Bu metnin Türkçe sürümü hazırlanıyor; geçerli sürüm İngilizcedir.

Privacy Policy

Effective date: [EFFECTIVE DATE — TO FILL]

This policy explains what personal data Mos Terminal collects, why, how long we keep it and what rights you have. It applies to the website mosterminal.com, the terminal at app.mosterminal.com and the desktop application (the "Service").

The controller of your personal data is [LEGAL ENTITY NAME — TO FILL], [REGISTERED ADDRESS — TO FILL] ("Mos", "we", "us"). Contact: [email protected].

We collect as little as we can. We do not sell your data, we do not show ads and we do not use advertising or analytics trackers.

1. Data we collect

Website visitors

• Technical data: IP address, browser and request information that our hosting and network providers process to deliver and protect the website.
• Preferences on your device: your language, theme and animation choices are stored in your browser's local storage. They never leave your device.

Waitlist and contact form

• Monthly trading volume range, email address, Telegram username and site language.
• We do not store your IP address or browser details with your application.

Terminal users

• Account data: an internal user ID, a hashed access token, your authenticator (TOTP) secret, active browser sessions and recent sign-in records (including IP address), and invitation status.
• Exchange connection: the exchange API keys you add (encrypted) and their permission status.
• Trading data read from your exchange account: positions, open orders, fills, balances, commissions and funding, used to show your terminal and run your protection rules. We keep a history of your closed positions for 30 days and monthly commission / volume totals for up to 13 months.
• Settings: risk limits (hard stop, order sizes), layouts and other preferences.
• Telegram (only if you connect it): your Telegram session (encrypted) and the list of chats you assign to terminal panels, so the terminal can show messages from those chats. Messages from other chats are discarded without being read, and message content is never stored on disk or logged.
• MOS AI: when you ask a question, we keep only usage counters (number of questions, cost). We do not store the text of your questions or answers; a short conversation is kept in memory for your current session only.
• Security logs: server logs with your user ID, masked IP address and the actions you take (for example sign-in, order placed, account added).

2. Why we use your data (purposes and legal bases)

3. Who we share data with

We share data only with service providers that help us run the Service, under contracts that require them to protect it, and with services you ask us to connect:

• Cloud hosting and key management: Amazon Web Services (servers in Tokyo, Japan; encryption keys in AWS KMS).
• Network, DNS and website hosting: Cloudflare.
• Email: our business email provider and Amazon SES (for notifications).
• AI service provider: when you ask MOS AI a question, the question and the data needed to answer it — market data and, where relevant, your positions, open orders or balance — are sent to a third-party AI model provider to generate the answer.
• Payment processor (when paid plans start): processes your payments; we do not receive or store your full card number.
• Your exchange (at your direction): we send your orders and read your account data using your API key.
• Telegram (at your direction, if you connect it).
• Authorities, if required by law or to protect rights and safety.

4. International transfers

Our servers are in Japan and some providers are based in other countries, including the United States. Where the law requires it, we rely on appropriate safeguards such as standard contractual clauses.

5. How long we keep data

When your account is deleted, your user data directory is erased. Backups taken during maintenance are deleted once the maintenance is verified.

6. How we protect data

• API keys, Telegram sessions and account records are encrypted with keys held in AWS KMS.
• Sign-in requires an authenticator app; terminal access is restricted to approved IP addresses.
• Exchange keys must have withdrawals and transfers disabled and must be restricted to our server's IP address, so a leaked key cannot be used to move your funds.
• Access to production systems is limited and logged.

No system is perfectly secure. If a breach affects your data, we will notify you and the authorities as required by law.

7. Your rights

Depending on where you live (for example under the EU/UK GDPR or Turkey's KVKK), you may have the right to access, correct, delete or export your data, to object to or restrict certain processing, and to withdraw consent. To exercise these rights, email [email protected]. You also have the right to complain to your data protection authority.

8. Cookies and local storage

• Session cookie (terminal only): a strictly necessary, secure, HttpOnly cookie that keeps you signed in for up to 30 days.
• Local storage (website and terminal): your preferences (language, theme, animations, layout helpers). Stays on your device.

We do not use advertising or analytics cookies, so no cookie banner is needed for them.

9. Children

The Service is not intended for anyone under 18. We do not knowingly collect data from children.

10. Changes

We will post any update here with a new effective date and, for material changes, notify you in the Service or by email.

11. Contact

[LEGAL ENTITY NAME — TO FILL] · [REGISTERED ADDRESS — TO FILL] · [email protected]