Privacy Policy

The controller of your personal data, meaning the company responsible for it under UK data protection law (the UK GDPR and the Data Protection Act 2018), is Runtil Technologies Ltd. We are registered in England and Wales, company number 17385629, and our registered office is 128 City Road, London EC1V 2NX. We trade as Runtiler.

For anything about your personal data, email support@runtiler.com. The UK regulator for data protection is the Information Commissioner’s Office (ICO).

We collect the following. Most of it comes from you, or from your use of the Service.

• Sign-in details. We use Privy to sign you in: with a one-time code sent to your email, with Google, or with an external wallet through WalletConnect. We receive an account identifier from Privy, and your email address if you sign in with email or Google.
• Wallet details. Your wallet is a non-custodial wallet created and secured by Privy, our wallet provider, not by us. Privy describes how it protects wallet keys in the security section of its documentation at docs.privy.io. We record your wallet’s address, and the address of any external wallet you sign in with.
• Profile. Your handle, and your profile picture, bio and X handle if you add them.
• Trading data. Your simulated trades, orders and positions, your challenge accounts and their history, and your reward claims, with the results of the checks we run on them (Section 4).
• Payments. Records of your purchases, rewards, refunds, creator earnings and withdrawals: amounts, dates, wallet addresses and blockchain transaction references.
• Challenges you publish. If you publish a challenge, its details and the earnings it brings you.
• Messages to support. What you write to us, and our replies.
• Technical data. Your IP address, which we use on each request to find your country (Section 5); a one-way code of it and a random device code, which help us spot one person using several logins (Section 5); your device’s time zone, which we use only to choose the currency for card top-ups; and settings saved in your browser (Section 10).
• Identity check. Before your first reward, a photo of your ID and a short selfie video, checked by our identity provider, Didit. We receive and keep only the result, your document’s country, your year of birth, and a one-way code of your document number, so we can spot the same document on two logins. We don’t keep the images.
• Who invited you. If you signed up through someone's link, we record who. They see, in their Earnings tab, your handle, when you joined, and the challenges you buy and sell, with their prices, because they earn a share of them.
• Partner applications. If you apply to be a Partner: the email you give, the links to where you post, how many people follow you, your note, and when you agreed to this policy.

Error reports. When something goes wrong in the app, our error-monitoring provider records the error and technical details about it, such as your browser and the page you were on. It also makes a recording of your screen in that session, from shortly before the error. The recording hides what you type into fields, such as your email address or a sign-in code. We use error reports only to find and fix problems. We also collect speed measurements from a small share of visits, to see how fast pages load.

We never see your card details: the card provider collects them directly. Apart from the face check in the identity check, we do not collect sensitive personal data, such as information about your health, religion or ethnic origin.

The law requires a legal basis for each use of your personal data. These are our uses, and the basis for each:

• To create your account and sign you in. Basis: contract, because we need this to provide the Service you signed up for.
• To run your challenges: recording your simulated trades, showing your account history and working out your results. Basis: contract.
• To make payments: purchases, rewards, refunds, creator earnings and withdrawals. Basis: contract.
• To check reward claims for copy trading, hedge trading and trades on out-of-date prices (Section 4). Basis: legitimate interests, namely keeping challenges fair and preventing fraud.
• To block countries we cannot serve, and to screen withdrawal addresses against a sanctions list (Section 5). Basis: legal obligation, because sanctions law requires it, and legitimate interests, namely making sure we do not deal with sanctioned people or places.
• To show your public profile, with your rewards, your certificates and the challenges you publish (Section 6). Basis: contract, because a public profile is part of the Service.
• To choose the currency for card top-ups from your device’s time zone. Basis: legitimate interests, namely showing you a sensible currency.
• To find and fix errors and keep the Service working (Section 2). Basis: legitimate interests, namely a working and secure Service.
• To answer your messages to support. Basis: contract, or legitimate interests where your message is not about your account.
• To keep records for tax and accounting, and to deal with disputes and legal claims. Basis: legal obligation, and legitimate interests, namely protecting our legal rights.
• To close out our former referral program. We keep records from the referral program that ran until October 2026 until they are settled, and then delete them. Basis: contract and legal obligation.
• To pay affiliate earnings to whoever invited you, and to show them the purchases and sales they earn from. Basis: contract, because these earnings are part of the Service.
• To review a Partner application and contact you about it. Basis: consent. You can withdraw it at any time by asking us to delete your application; we then delete it.
• To check your identity before your first reward, and to stop one person using several logins. The face check uses biometric data. Basis: your explicit consent, which you give when you start the check. You can say no, but we can’t pay a reward without it.

