Privacy Policy & Cookies

1. Data controller

The data controller is:

• Sami Hannai — Sole proprietorship (French micro-entrepreneur regime) operating under the commercial name Sextant
• Address: 6 allée des Primevères, 91370 Verrières-le-Buisson, France
• SIRET: 980 723 613 00017
• Email: [email protected]

2. Data collected

While using the site, dashboard, Academy and Sextant Bot, we may collect:

• Account data: email, password (hashed), session identifiers.
• Bot-related data: bot settings, traded pairs, execution logs.
• Exchange API keys: stored encrypted, with no withdraw permission.
• Billing data: via Stripe (name, email, payment information processed by Stripe). For the audit: your bank card is registered by Stripe, Inc., our payment provider, at your request and with your express authorisation, for a single charge at the debrief of your audit. We do not know its number. It is deleted as soon as that charge has been made, or as soon as the audit does not take place. If, on Stripe's page, you also choose to save your card in Link (Stripe's wallet, usable with other merchants), that saving is governed by Stripe and its terms, not by us: we cannot delete it.
• Educational data: Academy progression, viewed modules.
• Technical logs: error journals, security, connections.

3. Purposes of processing and legal bases (art. 6 GDPR)

This data is used for the following purposes, with their respective legal bases:

Purpose	Legal basis (art. 6 GDPR)
Account creation and management, access to dashboard and training	Contract performance (art. 6.1.b)
Operation of Sextant Bot based on your settings	Contract performance (art. 6.1.b)
Billing and subscription tracking	Legal obligation (art. 6.1.c) — accounting retention
Technical logs, security, diagnostics	Legitimate interest (art. 6.1.f) — service security
Response to support requests	Contract performance (art. 6.1.b)

4. Security & API keys

The API keys you provide are encrypted (Fernet/AES-128) and stored securely. They are used only to:

• fetch the market data required for the bot to operate;
• send trading orders based on your settings;
• never to perform withdrawals.

You can revoke your API keys at any time from your exchange and/or delete your Sextant account to erase all associated data.

5. Subprocessors & hosting

To provide the service, Sextant uses the following providers:

• OVH SAS (France): hosting of backend servers and infrastructure.
• Vercel Inc. (United States): hosting of the frontend website (public pages). Transfer outside the EU framed by Standard Contractual Clauses (SCC) approved by the European Commission (art. 46 GDPR).
• Stripe, Inc. (United States): payment processing, billing and subscription management. Transfer outside the EU framed by Standard Contractual Clauses (SCC) approved by the European Commission (art. 46 GDPR).
• Microsoft Corporation (United States): anonymised audience measurement (Microsoft Clarity — heatmaps and session recordings), only after your consent. Clarity masks inputs and is excluded from sign-in, sign-up, account and payment pages. Transfer outside the EU framed by Standard Contractual Clauses (SCC) approved by the European Commission (art. 46 GDPR).

These providers act as processors within the meaning of the GDPR and only process your data on behalf of Sextant.

6. Retention period

• User account: for the entire duration of service use.
• API keys: while the bot is in use, then deleted on account deletion.
• Technical logs: kept for a maximum of 6 months for security and diagnostics.
• Billing data: legal accounting retention period.

7. Your rights (GDPR)

Under the GDPR, you have the following rights:

• Right of access to your data;
• Right to rectification;
• Right to erasure (right to be forgotten);
• Right to restrict processing;
• Right to data portability;
• Right to object.

To exercise your rights, contact us at: [email protected]

Self-service: users with an account can directly exercise their rights of access, portability and erasure from their personal area /my-account → Data tab (full JSON export and final account deletion with email confirmation valid for 72 hours, in line with the cooling-off principle).

8. Cookies used

Sextant distinguishes two families of cookies:

a) Strictly necessary cookies (always active, no consent required):

• Session cookies (authentication, keeping you signed in);
• Security-related cookies (protection against certain attacks);
• Cookies needed for Stripe payment processing;
• A cookie storing your consent choices (kept ~13 months, per CNIL guidance).

b) Audience-measurement cookies — set only after your consent via the “Your cookies, your choice” banner:

• Vercel Web Analytics and Sentry: anonymised usage statistics and error diagnostics;
• Microsoft Clarity: anonymised heatmaps and session recordings, to understand and improve navigation. Clarity is excluded from sign-in, sign-up, account and payment pages, and inputs are masked there.

No third-party advertising cookies (Google Ads, Meta Pixel) are used. Audience-measurement cookies are only set after your explicit consent, which you can withdraw at any time.

9. Cookie management

You can change or withdraw your consent at any time via the “Manage my cookies” link in the footer. You can also delete cookies from your browser settings; blocking strictly necessary cookies may, however, affect the operation of the site and dashboard.

10. Policy updates

This policy may be updated to reflect changes in the service, regulation or our practices. In case of a significant change, an information notice may be displayed on the site or sent by email.