Last revised: 10 July 2026 · Version: 1.1 Service address: https://orfi.tech · Contact: support@orfi.tech (privacy@orfi.tech)
This is a translation provided for convenience. In case of any discrepancy between this English version and the Russian original, the Russian version prevails.
1. General Provisions 2. Terms and Definitions 3. Personal Data Operator 4. Legal Grounds for Processing 5. Categories of Data Subjects, Composition of Personal Data and Purposes of Processing 6. Principles and Conditions of Processing 7. Procedure and Periods of Processing, Storage and Destruction 8. Transfer of Personal Data to Third Parties 9. Cross-Border Transfer of Personal Data 10. Cookies and Similar Technologies 11. Rights of the Personal Data Subject 12. Personal Data Protection Measures 13. Procedure for Inquiries by Data Subjects 14. Amendment of the Policy 15. Contact Details of the Operator
1.1. This Policy determines the procedure for the processing and protection of the personal data of the users of the Orfi Service (https://orfi.tech) and has been developed in accordance with Federal Law No. 152-FZ of 27.07.2006 "On Personal Data" (hereinafter — Law No. 152-FZ).
1.2. The purposes of this document are to protect the rights and freedoms of personal data subjects and to ensure the Operator's compliance with the requirements of the legislation.
1.3. The Policy applies to all personal data that the Operator receives from the User in connection with the use of the Service.
| Term | Definition |
|---|---|
| Personal data (PD) | Any information relating to a directly or indirectly identified or identifiable natural person (the PD subject). |
| Operator | The person that organizes and carries out the processing of PD; contact details are set out in Section 15. |
| Processing of PD | Any operation with PD: collection, recording, storage, use, transfer, deletion, destruction and others. |
| PD subject / User | A natural person who uses the Service. |
| Destruction of PD | Actions as a result of which it is impossible to restore the content of the PD. |
3.1. The Operator is the owner of the Service; contact details for inquiries are set out in Section 15 of this Policy.
3.2. Inquiries regarding the processing of PD are to be sent to support@orfi.tech (or privacy@orfi.tech).
4.1. The processing of PD is carried out on the basis of:
5.1. The PD subjects are registered and unregistered Users of the Service.
5.2. The Operator processes the following data:
| Category of data | Composition | Purpose of processing |
|---|---|---|
| Registration | email address, password hash | creation and authentication of the Account |
| Technical | IP address, device and browser information, event logs | ensuring the operation and security of the Service |
| Usage | settings, history of actions in the Service, subscription status | provision of the functions of the Service |
| Payment | order identifier, payment status and amount, payment network/address (to the extent received from the Payment Provider) | accounting for Subscription payments |
| Trading Module | exchange API keys provided by the User; account data received by means of those keys | provision of the functions of the Trading Module |
| Communication | support inquiries and correspondence | handling of inquiries |
5.3. The Operator does not request and does not process special categories of PD. Full payment details (card data and the like) are not stored by the Operator — the payment is processed by the Payment Provider.
5.4. Exchange API keys are stored with the application of technical protection measures and are used solely for the provision of the functions of the Trading Module at the User's initiative. It is recommended to provide keys with the minimum necessary permissions.
6.1. Processing is carried out lawfully and fairly, is limited to the achievement of the stated purposes and is not excessive.
6.2. The Operator does not merge databases processed for incompatible purposes.
6.3. Processing is carried out both with and without the use of automation tools.
6.4. The Operator does not take decisions that give rise to legal consequences in respect of the PD subject or otherwise affect the subject's rights and legitimate interests on the basis of solely automated processing of personal data.
6.5. The Operator proceeds on the assumption that the data provided by the User is accurate, without verifying it, and takes measures to rectify or delete incomplete or inaccurate data in the cases provided for by this Policy and by Law No. 152-FZ.
7.1. PD is processed for the duration of the use of the Service and until the purposes of processing are achieved, unless another period is established by law.
7.2. The storage of the PD of citizens of the Russian Federation is carried out using databases located in the territory of the Russian Federation (part 5 of Article 18 of Law No. 152-FZ).
7.3. Upon achievement of the purposes of processing, withdrawal of consent or cessation of the use of the Service, the PD is subject to destruction within a period not exceeding 30 (thirty) days, except in cases where its further storage is required by law. If destruction within that period is technically impossible, the PD is blocked and destroyed within a period of no more than 6 (six) months.
7.4. Exchange API keys are deleted at the User's initiative (by disconnecting them in the Service) or upon deletion of the Account.
7.5. In accordance with Article 21 of Law No. 152-FZ:
8.1. The Operator is entitled to transfer PD to third parties solely to the extent necessary for the functioning of the Service:
8.2. The Operator does not sell PD and does not disclose it to an indefinite range of persons. Transfer is also possible pursuant to a lawful request of authorized state bodies.
8.3. In the event of a reorganization of the Operator's activities or a transfer of the rights to the Service, PD may be transferred to the successor provided that the successor assumes the obligations to comply with this Policy and with Law No. 152-FZ; Users are notified of such transfer by the publication of a new revision of the Policy.
9.1. Certain services engaged by the Operator (the Payment Provider, the email service) may be located outside the Russian Federation, and consequently a cross-border transfer of PD is possible to the extent necessary for the provision of the relevant services.
9.2. Cross-border transfer is carried out in compliance with the requirements of Law No. 152-FZ.
10.1. The Service uses cookies, localStorage and similar technologies for authentication, for storing user settings and for ensuring the operation of the interface.
10.2. The User may restrict the use of cookies by means of the browser; in that case some functions of the Service may become unavailable.
10.3. The Service does not place third-party advertising and does not transfer User data to advertising networks.
11.1. The PD subject is entitled to:
11.2. Withdrawal of consent and deletion of PD may result in the impossibility of using the Service.
12.1. The Operator takes legal, organizational and technical measures to protect PD against unlawful access, destruction, modification and dissemination, including:
13.1. Inquiries, requests and withdrawals of consent are to be sent to support@orfi.tech (or privacy@orfi.tech).
13.2. The Operator provides a response to a request of a PD subject within 10 (ten) business days from the date of the inquiry; that period may be extended by no more than 5 (five) business days with a reasoned notice sent to the subject (Article 20 of Law No. 152-FZ). Other inquiries are considered within the periods established by Law No. 152-FZ.
14.1. The Operator is entitled to amend this Policy. The current revision is published at https://orfi.tech/legal/privacy.