Privacy Policy

1. How We Collect Personal Information

We collect information:

• provided by you, when you register an Account, use the Services, or contact us;
• automatically, when you access the Website or the Platform;
• from service providers acting on our behalf, such as our infrastructure and analytics providers; and
• from public blockchain records and from our blockchain analytics provider, in relation to deposits made to, and withdrawals made from, your Account.

2. Information We Collect

We may collect the following information about you:

• Account data. Your email address, your password in hashed form, any display name you choose, and your marketing preferences.
• Transaction and activity data. Your deposits, withdrawals, trades, open and resolved positions, balances, fees, the Bitcoin addresses and Lightning invoices used, and your Account ledger.
• Technical data. Your IP address, the approximate location derived from it, indicators of the use of a virtual private network or proxy, device and browser characteristics, operating system, session data and timestamps.
• Usage data. Pages visited, features used, clickstream data, error logs, crash reports and performance data.
• Communications data. Correspondence with our support team, including any information you choose to include, and responses to surveys.
• API data. API keys issued to you and records of your API usage.
• Blockchain data. Publicly available blockchain information relating to deposits and withdrawals, including transaction details and Bitcoin addresses, together with the results of the screening we perform on it.
• Cookies data. Information received through cookies and similar technologies, as described in section 9.

We do not request, and do not knowingly collect, special category information such as racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data, health information, or information about sexual orientation or sexual life. You should not provide such information through the Services or our support channels. We do not knowingly collect information about children, and the Services are not available to persons under 18.

3. The Purposes We Collect Your Information For

To perform our contract with you. To register and operate your Account; to execute, settle and record your trades and maintain your Account ledger; to process deposits and withdrawals; to provide customer support; and to send trade confirmations, settlement notices and other service communications.

For our legitimate interests. To secure the Services and prevent fraud, unauthorized access and abuse, including identifying Accounts under common ownership or control and enforcing trading and position limits; to apply geographic access controls, including IP geolocation and the detection of virtual private networks and proxies, so that we can block access from Excluded Countries and Restricted Territories; to screen deposits and withdrawals using blockchain analytics in order to detect and prevent illicit activity; to monitor, troubleshoot and improve the performance and reliability of the Services; and to manage our business, handle complaints and disputes, and exercise our legal rights.

To comply with a legal obligation. To comply with applicable laws, lawful orders and requests from competent authorities, and to maintain records we are required to keep.

With your consent. To send you marketing communications where you have opted in, and to set non-essential cookies. You may withdraw your consent at any time, and withdrawal does not affect the lawfulness of processing carried out before it.

4. Disclosure of Information

We may disclose personal information to:

• service providers and other third parties that access personal information to perform functions on our behalf;
• our parent and affiliated companies, for operational, administrative and technical support;
• lawyers, auditors, security testers and other professional advisers, where necessary to obtain advice or to protect and manage our business interests; and
• local or overseas legal, regulatory, law enforcement, governmental and tax authorities, where required by applicable law or a lawful order.

The service providers we engage fall into the following categories: cloud infrastructure, hosting and application deployment; network security, content delivery and threat protection; transactional and service email delivery; product usage and performance analytics, which we configure with IP anonymization and with session replay disabled; IP geolocation, used for geographic access control; and blockchain analytics, used to screen deposits and withdrawals. If you would like to know which provider processes your personal information for a particular purpose, please write to us at privacy@glimpse.markets.

These recipients may process personal information only to the extent necessary to perform their respective functions and are subject to contractual confidentiality and data protection obligations. We do not sell personal information, and we do not share it with advertisers. In the event of insolvency, acquisition, merger, transfer of ownership or sale of assets, personal information may be disclosed to the acquirer or successor.

5. Transfer of Information to Other Jurisdictions

We are established in the Republic of Panama, and our service providers operate in several countries. Your personal information may therefore be transferred to, stored in, or accessed from jurisdictions that may not provide levels of data protection equivalent to those of your home jurisdiction.

Where we transfer personal information outside Panama, we do so only to recipients located in countries that provide a level of protection equivalent to or higher than that required under Panamanian law, or on the basis of contractual guarantees that oblige the recipient to apply equivalent protections and to respect your rights, or with your consent. You may request further information about these safeguards by contacting us.

