Privacy notice
Last updated 8 September 2026
What we collect
We process the information needed to operate VolaPilot: account and session state, product preferences, operational events, support requests, feedback, security records and first-party campaign labels. A secure first-party cookie assigns a random visitor identifier so we can count new and returning use without storing the raw identifier in the trading-event ledger. Security controls may temporarily process network identifiers; these identifiers are not used for advertising.
Trading and account data
Deriv handles passwords, signup and OAuth consent. VolaPilot may process the account identifier, account type, currency, balance, open-position count, proposals and contract results needed to provide the workspace. Production sessions use encrypted, secure, HTTP-only cookies. Selecting a Real account makes the trading controls use that account's real funds.
Operational and trading records
VolaPilot records requested, accepted, open, settled, failed and uncertain stages to operate the service and investigate execution problems. Scanner diagnostics record the contract, entry digit, probability estimate and timing used before an order. Read-only checks may compare these with Deriv's contract results and market history. Account, intent and contract identifiers are pseudonymized before storage. These records do not store Deriv tokens or passwords and are not used for automatic, unreviewed model training. Scanner diagnostics follow the same 13-month retention period as operational events.
Data kept on your device
Theme, experience mode, local recovery state, practice preferences and parts of the trading journal may be stored in your browser. Clearing site data removes device-local information and the visitor cookie. Strategy profiles and operational records may be stored in VolaPilot's hosted database.
Why we use it
We use data to provide trading tools, secure accounts, recover interrupted orders, answer support requests, measure reliability, understand product use and improve usability. VolaPilot does not use the operational ledger for behavioural advertising and does not sell personal information.
Support, feedback and communications
Support messages are triaged so security concerns and unresolved Real orders can be handled first. A suggested reply may be prepared automatically, but an owner must approve every external reply. Feedback remains private by default and is published only with consent and a recorded moderation decision. Public feedback is a curated selection, not a representative rating. Telegram channel posts are prepared and checked for unsafe claims before owner approval.
Partner attribution
When you choose to create a new Deriv account through VolaPilot, the signup request may include VolaPilot's public Deriv referral token and campaign labels. These labels let Deriv attribute an eligible signup and related commission to VolaPilot. Existing-account login does not add this signup attribution.
Service providers
Cloudflare and OpenAI Sites provide hosting and security infrastructure. Deriv provides market data, OAuth and contract services. Each provider processes data under its own terms and privacy obligations.
How long we keep information
Access-attempt records are normally kept for 30 days, integration delivery receipts for 90 days, private or rejected feedback and beta-interest records for one year, pseudonymized operational events for 13 months, sent communications for two years, and resolved support cases for three years. Legal acceptance and administrator audit evidence may be kept for six years where needed to establish compliance or resolve a dispute. Browser and Deriv session cookies expire independently and can be removed by signing out or clearing site data. An automated maintenance job applies the shorter periods; legal holds pause deletion only for the affected record.
Your choices
You may request access, correction, deletion, restriction, objection or withdrawal of publication consent through Support or privacy@volapilot.com. Some records may be retained where law, fraud prevention or an unresolved transaction requires it. We may verify that a request relates to you before acting.
International processing
Cloudflare, OpenAI Sites and Deriv may process data outside your country. VolaPilot uses service contracts and technical safeguards appropriate to the information processed.