Privacy Notice

Last updated: May 2026

This Privacy Notice explains how AI Copytrade ("we", "us", "our"), operator of the CBYD Protect platform, collects, uses, and shares personal data. AI Copytrade is the data controller for personal data processed through the service.

1. Personal data we collect

• Account data: name, email address, phone number, company, role, password (hashed).
• Service data: dig job details, site coordinates, notifications dispatched, comments and attachments you submit.
• Support and communications: messages you send to us or to other users on the platform.
• Technical data: IP address, device and browser identifiers, pages visited, referrer, session identifiers, and usage telemetry.
• Billing data: when you purchase credits, our payment provider Paddle collects and processes payment details directly. We receive purchase metadata (transaction ID, amount, credits, status) but not full card details.

2. Purposes and legal basis

• Provide the service (account creation, dig-job management, notifications) — performance of a contract.
• Process payments and manage subscriptions — performance of a contract; legal obligation (tax, accounting).
• Security, fraud prevention, and audit logs — legitimate interests in keeping the platform safe and compliant.
• Product improvement and analytics — legitimate interests in understanding and improving the service.
• Customer support — performance of a contract and legitimate interests.
• Service announcements — legitimate interests. Marketing emails are only sent with your consent where required.

3. How we share data

• Merchant of Record: Paddle.com Market Ltd ("Paddle") acts as our reseller and Merchant of Record. Paddle handles payments, subscription management, taxes, invoicing, and refund administration, and processes your billing data as an independent controller. See Paddle's privacy policy at paddle.com.
• Service providers / subprocessors: hosting, database, email/SMS/WhatsApp delivery, analytics, and customer-support tooling, acting on our instructions.
• Other platform users: when you create or comment on dig jobs, the relevant details (project, location, contact, comments) are visible to admins, asset owners with overlapping service areas, and other authorized participants.
• Professional advisers: legal, accounting and audit advisers under confidentiality obligations.
• Authorities: where required by law, regulation, court order, or to protect rights, property, or safety.

4. International transfers

Some of our service providers (including Paddle) may process data outside your country. Where data is transferred from the UK/EEA, we rely on adequacy decisions or Standard Contractual Clauses with appropriate safeguards.

5. Data retention

We keep personal data only as long as needed for the purposes above: account data for the life of your account plus a reasonable archival period; transaction and audit records for the period required by tax, accounting, and regulatory law; technical logs for a short rolling window. When no longer needed, data is deleted or anonymised.

6. Your rights

Depending on your jurisdiction, you may have the right to access, rectify, erase, restrict, port, or object to processing of your personal data, and to withdraw consent where processing is based on consent. UK/EEA users additionally have the right to lodge a complaint with their supervisory authority. We aim to respond to verified requests within one month. To exercise these rights, contact us at the address below.

7. Security

We use appropriate technical and organisational measures — including encryption in transit, hashed passwords, role-based access controls, and audit logging — to protect personal data from unauthorised access, loss, alteration, or disclosure. No system is perfectly secure, and we encourage you to use strong, unique passwords.

8. Cookies

We use essential cookies and similar technologies to keep you signed in and to operate the service. We may also use limited analytics cookies to understand aggregate usage. You can manage cookies through your browser settings. Disabling essential cookies may break sign-in and other core features.

9. Children

The service is intended for business use and is not directed to children under 16.

10. Changes

We may update this notice from time to time. Material changes will be highlighted in the service or by email where appropriate.

11. Contact

AI Copytrade — privacy enquiries: privacy@cbyd.lovable.app.