Privacy Policy

This Privacy Policy (“Policy”) describes how SoftFin Tech SA(“Company”, “we”, “us”, or “our”), a company registered under the laws ofSwitzerland, collects, uses, shares, and protects personal data when you use the Deribook platform, including its website, application, APIs, and all related services (collectively, the “Service”).

SoftFin Tech SA acts as the data controller within the meaning of the EU General Data Protection Regulation (“GDPR”) and the Swiss Federal Act on Data Protection (“FADP” / “nFADP”) for all personal data processed through the Service.

Switzerland has been recognized by the European Commission as providing an adequate level of data protection. We process data in accordance with both the GDPR and the Swiss FADP to ensure the highest standard of privacy for all users, regardless of their location.

We collect only the minimum personal data necessary to provide, improve, and secure the Service. The categories of data we collect are:

We collect personal data through the following means:

• Directly from you — when you create an account, submit API keys, configure dashboard settings, adjust preferences, or contact our support team.
• Automatically — through cookies, server logs, and similar technologies when you access and interact with the Service (subject to your cookie preferences).
• From third-party exchanges — when you authorize us to retrieve trading data via the read-only API keys you provide.
• From authentication providers — when you sign in using a third-party identity provider (e.g., Google), we receive basic profile information from that provider.

Under GDPR Article 6 and the Swiss FADP, we process your personal data on the following legal bases:

We use the personal data we collect for the following purposes:

• Service delivery — Providing portfolio analytics, Greeks calculations, P&L tracking, risk metrics, and customizable dashboards.
• Account management — Creating and managing your user account, processing linked exchange accounts, and maintaining authentication sessions.
• Security — Detecting and preventing unauthorized access, fraud, abuse, and security incidents. Monitoring for suspicious activity and enforcing our Terms of Service.
• Communication — Sending transactional emails (e.g., account verification, password resets, security alerts), and, where you have opted in, product updates and feature announcements.
• Improvement & analytics — Analyzing aggregated and anonymized usage patterns to improve platform performance, identify bugs, and develop new features. Where analytics cookies are used, this is subject to your consent.
• Legal compliance — Fulfilling our obligations under applicable laws, resolving disputes, and enforcing our agreements.

Given the sensitive nature of exchange API keys, we apply the following security measures:

We do not sell, rent, or trade your personal data. We share data only in the limited circumstances described below:

All third-party service providers are bound by contractual obligations to protect your personal data and are permitted to use it only for the specific purposes for which it was shared.

SoftFin Tech SA is based in Switzerland, which the European Commission has recognized as providing an adequate level of data protection (Commission Decision 2000/518/EC as updated). Your data may also be processed by sub-processors located in the United States and other countries.

For transfers to countries without an adequacy decision, we rely on appropriate safeguards including:

• Standard Contractual Clauses (SCCs) approved by the European Commission, as adopted by our sub-processors (Google, Vercel, Sentry).
• Supplementary measures such as encryption of data in transit and at rest, as recommended by the EDPB.
• Data Processing Agreements with all sub-processors, requiring them to protect your data in accordance with GDPR and Swiss FADP standards.

You may request a copy of the safeguards in place by contacting us at privacy@deribook.com.

We retain personal data only for as long as necessary to fulfill the purposes described in this Policy, or as required by law. Our retention periods are as follows:

Under the GDPR and the Swiss FADP, you have the following rights regarding your personal data:

• Right of access (Art. 15 GDPR) — You may request a copy of the personal data we hold about you, together with information on how it is processed.
• Right to rectification (Art. 16 GDPR) — You may request correction of inaccurate or incomplete personal data.
• Right to erasure (Art. 17 GDPR) — You may request deletion of your personal data where there is no compelling reason for its continued processing.
• Right to data portability (Art. 20 GDPR) — You may request your personal data in a structured, commonly-used, machine-readable format.
• Right to restriction (Art. 18 GDPR) — You may request restriction of processing in certain circumstances (e.g., while we verify the accuracy of your data).
• Right to object (Art. 21 GDPR) — You may object to processing based on legitimate interests. We will cease processing unless we demonstrate compelling legitimate grounds.
• Right to withdraw consent — Where processing is based on consent, you may withdraw consent at any time. Withdrawal does not affect the lawfulness of prior processing.

Right to lodge a complaint: If you believe your data protection rights have been violated, you have the right to lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC) at www.edoeb.admin.ch, or with the relevant supervisory authority in your country of residence if you are located in the EU/EEA.

If you are a resident of California, Virginia, Colorado, Connecticut, or another US state with a comprehensive privacy law, you may have additional rights regarding your personal information.

For more details on how we use cookies and how to control them, see our Cookie Policy.

We use cookies and similar technologies to operate, secure, and improve the Service. Non-essential cookies (analytics, marketing, functional) are activated only with your explicit consent.

For full details on the cookies we use, their categories, and how to manage your preferences, please refer to our Cookie Policy. You can update your cookie preferences at any time via the cookie settings available in the page footer or on the Cookie Policy page.

The Service is not directed at individuals under the age of 18. We do not knowingly collect personal data from children. If we become aware that we have inadvertently collected personal data from a person under 18, we will take steps to delete such data promptly. If you believe that we may have collected data from a minor, please contact us at privacy@deribook.com.

We implement appropriate technical and organizational security measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include:

While we strive to protect your personal data, no method of transmission over the Internet or electronic storage is 100% secure. In the event of a personal data breach that is likely to result in a high risk to your rights and freedoms, we will notify you and the competent supervisory authority without undue delay, in accordance with GDPR Article 33 and 34.

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:

• Post the updated Policy on the Service with a revised “last updated” date.
• Notify you via email and/or a prominent notice on the platform at least 30 days before the changes take effect.
• Where changes affect processing based on consent, obtain renewed consent where required by law.

We encourage you to review this Policy periodically. Your continued use of the Service after the updated Policy becomes effective constitutes your acknowledgment of the changes.

For any questions, concerns, or requests regarding this Privacy Policy or the processing of your personal data, please contact us:

Supervisory authority: You may also contact the Swiss Federal Data Protection and Information Commissioner (FDPIC) at www.edoeb.admin.ch, or the data protection authority in your country of residence if you are located in the EU/EEA.