Privacy Policy

• Document Privacy Policy
• Version Draft 1.0
• Last updated 7 August 2026
• Status Draft — pending legal review

1. Who is responsible for your data

This policy explains what personal data Usko collects about you, why, who it reaches, how long we keep it, and what you can require us to do about it.

The controller of your personal data is operating entity to be confirmed. Its company details, registered address, the identity of its data-protection officer or India DPDP Data Protection Officer, its EU/UK representative if one is required, and the supervisory authority it answers to are to be confirmed.

This is not a formality we are skipping. A controller's identity is the thing that tells you who to complain to. Until it is settled, please route any data-protection request through a support ticket, which is authenticated and tracked, and we will handle it.

2. Where your data is stored

Usko runs on a single server hosted by Akamai Connected Cloud (Linode) in its Mumbai, India region. Our application database, cache and market-data store all run on that server. Verification documents you upload are stored on that server's own filesystem.

So: if you are outside India, using Usko involves your personal data being transferred to and stored in India. If you are in the EEA or the UK, that is a transfer to a third country. The transfer mechanism we rely on, and the standard contractual clauses or equivalent safeguards behind it, are to be confirmed — that is a legal decision tied to the entity question in section 1. We are telling you where the data physically is so you can make your own decision in the meantime.

Email is delivered through a provider outside India (section 5).

3. What we collect

Information you give us

• Account. Email address, password (stored only as a cryptographic hash, never in readable form), first and last name, and optionally a phone number and a profile picture.
• Identity verification. The personal details and the document images required by the verification level you apply for — typically your name, date of birth, address and nationality, and an image of a government-issued identity document. Depending on the level and on what a review turns up, we may also ask for proof of address, a photograph of you holding your document, or evidence of the source of your funds.
• Peer-to-peer trading. The payment methods you choose to publish, the payment details you exchange with a counterparty (these are necessarily visible to that counterparty), the trade chat, payment references you enter, and any evidence you upload in a dispute.
• Support. Everything in a ticket you raise, including attachments.
• Preferences. Language, theme, notification settings and the markets on your watchlist.

Information created by your use of Usko

• Transactions and balances. Every order, fill, transfer, escrow movement, fee, tax withholding, subscription, strategy and ledger entry on your account, with its timestamp.
• Reputation. Your peer-to-peer completion record and the ratings and reviews left for you, which are shown publicly to other customers on the marketplace.
• Referrals. If you use or share a referral link, the relationship between the accounts involved and the rewards paid.
• Security and technical. IP address, browser and device information, session identifiers, login and failed-login timestamps, and the activity and audit logs the platform writes as you use it.
• Communications. Records of the emails and notifications we send you and whether delivery succeeded.

What we do not collect

• We do not run advertising or third-party analytics on Usko today. There is no advertising pixel and no analytics tag active on this site, and we set no advertising or analytics cookie (section 4).
• We do not buy personal data about you from data brokers.
• We do not collect biometric templates. No liveness or face-matching vendor is in use; verification is reviewed by a person.
• We do not ask for and do not want your special-category data — health, religion, political opinion, sexual orientation. Please do not send it to us. An identity document may incidentally reveal something of that kind; where it does, we use it only to check your identity.

4. Cookies and similar technologies

Usko sets a small, fixed set of cookies. All of them are strictly necessary to run the service or to remember a choice you made. We do not use cookies for advertising, profiling or cross-site tracking, and there is no third-party tracker on this site today.

We also use your browser's local storage to keep interface preferences such as your theme, chart layout and saved chart templates. That never leaves your device.

Because none of the above is used for advertising or analytics, we do not show a consent banner for them; strictly necessary cookies do not require consent. If we ever add analytics or advertising, we will ask for your consent first and this section will change before the tag goes live.

5. Who your data reaches

This list is the actual set of third parties involved in running Usko today, verified against the live system. It is deliberately short, and shorter than most exchanges' lists, because most of the platform runs on our own server.

Configured but switched off

The platform has an IP-geolocation check (using the ip-api.com service) that would map a login IP address to a country for compliance purposes. It is currently disabled and no data is being sent to it. If we enable it, this section will be updated first.

What we want you to notice about that list

• There is no third-party identity-verification vendor. Your documents are reviewed by our own team on our own server. Nobody else sees them.
• There is no payment processor. Usko does not take card or bank payments, so no card network, acquirer or payment gateway holds data about you through us.
• There is no analytics or advertising provider.
• Placeholder credentials for other services exist in the platform's configuration because it ships supporting them. They are placeholders, not live integrations, and nothing is sent to those services.

Other people who may see some of your data

• Your peer-to-peer counterparty sees your display name, your public reputation and whatever payment details the trade requires. That is inherent in paying a person directly, and you should share nothing beyond what the payment needs.
• Other customers see your public reputation, ratings and reviews on the marketplace, and your display name on a copy-trading leaderboard if you choose to become a leader.
• Authorities. We disclose data to regulators, tax authorities, courts and law-enforcement agencies where we are legally required to, or where it is necessary to establish, exercise or defend a legal claim. Where a suspicious activity report has been made we are generally prohibited from telling you.
• Professional advisers and a successor. Our auditors and lawyers, and a buyer or successor if the business is transferred, under confidentiality.

We do not sell your personal data. We have never sold it and we do not intend to.

6. Why we use it, and our lawful basis

For readers in the EEA and the UK, the lawful basis under the GDPR is in the right-hand column. For readers in India, the equivalent basis under the Digital Personal Data Protection Act 2023 is your consent or a legitimate use — principally the performance of a service you have asked for and compliance with a legal obligation.

