | Data |
|---|---|---|
| Hetzner Online GmbH, server in Finland (EU) | Hosting of the Service, database and backups | All data above |
| Güzel Hosting (Türkiye) | DNS and outgoing e-mail relay (sender noreply@laytrader.com) | Your e-mail address and the e-mails we send you |
| Telegram | Delivers bot messages, only if you link @Laytrader_bot | Telegram ID and message content |
| Let's Encrypt (ISRG) | TLS certificates for HTTPS | No user data |
| Binance | Public source of trader data | We send no user data to Binance |
Our providers act on our instructions under data-processing terms. Telegram also processes data as an independent controller under its own privacy policy. We may disclose data to authorities where the law requires it, to our professional advisers, or to a successor if the Service is transferred (we will tell you first).
7. International transfers
Our server is located in Finland (EU) and is operated by Hetzner Online GmbH. Some providers (our DNS and e-mail provider Güzel Hosting in Türkiye, and Telegram) may process data outside the EU/EEA. Where the destination country has no EU adequacy decision, we use appropriate safeguards such as the European Commission's Standard Contractual Clauses. Because we operate from Türkiye and our server is in Finland, storing your data on it is a transfer abroad under KVKK, which we carry out in accordance with Article 9 of KVKK. You can ask us for details.
8. Your rights
You have the right to:
- access your data and receive a copy (in your account settings you can export it as a JSON file);
- correct inaccurate data;
- erase your data (in your account settings you can delete your account);
- restrict processing;
- data portability;
- object to processing based on legitimate interests;
- withdraw consent at any time (for example, unlink Telegram);
- complain to a data protection supervisory authority, in particular where you live or work or where the alleged infringement took place, or to the Turkish Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu).
Under Article 11 of KVKK you also have the right to learn whether your data are processed, to learn the purpose of processing, to know the third parties to whom data are transferred, to object to a result against you that arises solely from automated analysis, and to claim compensation for damage caused by unlawful processing.
For anything you cannot do in the app, write to info@laytrader.com. We reply within one month (up to two more months for complex requests) and may need to check that the request comes from you.
9. Security
We protect data with: HTTPS on every page; passwords hashed with salted PBKDF2-HMAC-SHA256 (600,000 iterations); session cookies marked HttpOnly, Secure and SameSite; protection against cross-site request forgery; limits on sign-in and sign-up attempts; automatic expiry of inactive sessions; restricted administrator access; daily backups. No system is perfectly secure. If a personal data breach is likely to put your rights at risk, we will inform you and the authorities as the law requires.
10. Children
LayTrader is only for people aged 18 or over. We do not knowingly process children's data. If you believe a minor has an account, contact us and we will delete it.
11. Traders shown on LayTrader
LayTrader displays information that lead traders have made public on Binance (public nickname, ID, positions and performance). We process this information on the basis of our legitimate interests in providing the Service (GDPR Art. 6(1)(f)) and, under KVKK, because the trader has made it public and on the basis of our legitimate interests (Article 5(2)(d) and (f)). We show only information that the trader has made public on Binance. If you are such a trader and have a question or want to object, contact info@laytrader.com; we will review every objection and, where it is justified, stop showing your data.
12. Cookies
See our Cookie Policy.
13. Changes
We may update this policy. We will tell you about material changes by e-mail or in the app. The "Last updated" date shows the current version.
14. Contact
LayTrader (laytrader.com), Türkiye - info@laytrader.com