Privacy Policy

Version 1.0 · effective 9 November 2026

1. Who is responsible

The controller of your personal data is MillionAlgo, which operates MillionAlgo and MillionChart.
Contact for privacy questions and requests: [email protected] (or the Rights Request form on this site). General: [email protected].
No Data Protection Officer is appointed.

2. Scope

This policy covers millionalgo.com, the member portal, the MillionChart platform and our community services (including our Telegram bot and group). It does not cover other sites we link to.

3. What we collect, why, and on what basis

Where	Data	Purpose	Legal basis
Visiting millionalgo.com	IP address, browser, pages, time (server logs); a referral code kept in your browser if you arrive through a referral link; cookie-free visit statistics from our network provider (Cloudflare Web Analytics); no advertising or cross-site tracking	run and secure the site	legitimate interest (security, operation)
Contact form	name (optional), email, topic, message	answer you	legitimate interest / steps you asked for
Rights-request form	name, email, request type, details	handle your request, prove we did	legal obligation / legitimate interest
Form protection (Turnstile)	IP, browser signals, pass/fail	stop spam and abuse	legitimate interest (security)
Account	email, name, password (stored as a hash), phone and country if you give them, profile picture, language, passkeys, consent records (document, version, time, IP, browser)	create and run your account, prove consent	contract; legal obligation; consent where required
Security and devices	login time, IP, browser, device label, city/country	protect accounts, show you your devices	legitimate interest
Usage (first party)	page path, referrer, device type, country, hashed IP, visitor key, time on page	understand and improve the service	legitimate interest
Identity checks (KYC) for payouts/wallet	ID document and selfie images, document details, country, review result	prevent fraud, meet payout checks	legal obligation / legitimate interest; consent where required
Wallet, payouts, referral	wallet/crypto addresses, amounts, transaction and referral records, who invited whom, commissions	run the wallet and rewards, keep records	contract; legal obligation (accounting)
Chart work	layouts, watchlists, alerts, journal entries, scripts you write, replay/practice data	give you the features	contract
Failed-import report (optional)	the script text and error you choose to send (encrypted), a hashed id instead of your user id	fix converters	consent (shown with a checkbox; you can turn it off)
Community and support	posts, comments, tickets, support chats, notes	provide support and community	contract; legitimate interest
Telegram	Telegram id and username, messages to our bot, join/leave events, moderation log	run the community and bot	legitimate interest; consent when you start the bot
Notifications	email address, web-push endpoint per device	send what you ask for	contract / consent
Your own contacts	people you add to your own contact list (name, email, phone, notes)	your own use	you are responsible for having a lawful reason; we store it for you

We do not collect more than we need. Do not send us passwords, keys or other people's sensitive data.

4. AI features and automated processing

• Some features use AI providers (today mainly Google's Gemini API): support and community assistants (member messages), the Analyst features (chart context you choose), and the vision check of identity images. Text or images are sent to the provider only to produce the result and are not used by us to build advertising profiles.
• Pictures you post in our public Telegram community group may be sent to an AI provider (Google Gemini) so that our assistant can decide whether to react or reply briefly. We do not keep the picture: we keep only a short-lived fingerprint (hash) for a few hours to avoid repeats, and per-member counters for daily limits. Nothing from private chats is sent, and no decision with legal or similar effect is made this way.
• AI output is information, not advice, and may be wrong.
• Decisions with legal or similar effect about you (for example refusing a payout) are made or confirmed by a person, not only by AI.

