Privacy Policy
This policy explains how DCA Forge (SSM 202601234567) ("we", "us") collects, uses, stores and protects your personal data when you use DCA Forge at https://dcaforge.my, in line with the Personal Data Protection Act 2010 ("PDPA"). This notice is provided in Malay and English — press BM above for the Malay version.
1. Data we collect
| Type of data | Details |
|---|---|
| Account information | Your name (optional), email address and password. Passwords are stored as a one-way hash (scrypt) and cannot be read by anyone, including us. |
| Exchange API keys | The API keys and secrets you connect for Luno, HTX or Binance. Stored encrypted (symmetric encryption) and only decrypted by the bot engine to send orders on your behalf. We only display a few characters at the start and end of each key. |
| Bot and trading data | Bot settings (exchange, capital, TP, stop loss), cycle status, orders placed, prices, profit/loss, activity logs and errors. Your exchange account balance is read when needed (when verifying API keys and before placing orders) and a recent snapshot is kept to show whether your balance covers your bots. |
| Subscription information | Plan, subscription status, renewal date, Stripe customer ID and invoice records (amount, date, status). Card details never reach or are stored on our servers — they are handled entirely by Stripe. |
| Technical data | IP address and browser information in web server logs, and IP addresses used temporarily to limit login attempts. |
2. Purposes of use
- Creating and managing your account, and authenticating logins.
- Running your bots: reading prices, and placing and cancelling orders on the exchange according to your settings.
- Showing you your dashboard, history and bot performance.
- Processing subscriptions and payments, and enforcing plan bot limits.
- Security: detecting abuse, preventing unauthorised access and fixing errors.
- Contacting you about your account, payments, changes to the Terms or service disruptions.
- Complying with legal obligations, including keeping accounting records.
We do not sell your personal data and do not use it for third-party advertising.
3. Disclosure to third parties
Data is shared only as far as needed to provide the Service:
- The exchanges you connect (Luno, HTX, Binance) — order and balance requests are sent using your API keys.
- Stripe — subscription payment processing; receives the email, name and payment details you enter on Stripe's page.
- Hosting provider (Hostinger) — the servers where the Service and its database run.
- Authorities — where required by law, a court order or a lawful request from an authority.
Some of these parties process data outside Malaysia. We only use providers with reasonable data-protection measures, in line with the cross-border transfer requirements under the PDPA.
4. Cookies
We use only essential cookies: one to keep you logged in (dcabot_session, expires after 14 days) and
one to remember your language choice (lang). We do not use analytics or advertising cookies. Stripe may set
its own cookies on Stripe's payment pages.
5. Security
- Connections are protected by HTTPS; passwords are hashed; API keys are encrypted at rest.
- Administrator access is limited to authorised personnel.
- No system is 100% secure. If a data breach affects you, we will notify you and the relevant authorities as required by law.
- Reduce risk by giving API keys trade-only permission (no withdrawals) and restricting them to our server's IP.
6. Retention
- Account, bot and trading data is kept while your account is active.
- API keys are deleted immediately when you delete them on the Settings page.
- When an account is deleted on request, personal data is deleted or anonymised within a reasonable time, except payment and invoice records that must be kept for the period required by accounting and tax laws.
- Server logs are kept for a limited period for security and troubleshooting.
7. Your rights
Subject to the PDPA, you have the right to:
- access your personal data and obtain a copy of it;
- correct data that is inaccurate or incomplete;
- withdraw consent and ask for your account and data to be deleted (this ends the Service for you);
- ask for your data to be transferred in a commonly used format, to the extent permitted by law;
- limit processing for direct marketing purposes.
Send requests to sokongan@dcaforge.my from your account's email address. We will reply within 21 days. We may charge a fee permitted by law for data-copy requests, and may refuse requests in circumstances permitted by the PDPA. You may also lodge a complaint with the Personal Data Protection Department (JPDP).
8. Children
The Service is not intended for anyone under 18, and we do not knowingly collect their data.
9. Changes to this policy
We may update this policy. The effective date above will be updated, and material changes will be notified by email or a notice in the Service.