Scope & applicability
This policy applies to California residents and describes how MagicTradeBot complies with the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA) (Cal. Civ. Code § 1798.100 et seq.). It supplements our Privacy Policy.
Because MagicTradeBot is a self-hosted binary, data responsibility is divided between us and you:
| Data category | Business (controller) | Description |
|---|---|---|
| Account & registration data | MagicTradeBot | Name, email address, password hash, account preferences |
| License & billing data | MagicTradeBot | Transaction references, license keys, purchase history |
| Technical & security data | MagicTradeBot | IP addresses, login events, session logs (retained 12 months) |
| Support communications | MagicTradeBot | Email threads, ticket content, submitted evidence |
| Trading data & bot configuration | You (the user) | API keys, trade history, strategy files on your server |
| Exchange API credentials | You (the user) | We never receive or store your exchange API keys |
Categories of personal information collected
In the 12 months prior to the date of this policy, MagicTradeBot has collected the following categories of personal information as defined under CCPA:
| CCPA category | Examples we collect | Purpose | Sold? |
|---|---|---|---|
| Identifiers | Name, email address, IP address | Account management, security, license validation | No |
| Commercial information | License purchase history, transaction references | Billing, license activation, fraud prevention | No |
| Internet / network activity | Login events, browser type, session data | Security monitoring, abuse prevention | No |
| Geolocation (derived from IP) | Country / region inferred from IP address | Fraud detection, jurisdictional compliance | No |
| Communications | Support emails, feedback submissions | Customer service, issue resolution | No |
Your CCPA / CPRA rights
As a California resident you have the following rights. All requests are fulfilled free of charge within 45 days of receipt of a verified request (extendable by a further 45 days with notice).
A. Right to know (§ 1798.100)
You may request disclosure of the categories and specific pieces of personal information we have collected about you, the categories of sources, our business purpose for collecting it, and the categories of third parties with whom we share it.
CCPA Know Request — [your account email]. We will provide a copy of your data in JSON or CSV format within 45 days.
B. Right to delete (§ 1798.105)
You may request deletion of personal information we have collected about you. We will fulfil deletion requests subject to the following retention requirements:
| Data category | Deletion outcome | Retention exception |
|---|---|---|
| Account profile (name, email) | Deleted within 45 days | None |
| License activation records | Deleted after legal retention period | 7 years — tax and financial regulation |
| IP and security logs | Deleted after retention window | 12 months — fraud and security |
| Support ticket content | Deleted after closure period | 2 years after ticket closure |
| Billing transaction records | Cannot be deleted before expiry | 7 years — legal obligation (Cal. Rev. & Tax Code) |
C. Right to correct (§ 1798.106 — CPRA)
You have the right to request correction of inaccurate personal information. Most account data (name, email) is correctable via self-service in your Account Dashboard. For other corrections contact us directly.
D. Right to opt-out of sale or sharing (§ 1798.120)
MagicTradeBot does not sell personal information and does not share it for cross-context behavioural advertising. This right does not apply to our practices; however, you may confirm this in writing by submitting a request with subject CCPA Opt-Out Confirmation.
E. Right to limit use of sensitive personal information (§ 1798.121 — CPRA)
We collect only the minimum sensitive personal information necessary for platform operation (account credentials and payment references). We do not use sensitive personal information for inferences, profiling, or any purpose beyond what is necessary to provide the service. This right is therefore largely not triggered by our practices.
F. Right to non-discrimination (§ 1798.125)
We will not discriminate against you for exercising any of your CCPA rights. Exercising your rights will not result in:
- Denial of service or license features
- Different pricing or quality of service
- Any form of retaliation or adverse treatment
Data sharing with third parties
We share personal information with third-party service providers only to the extent necessary to operate the platform. We do not sell data to or share data with data brokers, advertisers, or marketing platforms.
| Third party | Purpose | Data shared | CCPA category |
|---|---|---|---|
| NowPayments | Crypto payment processing | Transaction reference only | Commercial information |
| Resend | Transactional email delivery | Name, email address | Identifiers |
| Google Analytics | Anonymised website analytics | Anonymised usage data (IP anonymised) | Internet activity (anonymised) |
| Cloud infrastructure | Hosting of website and license system | Account and license data (encrypted) | Identifiers, commercial |
Sale of minors' information (§ 1798.120(c))
MagicTradeBot does not knowingly collect or sell the personal information of consumers under the age of 16. If we become aware that personal information of a minor has been collected, we will delete it promptly. If you believe we have inadvertently collected data about a minor, contact us immediately.
Security measures
We implement reasonable security measures appropriate to the nature of the personal information we process:
-
Encryption in transit. TLS 1.3 for all data transmitted between your browser and our servers.
-
Encryption at rest. AES-256 for all stored sensitive data.
-
Data minimisation. We collect only the personal information strictly necessary for license validation and account management.
-
Access controls. Role-based access and multi-factor authentication required for staff accessing personal data.
-
Breach notification. In the event of a breach involving California residents' personal information, we will notify affected individuals in accordance with Cal. Civ. Code § 1798.29 — without unreasonable delay.
How to exercise your rights
Submit any CCPA rights request by email. We will verify your identity before fulfilling sensitive requests to protect your data from unauthorised access:
Include with your request:
- Your account email address and license key
- The specific right you are exercising
- Proof of California residency and identity for deletion requests (e.g. government-issued ID)
Authorised agent requests
You may designate an authorised agent to submit a CCPA request on your behalf. We require written proof of authorisation and may verify your identity directly before processing the request.
Policy updates
This CCPA Compliance Policy is reviewed at least annually and updated when our data practices or applicable law changes. When material changes are made:
- The "Last Updated" date at the top of this page is updated
- California resident users are notified via email for significant changes
- A notice is displayed on the platform dashboard for 30 days
Continued use of MagicTradeBot after changes are published constitutes acknowledgement of the updated policy.
Contact
For all CCPA-related questions, data rights requests, or privacy enquiries:
If you believe we have not responded adequately to your CCPA rights request, you may contact the California Privacy Protection Agency (CPPA) at cppa.ca.gov or the California Attorney General at oag.ca.gov/privacy/ccpa.