5. Who receives your data (processors and recipients)

Recipient	What for	Where
Zoho ZeptoMail	sending email (codes, notices, replies)	EU
Cloudflare	CDN and DNS protection, Turnstile anti-spam check, forwarding of mail sent to our contact addresses (Email Routing)	global network
Hetzner Online GmbH (hosting)	runs our servers and local backups	Germany (Nuremberg)
Google (Drive, Gmail)	encrypted copies of our backups; the team mailbox that receives messages sent to our contact addresses (support@, privacy@)	provider's regions
Payment/payout partner (for example Ziina)	payments where offered	—
AI providers (section 4), including Google Gemini	generate AI output, read identity images, look at pictures posted in our public Telegram group	—
Telegram	the community and bot; also receives backup copies of our databases (below)	outside the EU
Web-push services of your browser vendor	notifications you enable	global
Market data providers	we send them symbol requests, not member data	n/a
Professional advisers, authorities	when the law requires or to defend legal claims	as needed
A buyer, if the service is transferred	with the same protections	as needed
Backup copies. To be able to restore the service after a failure, we make regular backups of our databases, which contain the account, wallet and identity-check records described above (not the identity images themselves unless stated otherwise). Backup copies are stored on encrypted storage and a local encrypted copy. In addition, a copy of the database backup file is sent through a Telegram bot to a private Telegram chat that only we can access. That Telegram copy is not separately encrypted by us; it is protected by Telegram's own account security and transport encryption. Purpose: disaster recovery only. Retention of the Telegram copies: kept until we delete them by hand (there is no automatic deletion yet). We may change this arrangement (for example by encrypting the copy or stopping it) and will update this page.
We do not give your data to advertisers. Contractors working for us act on our instructions.

6. International transfers

Some providers (for example Cloudflare, AI providers, Telegram, including the backup copies sent to Telegram) process data outside your country. Where required we rely on the provider's transfer terms.

7. Security

Passwords are hashed; sensitive fields (for example failed-import text) are encrypted at rest; access to member data is limited by role; identity images are visible only to reviewers. No system is perfectly secure; tell us at [email protected] if you see a problem.

8. We do not sell your data

We do not sell your personal data and do not share it for cross-context advertising. If this ever changes, this page is updated first.

9. How long we keep it

Data	Kept
Contact messages	up to 12 months; the record in our database is deleted automatically. Copies in our support mailbox and in backups follow their own retention (backups: see below)
Rights-request records	up to 24 months; the record in our database is deleted automatically. Copies in our privacy mailbox and in backups follow their own retention (backups: see below)
Form abuse log (IP, time, pass/fail)	30 days
Failed-import reports	source and error: 30 days after fixed/closed, otherwise 90 days; hit counters 2 days
Server logs (web access and application)	14 days to about 6 weeks, depending on the system
Account data	while the account is open, then deleted within 30 days unless a law requires keeping
Login, consent and security records (including the IP address)	while the account exists, for security and audit; then deleted with the account unless a law requires keeping them
KYC images and results	12 months after the review decision, then deleted
Wallet, payout and payment records	as long as accounting and tax law require, then deleted
Consent records	as long as needed to prove consent
Support chats and tickets	24 months
Telegram bot chats	12 months
Pictures posted in our public Telegram group (AI check)	the picture itself is not kept; its fingerprint (hash) a few hours; per-member counters one day
Backups (encrypted storage and local copy)	local copies are kept up to 21 days; the encrypted Google Drive copies keep only the newest few
Backup copies sent to Telegram	kept until we delete them by hand (there is no automatic deletion yet); deleted copies may remain in Telegram's systems for a time we do not control

10. Your rights

Depending on where you live you may: ask what we hold and get a copy; correct data; ask us to delete it; object to or restrict processing; receive your data in a portable format; withdraw consent at any time (without affecting earlier processing); and not be subject to solely automated decisions with legal effect.
How: use the Rights Request form or write to [email protected] from the email on your account. We may ask you to confirm your identity by replying from that address; we do not ask for ID copies unless we cannot match the account. We answer within 30 days (one month where the law says so) and tell you if we need longer. Some records (for example accounting records) cannot be deleted while a law requires us to keep them; we tell you which.
Account closure and erasure are handled by us after your request; there is no self-service deletion yet.

11. Complaints

You may complain to the data-protection authority in your country. We would appreciate the chance to fix the problem first: [email protected].

12. Children

Our services are not for people under 18. If we learn we hold a child's data we delete it.

13. Cookies

See the Cookies Policy. The marketing site sets no cookies of its own; it keeps a referral code in your browser when you arrive through a referral link and loads a security check on forms.

14. Changes

Each version is dated. For material changes we notify you by email or in the portal before they apply. Last updated: 9 November 2026.