Privacy Policy.
Version 2026-09-15. How Haider Shah ("the Operator") handles personal data on Haider Shah Terminal at bot.iamhaidershah.com ("the Platform"). Accepting the Terms & Conditions includes accepting this policy.
Privacy Policy
1. Who is responsible
The Operator is the controller of the personal data described here. Contact: digiomix@gmail.com.
2. What we collect and why
| Data | Why |
|---|---|
| Name, email address, password (stored only as a one-way hash) | To create and secure your account, verify your email, and contact you about your account. |
| Network (IP) address at registration, at login and at consent; login times | Security, abuse prevention, and to record that and when you accepted the Terms and this Policy. |
| Your consent record (version, time, IP) | To evidence your acceptance of the Terms and this Policy. |
| Approval status, entitlements, subscription/trial dates, payments you made to the Operator, and any note the Operator records about your account | To decide and administer what your account may access. |
| Symbols you subscribe to; AI provider, model and limit choices you make | To run the features you configured, for you only. |
| API keys you enter (AI providers) and notification credentials (Discord webhook, Telegram bot token, chat id) | Stored encrypted at rest under the Platform's own key. Used only to make the calls and send the notifications you configured. Never shown back to you or anyone else after saving; only a one-way fingerprint is displayed. |
| Your simulated ("paper") trading records: positions, orders, results, alerts, and the AI assessments produced for your account, including what your own AI calls cost | To operate your account, show you its history, enforce the limits you set, and keep an auditable record. |
| Technical logs (requests, errors, timings) | To keep the Platform working and secure. |
We do not collect payment-card details on the Platform; payments to the Operator are arranged and recorded off-platform. We do not use advertising trackers.
3. Legal basis
We process this data to perform our agreement with you (the Terms), to comply with legal obligations, and for our legitimate interests in security and in evidencing consent. Where consent is the basis (for example, connecting a notification channel), you may withdraw it by removing the connection.
4. Who receives data
- AI model providers you chose (for example Google, Anthropic, OpenAI): to produce assessments for your account, the Platform sends them market data and analysis text together with the API key you provided. Their handling of that traffic is governed by their own terms and privacy policies. No personal data about you other than your key is sent.
- Messaging platforms you connected (Discord, Telegram): receive the alert text you asked for, through the credentials you provided.
- Infrastructure providers that host the Platform and route its traffic. Some traffic may be routed through servers in other countries to reach a provider's service.
- Authorities, where the law requires it.
We do not sell personal data and we do not share it with other users. Your trading records, keys and channels are visible only to you and to the Operator for the purpose of operating the Platform.
5. Retention
Account data is kept while your account exists. Trading, decision and consent records are kept as an auditable history for as long as the Platform is operated, or as long as the law requires, whichever is longer; they may be retained after account closure in anonymised or archived form. Encrypted API keys and notification credentials are deleted when you remove them or when your account is deleted. Logs are rotated on a rolling basis.
6. Security
Secrets are encrypted at rest; passwords are hashed; transport is encrypted (HTTPS); access is restricted to the Operator. No system is perfectly secure, and the Operator does not guarantee that data will never be accessed unlawfully — see the Terms on liability. Keep your login and your API keys safe and rotate them if you suspect exposure.
7. Your rights
Depending on where you live, you may have rights to access, correct, delete, or receive a copy of your personal data, to restrict or object to processing, and to complain to a supervisory authority. To exercise them, email digiomix@gmail.com from your registered address. You can remove connected API keys and notification channels yourself at any time from your configuration page.
8. Cookies
The Platform uses strictly necessary cookies only: a session cookie to keep you signed in, a CSRF token to protect forms, and a local browser preference for the display theme. No analytics or advertising cookies are set.
9. Children
The Platform is not for anyone under 18. We do not knowingly collect data from children; if you believe a child has registered, contact us and the account will be removed.
10. Changes
Material changes to this Policy are issued as a new version together with the Terms, and you will be asked to accept the new version before continuing to use your account.