Privacy Policy

Last updated: 29 March 2026

This Privacy Policy describes how BetFlowBot (“we”, “our”, “Platform”) collects, uses, stores and protects personal data of users (“you”), in line with Brazil’s General Data Protection Law (LGPD — Law 13.709/2018) and other applicable law.

1. Data controller

2. Data we collect

Data Source Purpose Legal basis (LGPD)
Name and email Google OAuth Identification and communication Contract performance (Art. 7, V)
Profile photo Google OAuth Display in the dashboard Consent (Art. 7, I)
Google ID Google OAuth Single sign-on Contract performance (Art. 7, V)
IP address Site access Security and fraud prevention Legitimate interest (Art. 7, IX)
Bot settings Use of the platform Running the service Contract performance (Art. 7, V)
Trade history Use of the platform Trade journal and analytics Contract performance (Art. 7, V)
Wallet signing key User configuration Signing Polymarket orders on your behalf Contract performance (Art. 7, V)

We do not collect card numbers, bank details or subscription billing data. The Service has no paid plan.

3. Data we do not collect

  • Passwords (login is Google OAuth)
  • Precise location (GPS)
  • Device data beyond what is needed for security

4. How we protect your data

  • Signing keys: Encrypted with Fernet (AES-128-CBC + HMAC-SHA256) in the database. Never exposed via API, logs or UI.
  • Transport: HTTPS/TLS.
  • Authentication: Server-side Google OAuth session; rate-limiting on login.
  • Database: PostgreSQL with restricted access and encrypted backups.
  • Infrastructure: Dedicated VPS with firewall and SSH key access.

5. Data sharing

Personal data is shared only with:

Third party Data shared Purpose
Google (OAuth) Authentication flow User login
Polymarket (API) Wallet address and orders Executing trades

We never sell, rent or share your personal data for marketing, advertising or any purpose not described above.

6. Your rights (LGPD — Art. 18)

  • Confirmation and access: Know whether we process your data and get a copy
  • Correction: Fix incomplete, inaccurate or outdated data
  • Anonymization or deletion: Request anonymization, blocking or deletion of unnecessary data
  • Portability: Receive your data in a structured format
  • Erasure: Request deletion of data processed on the basis of consent
  • Information: Know who we share your data with
  • Withdrawal: Withdraw consent at any time
  • Objection: Object to processing based on legitimate interest

To exercise any right, email heitorhog@gmail.com. We will reply within 15 business days, as required by the LGPD.

7. Retention

Data type Retention
Account data (name, email) While the account is active + 6 months after deletion
Trade history While the account is active + 5 years (tax/record-keeping)
Audit logs 5 years (security and compliance)
Signing keys Deleted immediately when you remove the wallet or delete the account

8. Cookies and tracking

  • Essential cookies: Session authentication. Strictly necessary.
  • Analytics (optional): If added later, it will be anonymized and require explicit consent.

We do not use third-party cookies for advertising or behavioral tracking.

9. International transfers

  • Google (USA) — authentication
  • Polymarket (USA) — order execution

These transfers are based on necessity to perform a contract (LGPD Art. 33, II) and, where required, the data subject’s consent (LGPD Art. 33, VIII).

10. Minors

BetFlowBot is not intended for anyone under 18. We do not knowingly collect data from minors. If we learn a minor used the Service, we will delete their data immediately.

11. Security incidents

If a security incident may cause relevant risk or harm to data subjects, we will notify:

  • The Brazilian National Data Protection Authority (ANPD) within 72 hours
  • Affected users, with a description of the incident, data involved and measures taken

12. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be communicated by email or a dashboard notice. The “Last updated” date will always be revised.

13. Contact and DPO

You may also lodge a complaint with the ANPD at www.gov.br/anpd.