Legal
Privacy Policy
Effective 25 October 2026 · Avtim LLC, Yerevan, Armenia
This policy explains what personal data Avtim LLC ("Avtim", "we") collects when you use avtim.com and the Avtim Service, why, how long we keep it, and your rights. We wrote it to be read, not skimmed: it is short because we collect little.
1. Who is responsible
The data controller is Avtim LLC, a limited liability company registered in the Republic of Armenia, Yerevan, Armenia. Questions and requests: legal@avtim.com.
2. What we collect and why
| Data | When | Why | Legal basis | Kept |
|---|---|---|---|---|
| Email address, password (stored as a salted hash), optional name and company | You create an account | To provide the account, send verification and security emails, and alerts you configure | Performance of a contract | Until you delete the account |
| Alert settings, API keys (stored as hashes), saved views | You use the account | To deliver the features you set up | Performance of a contract | Until you delete them or the account |
| Telegram chat identifier | You enter it in alert settings | To send alerts to Telegram | Consent, withdrawable by clearing the field | Until cleared |
| IP address, user agent, requested pages and API calls, timestamps | Every request | Security, abuse prevention, rate limiting, debugging | Legitimate interest in running a secure service | Server logs 90 days; rate-limit counters up to 1 hour |
| Name, email, company, message, IP | You use the contact form | To answer you | Legitimate interest in replying to your request | 24 months after the last exchange |
| Email address, IP, confirmation time | You subscribe to the digest | To send the monthly digest | Consent, double opt-in; withdraw with the unsubscribe link | Until you unsubscribe, then the address is kept on a suppression list |
| Invoicing details (company name, address, tax number) | You buy a paid plan | Billing and accounting | Contract and legal obligation | As required by Armenian accounting law |
We do not collect payment card data (paid plans are invoiced), do not profile users, do not buy data about you and do not sell or rent your data to anyone.
3. Cookies
We use only the cookies needed to run the site: a session cookie, a cross-site request forgery token and, when enabled, the Cloudflare Turnstile anti-bot check on forms. There are no advertising or analytics trackers. Details in the Cookie Notice.
4. Who processes data for us
- Hosting: our servers are rented from a hosting provider in the European Union (the Netherlands). Data is stored on those servers, encrypted in transit.
- Transactional email: an email delivery provider sends verification, password-reset and alert messages on our behalf and sees the recipient address and message content.
- Anti-bot check: when enabled, Cloudflare Turnstile receives the IP address and browser characteristics of a visitor submitting a form, under Cloudflare's privacy terms.
- Telegram: if you enable Telegram alerts, messages are delivered through Telegram's Bot API to the chat you specify.
Processors act on our instructions under written agreements. We do not transfer your data outside the European Union and Armenia except where a processor named above does so under appropriate safeguards (such as the European Commission's standard contractual clauses).
5. Exchange data is not personal data
The latency, spread and funding figures we publish are measurements of public endpoints of exchanges. They contain no information about you or any other individual.
6. Your rights
You can access, correct, export and delete your personal data from the account settings. Deleting the account removes your profile, keys, alert settings and saved views immediately; server logs expire on their own within 90 days; invoicing records are kept as the law requires. You may also object to processing based on legitimate interest, withdraw consent at any time, and ask us for a copy of your data by writing to legal@avtim.com. We answer within 30 days. If you are in the European Economic Area or the United Kingdom you may complain to your local data protection authority; in Armenia, to the Personal Data Protection Agency.
7. Security
Passwords and API keys are stored as hashes and cannot be recovered by us. All traffic is encrypted with TLS. The public website runs on infrastructure separate from our trading systems. Access to production is limited to named engineers with hardware-backed authentication. If a breach affecting your data ever occurs, we will notify you and the competent authority as the law requires.
8. Children
The Service is not directed at anyone under 18 and we do not knowingly collect data from children.
9. Changes
We will post changes here and, for material changes, email account holders at least 14 days in advance. The effective date at the top tells you which version you are reading.