Privacy Policy

Who we are

ArbLens ("ArbLens", "we", "us", "our") operates the treasury and arbitrage tracking platform at arblens.io. This policy explains what personal data we collect when you use the service, how we use it, and your rights over it.

Data we collect

Account data. When you register, we collect your email address and create an account record linked to a unique identifier (Cognito sub). If you sign in via Telegram, we receive your Telegram user ID and display name.

Exchange credentials. API keys and secrets you provide are encrypted with AWS KMS before storage and are never returned to the browser. Passphrases (OKX, KuCoin, Bitget) are stored as part of the same encrypted blob.

Financial data. We fetch and store balance snapshots, transaction history, trade fills, and open position data retrieved from exchanges on your behalf. This data is tied to your account and workspace.

Usage data. We collect product analytics via Google Analytics 4 — specifically which features are used, onboarding milestones reached, billing events, and technical errors. We send an opaque user ID (your Cognito UUID) and event names only. We do not send your email address, wallet addresses, API keys, exchange credentials, or any financial amounts to Google. Server-side, we log API request timestamps and sync outcomes to operate the service reliably.

Browser storage. See our Cookie Policy for details on what we store locally in your browser.

How we use your data

• To authenticate you and keep your session secure.
• To connect to exchange APIs and fetch the data you request.
• To store and display your balance history, positions, and transaction ledger.
• To send Telegram or email alerts you have configured.
• To diagnose errors and maintain service reliability.
• To understand how the product is used and improve it (Google Analytics, only after consent).

We do not sell your data, share it with advertisers, or use it to train machine-learning models.

Legal basis for processing (GDPR)

If you are located in the European Economic Area, our legal bases are: contract performance (providing the service you signed up for), legitimate interests (security logging, abuse prevention), and consent (cookie storage, optional notifications, Google Analytics). Analytics data is sent to Google only after you accept analytics cookies — you may withdraw consent at any time via the cookie banner or the Google Analytics Opt-out Add-on.

Data retention

We retain your account and financial data for as long as your account is active. You can request deletion at any time (see "Your rights" below). Encrypted API keys are deleted immediately when you remove an account. Aggregated, anonymised snapshots may be retained for service diagnostics after account deletion.

Third-party processors

• AWS (Amazon Web Services) — hosting, database, KMS encryption, Cognito authentication.
• Google LLC (Google Analytics 4) — product usage analytics, only after consent. Receives event names and an opaque user ID. No financial data, credentials, or PII beyond the user ID is shared. Data may be processed in the United States under Google's Data Processing Terms.
• Telegram — optional alert delivery and Telegram login (if used).
• Exchange APIs — data is fetched from the exchanges you connect; their privacy policies apply to data held on their platforms.

Security

API keys are encrypted with AWS KMS before being written to the database and are decrypted in-memory only at sync time. Network traffic is encrypted with TLS. Access to production infrastructure is restricted and logged.

Your rights

You have the right to access, correct, or delete your personal data. To exercise these rights, email privacy@arblens.io. EEA users also have the right to data portability and to lodge a complaint with their local data protection authority.

Changes

We will update this policy when our practices change. Material changes will be announced in the app. The "Last updated" date reflects the most recent revision.

Contact

ArbLens — privacy@arblens.io