Privacy Policy

Personal Information

• Name, email address, and phone number
• Account credentials and authentication data
• Payment and billing information
• Investment preferences and risk profile data
• Preferred market sectors and watchlists

Usage Information

• Device information and browser type
• IP address and location data
• Platform usage patterns and feature interactions
• Search queries and market data requests
• Session duration and login history

When you sign in, we record the IP address, the device (browser and operating system) and the approximate location of the sign-in. We use them to protect your account — to show you where it is signed in, to tell you about a sign-in from a new device or country, to limit repeated attempts, and to investigate unauthorized access. Mongolia's Personal Data Protection Law treats an IP address as personal data, and we keep it only as long as these purposes need it:

• Full IP addresses: 30 days. After that, we keep only the network the address belonged to, not the address itself (for example, 203.0.113.57 becomes 203.0.113.0/24; an IPv6 address keeps only its first 48 bits). This applies to the IP addresses on your sign-in sessions, counted from the session's last activity once it has ended; on remembered devices, counted from the device's last use; and in our security log, counted from the event. A session you are still signed in to is never changed.
• Sign-in history: 180 days. The record of an ended sign-in session, together with the device, IP address and location stored on it, is deleted 180 days after its last activity. The two records described next are kept separately and are not deleted with it.
• Remembered devices. When you choose to remember a browser, we keep a record of it: its browser and operating system, the last three countries and the last city it was used from, and its IP address (reduced to the network 30 days after its last use, as above). A device unused for 90 days, or one you forget in Settings → Security, is no longer recognised, but its record is not yet deleted automatically.
• Sign-in countries and networks. To tell you about a sign-in from a country your account has never used, we keep the countries your account has signed in from and, for each network, a one-way code derived with a secret key — never the address itself — with when each was first and last seen. These are not yet deleted automatically.
• Security log: 400 days. Our record of security events (sign-ins, two-factor verification, security setting changes) is deleted after 400 days. Its IP addresses are reduced to the network after 30 days, as above.

These periods run automatically every day, and reducing or deleting this data cannot be undone. Some records are not yet covered by them: the remembered-device and sign-in-country records above, and a few other records that can contain an IP address — administrative audit records, the record of when a recovery code was used, and referral records. We are reviewing them and will update this section when they are covered.