Privacy Policy

1 Who we are

MarketsMill ™ ("we", "us", or "our") operates a website and an online trading, investment, and referral platform (together, the "Service").

MarketsMill ™ is operated by registered legal entity name, company form, and registration number, whose registered office is at registered office address. If you have any questions about this policy or about how we handle your personal data, you can reach us at privacy contact email.

In this policy, "personal data" means any information that identifies you or relates to you as an identifiable person.

2 Scope of this policy

This policy applies to visitors to our website and to registered account holders who use the Service. It does not apply to third-party websites or services that we link to or integrate with, each of which has its own privacy practices. Where we rely on outside providers to run the Service, they are listed in section 6.

3 The personal data we collect

3.1 Account details you provide

When you create an account, we ask for only two pieces of personal information: your email address and a password. Your password is never stored in readable form. You may also enter a referral code if someone invited you. We create a display name and a public username for you automatically from the first part of your email address, and you can change both later in your settings.

3.2 Profile details (optional)

In your account settings you can choose to add a phone number and a postal address. These fields are optional, and we store them only if you provide them.

3.3 Identity verification

Because we operate a financial service, we are required to verify the identity of account holders before certain activities, such as withdrawals. When you complete identity verification, you upload a photograph of a government-issued identity document and a selfie. We send the identity-document image to our verification provider to confirm that it is genuine; your selfie is kept only in our own records and is not sent to that provider. We store the result of the check and the date, and we retain the images you uploaded.

3.4 Beneficiary (nominee) details

You can choose to name a beneficiary for your account. If you do, you provide information about that person, which may include their name, their relationship to you, their contact details, their date of birth, a government identification number, and, optionally, a copy of their identity document. If someone later files a claim on an account as a beneficiary, that person provides their own contact details, a death certificate, and a copy of their identity document. Because this is information about a person other than you, please provide it only if that person is aware of it and agrees.

3.5 Financial and transaction details

When you deposit, invest, transfer, or withdraw funds, we record the details of the transaction. Depending on the action, this can include the amount and plan, the cryptocurrency address and network generated for your payment, the on-chain transaction reference, and, for withdrawals, the destination wallet address that you supply. For your protection, cryptocurrency withdrawals can be sent only to an address that you have saved to your account. For transfers between members, we record both accounts involved and any note you add. Your account balance is calculated from this transaction history.

3.6 Referral network

MarketsMill ™ includes a referral programme. We record who referred you and whom you refer, and we keep the resulting multi-level referral structure so that commissions can be attributed correctly.

3.7 Source-of-funds information

Where it is needed to meet anti-money-laundering obligations, we may ask you to provide information about the source of the funds you deposit, such as a transaction reference and a short description. We keep this as part of our compliance records.

3.8 Device, session, and technical data

When you sign in, we collect technical information to keep your account secure: your IP address, your browser's user-agent string, and an approximate location (country and city) that our infrastructure provider derives from your connection. We use this to protect your account and to show you which devices and sessions are signed in. We keep your full IP address only briefly in our session records; in our longer-term device history we keep only a shortened, partial IP address together with the approximate location.

We do not collect your date of birth, nationality, or a government identification number for your own account (identity is confirmed instead through the document check in section 3.3). Those fields are collected only for a beneficiary you choose to name.

4 How we use your data

We use your personal data to:

• create and operate your account and provide the Service (to perform our agreement with you);
• verify your identity and meet our anti-money-laundering and other legal obligations (to comply with the law);
• process deposits, investments, transfers, and withdrawals;
• calculate and pay referral commissions;
• keep your account secure, prevent fraud, and detect abuse (our legitimate interest in a safe Service);
• send you service and security messages, and any optional updates you have asked for;
• respond to your requests and provide support.

We do not use your personal data for advertising, and we do not sell your personal data.

5 Cookies and analytics

We use a small number of cookies, and all of them are strictly necessary to sign you in and keep your account secure. Specifically, we set a session cookie and a device-recognition cookie for your account, and a separate session cookie for the staff who administer the Service. We do not use advertising or cross-site tracking cookies.