Where we rely on legitimate interests, we have weighed our interests against your rights, and you can object (Section 11). We do not rely on your consent for any of these uses. If we ever ask for your consent, you can withdraw it at any time.

We do not sell your data. We do not use it for advertising or to build marketing profiles, and we do not send marketing email.

Every reward claim is checked before it is paid. The checks look at:

• Copy and hedge trading. We compare the profit and loss of the account making the claim with that of other accounts, including other users’ accounts, to find accounts that copy each other or trade against each other.
• Out-of-date prices. We check how old the price was when each trade opened, to find trades that took advantage of a stale price.
• Linked logins. The same face, ID document, device or wallet address on more than one login, or the same IP address.
• How much has been paid to a person compared with what they paid us.
• Every first reward is reviewed by a person.

Basis: legitimate interests, namely keeping challenges fair and preventing fraud. This means your accounts can also be part of the checks on other people’s claims.

We keep the result of each check, and the evidence behind it, with the record of the payment. The evidence can include the other accounts’ numbers.

A check never rejects a claim on its own. If a check flags a claim, the claim is held, and a person reviews it and decides. We make no decisions about you by automated means alone that have a legal or similarly significant effect on you. If your claim is held, you can ask us why, and give us your side.

We never tell other users who they were matched with. If your account is matched with someone else’s, we will not tell you who they are, and we will not tell them who you are.

We cannot serve people in Cuba, Iran, North Korea, Syria, Russia or Belarus. To enforce this, we use your IP address to find your country. This happens on our own server, using an IP-to-country database built into our software. No outside service is involved.

If you are in one of these countries, we refuse sign-up, purchases, claims and withdrawals.

We check your IP address and country on each request. To protect accounts and stop one person using several logins, we also keep a one-way code of your IP address and a random device code saved in your browser, with when we saw them. The code can’t be turned back into your IP address. We do not otherwise fingerprint your device, and we do not try to detect VPNs.

Before we send a withdrawal, we check the destination wallet address against a public sanctions list kept on the blockchain, which we read through our blockchain data provider. Only the address is checked. We will not send a withdrawal to an address on that list.

Basis: legal obligation, because sanctions law requires it, and legitimate interests, namely making sure we do not deal with sanctioned people or places. These checks are automatic. If you think a check got your country wrong, contact us.

Your profile is public: anyone can see it. It shows your handle, your profile picture, bio and X handle if you add them, when you joined, who follows you and whom you follow, your rewards, your certificates and the challenges you publish. There is no private profile. Your wallet address, your deposits and your withdrawals are never shown on it: only you see them.

Payments happen on the Polygon blockchain, which is public. Wallet addresses, and every payment between your wallet and Runtiler’s vault (purchases, rewards, refunds, creator earnings and withdrawals), can be seen by anyone, permanently. Runtiler does not show your wallet address, but anyone who learns it can look these payments up. No one, including us, can change or delete blockchain records.

Your simulated trades are not on the blockchain.

We use other companies to help run the Service. They act on our instructions, under contracts that require them to protect your data and to use it only for us. They provide:

• sign-in and wallets;
• card top-ups;
• blockchain data, and sending transactions to the blockchain;
• routing withdrawals to other blockchains;
• hosting and our database, in the EU (Frankfurt, Germany);
• file storage, and DNS (the service that points our domain name to our servers);
• error monitoring; and
• identity checks.

Card top-ups work differently. The card provider acts on its own account, as a separate controller, and runs its own checks, such as identity checks. Its own privacy policy covers what it collects. We never see your card details.