Automated decision-making

We do not make decisions about you that produce legal or similarly significant effects by automated means alone. Verification is reviewed by a person. The platform's automated compliance monitoring is not currently switched on, and if it is switched on it will flag activity for a person to review rather than decide anything by itself. Automated risk controls that act without a human — for instance liquidating a leveraged futures position when its margin is exhausted — are mechanical rules of the product you chose to use, described in the Risk Disclosure.

7. How long we keep it

We keep personal data for as long as we need it for the purpose we collected it, and then for as long as the law requires us to keep it.

The specific retention periods for each category are to be confirmed. They depend on which jurisdictions Usko ends up operating and registered in, and those are open questions (section 1). Publishing a schedule of periods before that is settled would be publishing a guess, and a retention schedule is precisely the kind of thing a reader is entitled to rely on.

What we can tell you now is the shape of it:

• Identity-verification records and transaction records are subject to statutory minimum retention under anti-money-laundering law in every jurisdiction we are likely to operate in, running from the end of your relationship with us. That is a floor we cannot go below, and it means closing your account does not delete your verification documents or your trading history.
• Tax records, including the TDS ledger and the remittance reports, are kept for the period the relevant tax authority requires.
• Security and audit logs are kept for a shorter period, proportionate to investigating an incident.
• Support tickets are kept while they may be relevant to a complaint or a claim.
• Marketing consents and unsubscribes are kept so that we can honour your choice.

When a period ends we delete the data or anonymise it so it can no longer be connected to you.

8. How we protect it

Written the same way as the rest of this site: what is actually in place, not what sounds reassuring.

• The whole site is served over encrypted connections (HTTPS/TLS).
• Passwords are stored using the Argon2 password-hashing function, which is salted by construction. We cannot read your password, and neither could anyone who obtained the database.
• Session and authentication cookies are HttpOnly and Secure, so a script running in your browser cannot read them, and are accompanied by cross-site-request-forgery protection.
• Two-factor authentication is available on your account, using an authenticator app or a code sent to your email address, with recovery codes. We recommend the authenticator app.
• Failed login attempts are counted and recorded against the account, and several subsystems — peer-to-peer, copy trading, the bots and the fiat ramp — write their own audit logs of the actions taken in them.
• Administrative functions are separated from customer functions and are restricted to staff accounts.
• The database, the cache and the market-data store listen only on the server's loopback interface and are not reachable from the internet.

Two honest caveats, because a security section that only lists strengths is not much use to you:

• Usko is an early-stage platform and its security posture is actively being reviewed and hardened. We do not currently hold an independent security certification, and we have not published a third-party penetration test. When we do either, we will say so on the Security page.
• No system is perfectly secure. If a breach affects your personal data and is likely to result in a risk to your rights, we will notify the relevant authority and, where required, you — without undue delay and within the deadlines the applicable law sets.

If you believe you have found a security problem in Usko, please report it through a support ticket rather than disclosing it publicly, and we will work with you.

9. Your rights

Which rights you have depends on where you are. We apply the following to everyone, because operating two standards is how mistakes happen.

Rights we honour for all customers

• Access. Ask what personal data we hold about you and get a copy.
• Correction. Have inaccurate or incomplete data corrected. Your name, email, phone and profile can be edited directly in your account; data captured during identity verification is corrected through a support ticket, because it has to be re-verified.
• Erasure. Ask us to delete your data. We will, except where we are required to keep it — and for identity and transaction records we generally are, for the AML and tax periods in section 7. We will tell you exactly what we are keeping and why.
• Restriction and objection. Ask us to pause our use of your data while a dispute about it is resolved, or object to processing we do on the basis of legitimate interests.
• Portability. Receive the data you gave us in a structured, machine-readable format. Your trading, TDS and profit-and-loss records can be exported as CSV from the platform yourself.
• Withdraw consent. Where we rely on consent — marketing email — withdraw it at any time. That does not affect what we did before you withdrew it.
• Complain. Complain to us, and to a data-protection authority.

If you are in the EEA or the UK

The rights above are your GDPR rights. You also have the right to lodge a complaint with your national supervisory authority, and you do not have to come to us first. We will respond to a request within one month, extendable by two further months for a complex request, and we will tell you if we extend.

If you are in India

Under the Digital Personal Data Protection Act 2023 you have the right to access a summary of your personal data and of our processing, the right to correction and erasure, the right to nominate someone to exercise your rights if you die or become incapacitated, and the right to a grievance-redressal mechanism. You may complain to the Data Protection Board of India if we do not resolve your grievance. The name and contact details of our Data Protection Officer and grievance officer are part of the entity question in section 1 and are to be confirmed; in the meantime a support ticket reaches the team that handles these requests.

How to exercise a right

Raise a support ticket from inside your account. That route is authenticated, which means we can be confident the request is really from you — the most common way personal data is lost is an attacker asking for it. If you cannot log in, contact us and we will agree another way to verify you. We do not charge for this, unless a request is manifestly unfounded or excessive.

10. Children

Usko is not for anyone under 18, and we do not knowingly collect data about children. If you believe a child has given us personal data, tell us and we will delete it and close the account.

11. Changes to this policy

We will update this policy as the platform changes — in particular when on-chain transfers, automated fiat rails or an identity-verification vendor go live, each of which changes who your data reaches. The version and date are at the top. For a material change we will notify you by email and in the platform before it takes effect.

12. Contact

For anything about your personal data, raise a support ticket from inside your account. The published data-protection contact address, the DPO's details and the postal address for privacy correspondence are to be confirmed.