Privacy Policy

Who we are

Packed Capital ("Packed", "we", "us") provides non-custodial crypto asset management. Your funds stay in your own exchange accounts. We run trading strategies (bots) on those accounts through API keys that you create and give us.

This policy covers our website, packedcap.com, and our client control panel at controlplane.packedcap.com. If you have any question about it, write to us at partner@packedcap.com.

What we collect

We keep this to what we actually need:

• Access requests. When you use the "Request access" form on our website, we receive your name, email address, the holdings range and strategy you select, and your message if you write one. If you email us, we receive your email address and whatever you choose to write.
• Account information. When you sign in to the control panel, we receive your name and email address, and your profile picture if you sign in with Google and have one set.
• Exchange API keys. The API keys for the exchange accounts you connect (for example Binance or Deribit) that you enter in the control panel. See Exchange API keys below.
• Operational data. Your bot configuration, orders, positions, trade history, and the logs and metrics our systems produce while running and monitoring your strategies.
• Website usage. Aggregate, cookieless statistics about how our website is used. See Website analytics and cookies below.

Like any website or online service, the servers that deliver our pages also process technical data such as your IP address and browser type, so they can serve you and keep the service secure.

How we use it

• To reply to your access request and talk to you about onboarding and your account.
• To sign you in to the control panel and keep your account secure.
• To run, monitor and support your strategies: placing and managing orders, tracking positions and results, and investigating problems.
• To understand, in aggregate, how our website is used, so we can improve it.
• To protect the service against abuse and to meet our legal obligations.

We do not use your personal data for advertising, and we do not use it to build marketing profiles.

Google sign-in

Sign-in to the control panel is handled by our authentication provider, WorkOS (AuthKit), on auth.packedcap.com. You can sign in with an email and password, with a magic link sent to your email, or with your Google account.

If you choose Google, we ask Google only for your basic profile and email address (the userinfo.email and userinfo.profile scopes). From Google we receive your name, your email address and your profile picture, if you have one set. We use this information only to create your account, sign you in and show who is signed in. We keep your name, email address and profile picture with your account for as long as your account is active, and delete them when you close your account or ask us to delete your data (see Your rights), except for records we are required to keep by law.

We never receive your Google password. We do not access your Gmail, Google Drive, contacts or any other Google data. We do not sell Google user data or use it for advertising. We share it only with the service providers that run sign-in and the control panel for us (WorkOS and DigitalOcean), or when required by law. You can remove Packed Capital's access at any time in your Google Account settings.

Packed Capital's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Exchange API keys

To run a strategy, you create API keys on your own exchange account (for example Binance or Deribit) and enter them in the control panel. We ask you to create keys with trading permission only and without withdrawal permission. A key like that can place orders, but it cannot move funds out of your account.

Your keys are stored as secrets in our private infrastructure. They are accessible only to the services that run your strategies and to authorized staff, and they are used only to place and manage orders for your strategies.

You can delete your keys in the control panel at any time. Deleting a key stops the strategies that use it. You can also revoke a key directly on the exchange whenever you like.

Website analytics and cookies

Our website uses Umami, a privacy-friendly analytics tool that does not use cookies. It counts page views and a few events, such as clicks on "Request access" and whether the access form was sent, together with the strategy and holdings range selected. It never receives your name, email address or message. Analytics run only on the live site.

We do not use advertising cookies or tracking pixels, and we do not track you across other websites. The control panel and our sign-in pages use cookies and browser storage only for sign-in, security and basic functionality, not for advertising or tracking.

Service providers

We rely on a small number of providers to run Packed Capital. Each one receives only what it needs to do its job:

• WorkOS for authentication and sign-in.
• Google for optional sign-in with your Google account.
• DigitalOcean for hosting the control panel and the infrastructure that runs your strategies.
• Amazon Web Services for hosting this website.
• Cloudflare for DNS.
• Umami for cookieless website analytics.
• Formspree for delivering website access requests to us.
• The exchanges you connect, such as Binance and Deribit. You hold your account with them directly, and they process your data under their own privacy policies.

Some of these providers operate in other countries, so your data may be processed outside the country where you live.

Sharing

We do not sell your personal data. We do not share it for advertising, and we do not use it to build marketing profiles. We disclose personal data only to the service providers listed above, so that we can run the service, or when we are required to by law.

Retention

• Logs and metrics are kept for a limited operational period, about two weeks.
• Account records, including your name, email address, profile picture, strategy settings and trade history, are kept while your account is active.
• Exchange API keys are kept until you delete them or close your account.
• Access requests and emails are kept for as long as we need them to reply to you and manage our relationship with you.

When you close your account, we delete your account data, including your stored exchange API keys, except for records we are required to keep by law.

Security

Access to personal data and secrets is restricted to authorized staff. Exchange API keys and other secrets are managed with a dedicated secrets manager. Traffic to our website, sign-in pages and control panel is encrypted with TLS.

No system is perfectly secure, which is why the service is built so that we never hold your funds, and why we ask for API keys that cannot withdraw them.

Your rights

You can ask us to access, correct, export or delete your personal data, and you can close your account, by writing to partner@packedcap.com. We respond within a reasonable time.

Deleting your account also deletes the exchange API keys we store. We may keep some records where the law requires us to. Depending on where you live, local data protection law may give you further rights, including the right to complain to your data protection authority.

Children

Packed Capital is not intended for anyone under 18, and we do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.

Changes to this policy

We may update this policy from time to time. Any changes are posted on this page with a new "Last updated" date at the top.

Contact

For any privacy question or request, email partner@packedcap.com.