To understand how our website and platform are used, we rely on Plausible Analytics, a privacy-friendly tool that does not set cookies, does not collect personal data, and does not track you across other websites. It provides only aggregate figures, such as which pages are visited.

6 Who we share your data with

We do not sell your personal data. We share it only with the service providers we rely on to operate the Service, and only to the extent each one needs it:

• Cloudflare provides our hosting, database, file storage, transactional email delivery, and security, including bot protection. As our core infrastructure provider, it processes data on our behalf across the Service.
• NowPayments processes cryptocurrency deposits and withdrawals. To set up a payment, we send it information that identifies the transaction, which includes your account identifier, your name, your referral code, and your referrer's code. For a withdrawal, we send the destination address and the amount.
• Didit is our identity-verification provider. We send it the image of your government identity document to confirm it is genuine. We do not send it your selfie.
• Plausible provides the cookieless website analytics described in section 5.
• A QR-code service is used to display cryptocurrency addresses as scannable images. To generate the image, the address (and, for a deposit, the amount) is sent to that service.
• Google Fonts may be used to display fonts on some pages, which causes your browser to request the font files from Google.

We may also disclose personal data where the law requires it, for example in response to a valid legal request, or where it is necessary to protect our rights, our users, or the Service.

7 International data transfers

The service providers listed above may process your data in countries other than your own. Where we transfer personal data internationally, we take steps to make sure it remains protected. Describe the transfer safeguards used, for example standard contractual clauses, once the operating entity and jurisdiction are confirmed.

8 How long we keep your data

We keep your personal data for as long as your account is active, and afterwards for as long as we need it to meet our legal, accounting, and anti-money-laundering obligations, or to resolve disputes.

Some technical data is kept only briefly. Sign-in session records and short-lived security codes expire automatically, within minutes to a few weeks. We keep device history, used for the account-security features described above, for a limited period of around 90 days of inactivity. Identity documents, transaction records, referral relationships, and beneficiary information are kept for longer, as part of our records and to meet legal requirements.

Confirm the specific retention periods for identity documents, transaction records, and beneficiary data with counsel, and put in place an automatic routine that deletes personal data, including old device history, once those periods end.

9 Your rights and choices

Depending on where you live, you may have rights over your personal data. These can include the right to access the data we hold about you, to correct it, to ask us to delete it, to object to or restrict certain uses, to receive a copy in a portable format, and to withdraw consent you have given.

You can update much of your profile yourself in your account settings. For any other request, contact us at privacy contact email. Please note that we may need to keep certain information to meet our legal obligations, such as anti-money-laundering records, even after you ask us to close your account or delete your data. If you believe we have not handled your data properly, you may have the right to complain to your local data-protection authority.

10 Communications and opt-out

We send two kinds of email. Service and security messages, such as email verification, sign-in codes, password resets, and withdrawal confirmations, are necessary to operate your account and cannot be switched off while your account is open. Optional messages, such as newsletters or promotional updates, can be turned off at any time using the unsubscribe link in those emails or through your notification settings.

11 How we protect your data

We take the security of your account seriously. Our measures include:

• storing passwords only as a salted cryptographic hash, never in readable form;
• offering optional two-factor authentication, and requiring a one-time code to authorise withdrawals and changes to sensitive settings;
• restricting cryptocurrency withdrawals to wallet addresses you have saved in advance;
• serving all connections over encrypted HTTPS and applying strict browser security policies;
• keeping identity documents in access-controlled storage that is not publicly reachable and is available only to authorised staff for verification.

No method of transmission or storage is completely secure. While we work hard to protect your personal data, we cannot guarantee absolute security.

12 Children

The Service is intended for adults. It is not directed at children, and we do not knowingly collect personal data from anyone under the age of 18. Confirm the minimum age for your jurisdiction. If you believe a child has provided us with personal data, please contact us so we can remove it.

13 Changes to this policy

We may update this Privacy Policy from time to time. When we make a material change, we will update the "Last updated" date at the top of this page and, where appropriate, let you know.

14 How to contact us

If you have any questions about this Privacy Policy or about how we handle your personal data, please contact us at privacy contact email, or write to us at registered office address.