Privacy Policy
Last updated 21 October 2026
1. Who is responsible
Tran Thanh Dat, Hanoi, Vietnam, operating HolyGrail, is the controller of personal data described here. Contact: support@holygrailbot.com.
2. What we collect
- Account data — email address and password hash. We never store passwords in plain text.
- Usage data — the strategies and parameters you configure, simulation results, and basic product analytics such as pages viewed and features used.
- Technical data — IP address, browser type and timestamps, recorded in server and security logs.
- Optional contact handles — your Telegram chat ID, only if you choose to enable alerts.
You can browse the site and run backtests without creating an account. We collect no account data until you register.
3. What we do not collect
- Payment card details. Payments are handled by our payment provider acting as merchant of record. Card numbers never reach our servers; we receive only subscription status and an anonymised transaction reference.
- Exchange API keys. The Service never connects to exchange accounts and has no field to enter such keys.
- Financial account information of any kind, and no special-category data.
4. Why we use it, and on what basis
- To provide the Service — run your bots, store results, authenticate you. Basis: performance of our contract with you.
- To bill you — manage subscriptions through our payment provider. Basis: contract and legal obligation.
- To keep the Service working and secure — diagnose errors, prevent abuse and fraud. Basis: our legitimate interests.
- To send service messages — outage notices, billing issues, material changes to terms. Basis: contract.
- To send product updates — only if you opt in. Basis: your consent, withdrawable at any time.
We do not sell personal data, and we do not use it for advertising or profiling.
5. Who we share it with
Only service providers needed to run the product, each handling data on our instructions:
- Payment provider (merchant of record) — subscription billing and tax handling.
- Hosting and CDN — serving the site and storing application data.
- Error monitoring — diagnosing crashes and faults.
- Telegram — only if you enable alerts, and only to deliver those messages.
We may also disclose data where required by law.
6. International transfers
We operate from Vietnam and our providers may process data in other countries. Where data of users in the EEA or UK is transferred abroad, we rely on appropriate safeguards such as the European Commission's standard contractual clauses.
7. How long we keep it
- Account and simulation data — while your account is active, then 90 days after deletion.
- Server and security logs — up to 12 months.
- Billing records — as long as tax and accounting law requires.
8. Cookies and local storage
We use a session cookie to keep you signed in, and browser local storage to remember interface preferences such as your selected chart. We do not use advertising or cross-site tracking cookies. Product analytics, where used, are aggregated and not used to build profiles.
9. Your rights
Depending on where you live, you may have the right to access, correct, delete or export your personal data, to object to or restrict processing, and to withdraw consent. Email support@holygrailbot.com and we will respond within 30 days. You may also delete your account from your settings at any time. If you are in the EEA or UK you can lodge a complaint with your local data protection authority.
10. Security
We use encryption in transit, hashed passwords, access controls and regular backups. No system is perfectly secure, but we will notify affected users and relevant authorities without undue delay if a breach puts your data at risk.
11. Children
The Service is not intended for anyone under 18, and we do not knowingly collect their data. If you believe a minor has registered, contact us and we will remove the account.
12. Changes
We will post updates here and change the date above. Material changes will be announced by email or in-product before taking effect.