1. Operator & Controller Notice

Pending formal corporate entity incorporation, Exur and the Exur platform are owned, operated, and maintained by Hamid Reza Hassani Yaqouti as an independent tech initiative. For GDPR and data protection compliance purposes, the operator functions as the Data Controller.

2. Information We Collect

We adhere to strict data minimization principles, collecting only the information required to deliver, optimize, and secure our market intelligence services:

• Authentication & Profile Data (via Google OAuth): Google user ID, name, email address, and profile picture URL associated with your Google account.
• Technical & Network Metadata: IP Address and approximate geographic location derived from IP (used for regional service optimization and security). Device type (Desktop vs. Mobile), browser version, and operating system (used to optimize user interface responsiveness).
• Referral Tracking Data: Referral code associations captured upon sign-up to manage campaign attributions.
• Pro Plan Notification Endpoints: Contact endpoints (such as email address, Telegram handle/chat ID, or custom Webhook URLs) voluntarily submitted by Pro Plan users for alert routing.

3. Legal Basis for Processing (GDPR Compliance)

If you reside in the European Economic Area (EEA), the United Kingdom, or applicable jurisdictions, we process your personal data under the following legal grounds:

1. Performance of a Contract: Providing access to the Exur dashboard, quantitative signal analytics, historical market databases, and real-time alerts.
2. Legitimate Interests: Securing our platform, optimizing device-specific user interfaces, preventing fraudulent API abuse, and analyzing aggregate usage patterns.
3. Consent: Routing automated notifications via user-configured channels (Email, Telegram, Webhooks).

4. Third-Party Service Providers & Data Processors

We utilize trusted third-party infrastructure providers and analytics services to operate Exur:

• Cloud Infrastructure & Security: Cloudflare, Google Cloud Platform (GCP).
• AI Processing Engines: OpenAI, Google Gemini, DeepSeek (used strictly for contextual market news summarization and algorithmic analytics; no personal user data is submitted to AI models).
• Market Data & External Protocols: CryptoCompare News API, Hyperliquid, X (Twitter API).

We do not sell, rent, or trade your personal data to third parties under any circumstances.

5. Data Retention, Synchronization & Deletion

• Image & Profile Syncing: Profile image URLs are referenced from Google. If you update or delete your profile image on Google, the reference on Exur updates or clears automatically.
• Data Erasure Rights: You may request complete erasure of your stored profile and session data at any time by contacting our privacy team.

6. Your Data Protection Rights (GDPR / CCPA)

Depending on your geographic location, you possess the following rights regarding your personal data:

• Right to Access: Request a copy of the personal data stored about you.
• Right to Rectification: Correct incomplete or inaccurate data.
• Right to Erasure (“Right to be Forgotten”): Request the complete deletion of your records.
• Right to Restrict or Object: Limit or object to specific processing activities.
• Right to Data Portability: Obtain your data in a structured, machine-readable format.

7. Cookies and Local Storage

We use essential session tokens and local browser storage strictly necessary for authentication state persistence and UI preference retention (such as dark mode settings or selected trading pairs). We do not deploy invasive third-party tracking cookies.

8. Data Protection Contact

For any questions regarding this Privacy Policy, or to exercise your GDPR data protection rights, please contact us at:

• Email: privacy@irislab.info
• General Legal: legal@irislab.info
• Version Control Repository: github.com/irislab-net/iris-legal-docs