Privacy Policy

Reflect is the controller of the personal data described in this Policy. You can contact us through the Contact page. This Policy applies to the Reflect website, applications, APIs and related services. It does not apply to Polymarket, wallets, blockchain networks or other third-party services, which have their own privacy policies.

Account data: email address, display name, password hash, authentication and session data, account status and preferences.

Wallet and blockchain data: wallet addresses you connect, public on-chain activity, transaction hashes, token transfers, balances and confirmations.

Payment and subscription data: USDC amounts, treasury address, transaction status, subscription plan, billing history and referral records. Reflect does not store your private keys or seed phrase in its application database. When you connect a wallet, the seed phrase and relayer credentials are transmitted to the execution service to derive and operate the trading wallet. We do not store full card details.

Usage and device data: IP address, approximate location derived from IP, browser type, device type, operating system, pages viewed, actions taken, timestamps, error logs and security events.

Communications and support data: messages you send through the contact form, support requests, feedback and any attachments.

Marketing data: language and theme preferences, consent and opt-out records, and campaign attribution where permitted.

We do not intentionally collect special category data (such as health, biometric or precise geolocation data). If we are required to conduct identity, KYC or AML checks, we may collect identity documents, date of birth, address and verification results from our compliance providers.

We use personal data to provide, operate and secure the Service; create and manage accounts; verify wallet ownership; process USDC deposits and subscriptions; display analytics and copy-trading features; provide support; personalise language and theme; monitor performance; detect and prevent fraud, abuse, sanctions violations and security incidents; comply with legal, tax, accounting and regulatory obligations; enforce our Terms; and communicate service updates.

We may use aggregated or de-identified data for analytics, product improvement and research. We do not use your data for automated decision-making that produces legal or similarly significant effects without human review, except for automated security and sanctions screening.

Where the GDPR or UK GDPR applies, we rely on: performance of a contract (providing the Service and processing subscriptions); legitimate interests (security, fraud prevention, product improvement, analytics and communicating with you); legal obligation (tax, accounting, sanctions and law enforcement requests); consent (where required, such as certain cookies or marketing); and vital interests where necessary.

You may withdraw consent at any time, without affecting processing that occurred before withdrawal.

We use an httpOnly session cookie for authentication and local storage for your language and theme preferences. We do not use advertising cookies or sell personal data. If we introduce analytics or marketing cookies, we will provide the required notice and consent controls.

Blockchain data, including wallet addresses and USDC transfers, is public, permanent and cannot be deleted or changed by us. We may store transaction hashes, amounts, confirmations and related wallet activity to verify payments and provide the Service. On-chain data may reveal information about you or your wallet activity.

We may share data with service providers that help us operate the Service, including hosting, database, analytics, support, security, email and payment-verification providers; Polymarket and public API providers; Polygon API providers; professional advisers; authorities, courts and regulators where required by law or necessary to protect rights and safety; and actual or prospective acquirers in a merger, financing or asset sale.

We do not sell personal data. We may disclose data to enforce our Terms, prevent fraud or sanctions violations, respond to legal requests, or protect Reflect, our users or the public.

We may process data in countries other than your own. Where required, we use appropriate safeguards such as standard contractual clauses, the UK International Data Transfer Addendum or other lawful transfer mechanisms. You can request more information about these safeguards through the Contact page.

We retain account data for as long as your account is active and for a reasonable period afterwards. We retain payment, tax and accounting records for the period required by law. Security logs are kept for a limited period. Marketing data is kept until you opt out. Blockchain data is retained indefinitely by the public network and may be stored by us for verification and analytics.

When data is no longer needed, we delete it or anonymise it. Some data may be retained where required by law, for fraud prevention, sanctions screening, dispute resolution or to enforce our Terms.

We use technical and organisational measures designed to protect personal data, including encryption in transit, access controls, least-privilege access, logging and monitoring. No method of transmission or storage is completely secure. You are responsible for protecting your credentials, wallet and devices.

If we become aware of a personal data breach that requires notification, we will notify the relevant authorities and affected users as required by law.

Depending on your location, you may have the right to access, correct, delete, restrict or object to processing, receive a portable copy of your data, withdraw consent, and lodge a complaint with a supervisory authority. California residents may have rights to know, access, delete, correct and opt out of sale or sharing; we do not sell personal data.

To exercise your rights, contact us through the Contact page. We may verify your identity and authority before responding. We will not discriminate against you for exercising your rights. Some rights are limited by law, including where we must retain data for compliance or where data is on-chain.

We may send service-related messages and, where permitted, product updates. You can opt out of marketing messages using the unsubscribe link or by contacting us. We may still send essential service, security and legal notices.

The Service is not intended for anyone under 18 or the age of majority in their jurisdiction. We do not knowingly collect personal data from children. If you believe a child has provided data, contact us and we will take appropriate steps.

The Service may link to Polymarket, wallets, explorers, API providers and other third-party services. We are not responsible for their privacy practices. Review their policies before providing personal data or connecting a wallet.

We may update this Policy from time to time. The updated version will be posted on this page with a new “Last updated” date. Where required, we will provide additional notice. Continued use of the Service after the effective date means you acknowledge the updated Policy.

For privacy questions, requests or complaints, contact us through the Contact page. If you are in the EEA or UK, you also have the right to complain to your local data protection authority.