Privacy Policy

1. Who this policy covers

This policy covers personal data we collect about you when you create an account, subscribe, or join our VIP Telegram channel at https://xausignal.ai.

2. Data we collect

• Account: email, display name, hashed password, creation timestamp.
• Telegram identity: when you sign in with Telegram or link your account, we store your Telegram user id, username, first/last name, and profile photo URL as provided by Telegram's Login Widget.
• Billing: Stripe customer id, subscription id, checkout-session id, payment method type, plan, current period end. We do not store card numbers or PromptPay identifiers — those stay with Stripe.
• VIP membership: invite link, join and expiry timestamps, status (pending/active/kicked).
• Operational: server logs (IP, user-agent, timestamp) for security and debugging, auto-rotated after 30 days.
• Audit log: a tamper- evident record of invite / kick / payment events tied to your account, used for compliance and customer support.

3. How we use your data

• Provide, maintain, and improve the service (fulfil your subscription).
• Issue and revoke VIP channel access in line with your subscription status.
• Process payments via Stripe and record receipts.
• Send transactional emails (receipts, invite instructions, renewal notices).
• Prevent fraud, abuse, and violations of the Terms.
• Comply with legal obligations (tax, accounting, law-enforcement requests).

We do not sell your data and we do not use it to train third-party AI models.

4. Processors we share data with

We rely on the following processors. Each has their own privacy policy which governs the data they receive.

• Stripe, Inc. — card + PromptPay processing, customer billing portal. Receives your email, plan, and payment metadata.
• Telegram FZ-LLC. — identity (Login Widget), VIP channel delivery. Receives whatever Telegram itself collects under its own terms.
• Neon.tech / Postgres. — database hosting.
• Vercel Inc. — web hosting and logs.
• Railway Corp. — bot + worker hosting and logs.
• Cloudflare, Inc. — DNS, CDN, and DDoS protection.
• TwelveData, Inc. — market data (receives no personal data; only symbol + timeframe queries).

5. International transfers

Our processors operate in the United States, European Union, and Singapore. Data about you may be transferred outside your country of residence. We rely on the processors' standard contractual clauses and their own safeguards.

6. Retention

• Account data: kept until you delete your account, then erased within 30 days.
• Billing records: kept 7 years to meet tax / accounting law.
• Audit log: kept 2 years, then purged.
• Server logs: rotated after 30 days.

7. Your rights

Depending on where you live, you may have the right to access, correct, delete, export, or object to the processing of your data. Email [email protected] and we will respond within 30 days.

8. Security

We use TLS in transit, at-rest encryption on our database provider, HMAC-signed sessions, and least-privilege API tokens. No card details ever touch our servers.

9. Children

The service is not intended for children under 18. We do not knowingly collect data from children.

10. Changes

We may update this policy from time to time. Material changes will be announced in the VIP channel and on the dashboard.

11. Contact

Data-protection questions? Email [email protected].