A list of the companies we use is available on request from support@runtiler.com.

We may also share data when the law requires it (for example, with the police, HM Revenue & Customs or a court), when we need to protect our legal rights or someone’s safety, or with a buyer if our business is sold. A buyer would have to keep to this Policy.

We protect your data with appropriate technical and organisational measures. No system is perfectly secure, so please keep your sign-in method and your devices safe.

Our hosting and database are in the European Union, in Frankfurt, Germany. UK law recognises the EU as giving adequate protection to personal data, so no extra safeguards are needed for this.

Some of the services we use are based in the United States, so your data may be sent there. When it is, we rely on the UK–US data bridge (the UK’s adequacy regulations for US companies certified under it) where the company has signed up to it. Otherwise we rely on the UK International Data Transfer Agreement or the UK Addendum to the EU standard contractual clauses, which are safeguards approved under UK law.

You can ask us for more detail, or a copy of the safeguards we rely on, at support@runtiler.com.

We keep personal data only as long as we need it:

• Account, trading, claim and payment records, including claim check results: 6 years after your account or profile closes. This matches the UK time limit for most legal claims, and covers tax rules and disputes.
• Your IP address and country: not stored. The one-way code of your IP address and your device code: 12 months after we last saw them.
• Error reports and screen recordings: a limited period set by our error-monitoring provider, typically up to 90 days.
• Support messages: as long as we need them to deal with your request, and after that no longer than the 6-year period above.
• Records from the former referral program: until they are settled, and then deleted.
• Blockchain records: permanent, and outside our control.
• Identity check result and document code: 6 years, with claim records. Our identity provider deletes its copy, the images and data, after 90 days.

When a period ends, we delete the data or make it anonymous.

We use only these cookies and this browser storage:

• your sign-in session, so you stay signed in;
• settings saved in your browser, so the Service remembers your choices;
• a device code, a random code that helps us spot one person using several logins (Section 5); and
• a referral cookie, set when you open an old referral link, so the person who shared it is credited if you sign up. It lasts up to 90 days, and it goes away when our former referral program closes. You can delete it.

We do not use analytics, advertising or tracking cookies, so we do not show a cookie banner.

You can clear cookies and storage in your browser settings at any time. If you do, you will be signed out.

Under UK data protection law, you have the right to:

• access your personal data and get a copy of it;
• correct data that is wrong or incomplete;
• delete your data. There is no delete option in the app, so email us and we will do it. We will keep what the law, tax rules or possible disputes require, for the 6 years in Section 9, and no one can delete blockchain records;
• restrict how we use your data, for example while we look into a complaint about its accuracy;
• object to any use based on legitimate interests (Section 3). We will stop unless we have compelling grounds to continue, or need the data for legal claims;
• move the data you gave us to another service, in a common machine-readable format; and
• complain to the ICO (Section 14).

To use any of these rights, email support@runtiler.com. We will reply within one month. If a request is complex, or you send several, we may need up to two more months, and we will tell you if so. There is normally no charge.

We first need to confirm the request comes from you. We do this through your sign-in, for example by asking you to write from the email address on your account, or by asking you to show you control your wallet, for example by signing a message with it.

If a claim of yours is held, you can also ask us why, and ask us to look at the decision again (Section 4).

The Service is only for people aged 18 or over. We do not knowingly collect data from anyone under 18. If we learn that someone under 18 has an account, we will close it and delete their data, except what the law requires us to keep. If you think a child has given us data, please tell us.

We may update this Policy. When we do, we will change the “Last updated” date at the top. If a change is important, we will tell you in the Service, or by email if we have your address, before it takes effect.

Questions or requests about your personal data: support@runtiler.com. You can also write to Runtil Technologies Ltd, 128 City Road, London EC1V 2NX.

If you are unhappy with how we handle your data, you can complain to the Information Commissioner’s Office (ICO) at ico.org.uk or on 0303 123 1113. We would like the chance to put things right first, but you can go to the ICO at any time.

If you live outside the UK, you may also be able to complain to the data protection authority in your own country.