Privacy Policy

Who is responsible

Tribulnation Labs, S.L. is the controller responsible for personal information processed through Terminal. Our registered address is PZ PAU VILA 1, PALAU DE MAR, PIER 01, OFICINA 2B, 08039 BARCELONA, Spain. Contact marcel@tribulnation.com with privacy questions or requests.

Information we process

Account and authentication information includes your email address, user identifier and information supplied by a sign-in provider you choose. Wallet sign-in also uses your wallet address and proof that you control it.

Connected-account information includes account labels, platform identifiers, API credentials and wallet addresses. We retrieve portfolio information from connected providers and public blockchain sources, including balances, positions, valuations and snapshot history.

We also process your preferences, technical and operational information used to deliver and secure the service, and information you send us in support requests or reports, including attachments. Technical information can include IP addresses, request timestamps, errors and API usage.

Authentication information is necessary to provide an account. Connecting an exchange account or wallet for portfolio tracking is optional, but we need the relevant connection details to provide its features.

Why we use information

We use account and connected portfolio information to provide the service you request, relying on performance of our contract with you where processing is necessary for that purpose.

We process necessary operational and security information for our legitimate interests in maintaining reliability, investigating faults, answering support requests and preventing abuse, subject to your rights and interests. We may also process information to comply with applicable legal obligations.

Where an optional activity requires consent, we request it separately and explain how to withdraw it. We do not treat acceptance of our terms as consent to unrelated processing.

API credentials and security

We use the API credentials you provide to retrieve account and portfolio information. Secret credential fields are encrypted in storage and decrypted by authorised backend services when needed to communicate with your provider. Non-secret identifiers, including wallet addresses and some API identifiers, are not encrypted in the same way.

We use access controls and other safeguards appropriate to the information we process. No system can guarantee absolute security. Only provide read-only credentials with trading and withdrawal permissions disabled. Never provide wallet private keys or recovery phrases.

Providers and disclosures

We use infrastructure providers to operate Terminal, including Supabase for database and authentication services, Microsoft Azure for backend processing, and Cloudflare for application delivery and storage. Service providers process information needed to perform their functions, under applicable contractual and data-protection obligations.

When you choose an external sign-in provider, that provider processes information needed to authenticate you. When you connect an account, we send the credentials or identifiers necessary to retrieve your information to its provider. Blockchain data providers may receive wallet addresses used in queries. These providers may also process information under their own privacy notices.

We may disclose information where legally required or necessary to establish, exercise or defend legal claims.

Hosting and international processing

Our primary database is currently hosted by Supabase in Ireland. Our providers and processing locations may change over time.

Personal information may be processed within or outside the European Economic Area. Where processing involves a transfer outside the EEA, we comply with applicable data-protection requirements, using an applicable adequacy decision or appropriate safeguards, such as the European Commission’s Standard Contractual Clauses, together with additional measures where required. Contact marcel@tribulnation.com for information about the safeguards applicable to your data.

We keep this policy updated to reflect our processing practices and notify you appropriately of material changes.

Retention

We retain account information and portfolio history for as long as needed to provide your account and portfolio-tracking features. Connected API credentials are retained while needed to retrieve information from your connected accounts. You can request account closure, removal of a connection or deletion of stored information by emailing marcel@tribulnation.com.

Our Supabase Pro service keeps daily database backups for seven days and API and database service logs for seven days. After information is deleted from the active database, copies may remain in those daily backups until they expire. These periods apply to Supabase’s managed backups and service logs, rather than to records stored in the database itself.

Other operational records, including workflow history and authentication audit records stored in the database, are retained only for as long as needed to investigate faults, maintain security and resolve incidents. Support correspondence is retained while needed to resolve your request and any related follow-up or dispute. We assess retention according to the purpose of each record, whether an issue remains open and any applicable legal requirements.

We restrict access to recovery copies and take account of completed deletion requests when restoring data. A request to delete your information covers the personal information we control, including copies held outside the primary database, subject to applicable legal exceptions.

Where a legal obligation or the establishment, exercise or defence of legal claims requires longer retention, we retain only the necessary information for that purpose and restrict its use. Specific security evidence may be retained for an ongoing investigation where necessary.

Account closure and deletion

You can request account closure and deletion of your personal information by emailing marcel@tribulnation.com. We may need to verify your identity before acting on your request. We act without undue delay and normally respond within one month. If an extension is permitted by law, we explain it within that period. Where we cannot fulfil a request, we explain the reason and your options to challenge our response.

Removing a connection or revoking its credentials does not itself remove previously collected portfolio history. You can request deletion of that history separately. We cannot delete records from public blockchains or another provider’s systems.

Cookies and browser storage

Terminal uses authentication cookies to maintain your session and cookies to remember language, currency, funding-period and appearance preferences. Preference cookies are set for up to one year. Authentication-cookie lifetimes are managed by our authentication service and may be renewed during use.

Browser local storage remembers choices such as page layouts, navigation and portfolio display settings until you reset them or clear browser storage. You can manage cookies and local storage through your browser; clearing them may sign you out or reset preferences. Where optional storage or tracking requires consent, we request it before use.

Your rights

Where applicable, you can request access, correction, deletion, restriction or portability of your personal information, and object to processing based on legitimate interests. You can withdraw consent without affecting earlier lawful processing.

Contact marcel@tribulnation.com to exercise these rights. You may complain to the Spanish Data Protection Agency (AEPD), at www.aepd.es, or another competent data protection authority, including the authority where you live or work.

Children and changes

Terminal is intended for adults aged 18 or over. If you believe a child has provided personal information, contact us so we can investigate and take appropriate action.

We update this policy as our practices change, display the revision date and notify you appropriately of material changes.