6. How We Protect Your Information

We employ technical, organizational and administrative measures designed to protect personal information against unauthorized access, disclosure, alteration, and destruction. These include:

• TLS encryption for data in transit and AES-256 encryption for data at rest;
• role-based, least-privilege access controls restricting access to authorized personnel;
• multi-factor authentication, including hardware security keys, for access to sensitive systems;
• segregated system architecture and immutable audit logs;
• web application firewalls, distributed denial-of-service protection and rate limiting;
• scoped and revocable API keys, secrets management and periodic key rotation;
• regular vulnerability scanning and annual third-party penetration testing; and
• encrypted backups, vendor security reviews, and privacy and security training for our personnel.

We also limit the information we hold. Because we do not carry out identity verification, we do not hold identity documents or government identification numbers.

We maintain an incident response framework covering monitoring, containment, investigation, remediation, and post-incident review. Where a personal data breach is likely to result in a risk to your rights, we will notify you without undue delay by email or in-platform notification, and we will notify ANTAI and any other competent supervisory authority within the period required by applicable law. You may report a suspected security issue, phishing attempt or unauthorized access to your Account at privacy@glimpse.markets.

Our security measures are reviewed and updated regularly. No system can be guaranteed to be secure, and while we take all reasonable steps to protect personal information, we cannot guarantee absolute security.

7. Retention of Information

We retain personal information only for as long as necessary to satisfy the purposes described in this notice. This may include a period after your Account is closed, in order to meet legal, regulatory, accounting, reporting or dispute-resolution requirements. In deciding the appropriate retention period we consider the amount, nature and sensitivity of the information, the potential risk of harm from unauthorised use or disclosure, the purposes for which we process it, and whether those purposes can be achieved by other means.

Our standard periods are as follows:

• Account and transaction records are retained for the life of the Account and for five years following its closure.
• Support correspondence is retained for as long as necessary to resolve the matter and to maintain dispute and quality records.
• Security and access logs are retained for up to 90 days.
• Technical and analytics data is retained for up to 12 months.
• Marketing contact information is retained until you withdraw your consent, after which it is deleted.

Information recorded on the Bitcoin blockchain is public and permanent. It is outside our control and cannot be deleted by us.

8. Your Rights

You have the following rights in relation to your personal information:

• Access. To obtain confirmation of whether we process your personal information and to receive a copy of it, together with details of its use and disclosure.
• Rectification. To have inaccurate or incomplete information corrected or completed.
• Erasure. To have your personal information erased in certain circumstances. This right is not absolute and may be limited by legal requirements or overriding legitimate interests.
• Restriction. To request that we limit our use of your personal information in certain circumstances, while continuing to store it.
• Portability. To receive certain personal information in a structured, commonly used, machine-readable format and to have it transmitted to another controller.
• Objection. To object to processing based on our legitimate interests, and to object at any time to direct marketing.
• Automated decisions. To request human review of any automated decision that produces legal effects concerning you or similarly significantly affects you.

To exercise any of these rights, contact us in writing at privacy@glimpse.markets. We may ask you to verify control of the email address registered to your Account. We will respond within the period required by applicable law, and in any event no later than one month from receipt. Where a request is complex or where we receive a high volume of requests, we may extend that period to the extent applicable law allows, and we will tell you and explain why.

We do not charge a fee for exercising these rights. Where a request is manifestly unfounded or excessive, in particular because it is repetitive, we may charge a reasonable fee based on our administrative costs or decline to act, and we will explain our decision. We may also need to retain personal information where applicable law requires it. You may lodge a complaint with ANTAI or with the data protection authority in your country of residence.

9. Cookies

Cookies are small text files placed on your device when you visit the Website. They store preferences, allow the Website to recognise your browser, and support the functionality and security of the Services. Session cookies are deleted when you close your browser, and persistent cookies remain until they expire or you delete them.

We use essential and authentication cookies, which maintain your session and enable access to secure areas; security cookies, including cross-site request forgery tokens and cookies set by our network security provider to identify trusted traffic and detect malicious activity; functional cookies, which store language and interface preferences; and analytics cookies, used only with your consent, through which our analytics provider collects usage and performance information.

We do not use advertising or cross-site tracking cookies, and our transactional emails do not contain tracking pixels. IP geolocation and the detection of virtual private networks and proxies are performed in each session for security and access-control purposes and are not cookie-based.

You may accept or decline non-essential cookies, change your choices, or withdraw your consent at any time through our cookie settings, and you may block or delete cookies through your browser. Essential cookies cannot be disabled, because they are necessary for the security and proper functioning of the Services.

10. Changes to This Notice

We may update this Privacy Policy to reflect changes in our data processing practices or in legal requirements. Where the changes are significant, we will notify you by email and through the Website, and we will publish the updated notice with a revised date. Prior versions remain available on the Site.

11. Contact Us

You may contact us at privacy@glimpse.markets.