1. Who We Are

The WFF Platform ("Platform", "we", "our", "us") is operated by Bilinguals Multi-Services, Massachusetts. We provide an automated cryptocurrency trading platform with AI-powered decision support, multi-exchange connectivity, and portfolio management tools.

2. Information We Collect

2.1 Information you give us directly

• Account identifiers: Email, phone number, username, full name, date of birth
• Authentication credentials: Password (stored bcrypt-hashed, cost factor 12) and PIN (separately hashed)
• KYC documentation: Government-issued ID, selfie verification, proof of address (when required by AML rules)
• Financial information: Bank account details (via Plaid, where applicable), exchange API keys (encrypted at rest)
• Communication: Support tickets, in-app chat, feedback submissions

2.2 Information we collect automatically

• IP address (logged for security and audit trail)
• Device information (browser, operating system) when you log in
• Trading activity and bot configuration on the Platform
• Session timestamps and last-login records

2.3 Information from third parties

• Connected exchange accounts (balances, executed trades — only when you authorize via API key)
• Identity verification providers (Plaid, KYC vendors)
• Payment processors (Stripe, MoonPay, Ramp Network, Wise)

3. How We Use Your Information

• Operate the Platform and execute the trading decisions you authorize
• Verify your identity and comply with KYC/AML requirements
• Detect and prevent fraud, abuse, and unauthorized access
• Provide customer support and respond to your requests
• Send you account, security, and transactional notifications
• Comply with legal obligations (tax reporting, regulator requests)

4. How We Share Your Information

We do not sell your personal information. We share it only with:

• Service providers who help us run the Platform (cloud hosting, payment processing, KYC verification, email/SMS delivery) under contractual confidentiality.
• Connected exchanges when you place an order through us. We send the order; the exchange settles it.
• Regulators and law enforcement when required by valid legal process.
• An acquirer in the event of a merger, acquisition, or sale of business assets — with notice to you.

5. How We Protect Your Information

• HTTPS / TLS 1.2+ enforced for all connections (HSTS with one-year max-age)
• Passwords hashed with bcrypt (cost factor 12) — never stored in plaintext
• Two-factor authentication (TOTP) available and required for owner accounts
• Exchange API keys encrypted at rest with rotating envelope keys
• Audit logs of all administrative actions retained for compliance review
• Production data is encrypted at rest by our hosting provider (Railway)
• Background fraud detection on transaction patterns and login behavior

6. Your Rights

Depending on your jurisdiction, you may have the right to:

• Access the personal information we hold about you
• Correct inaccurate information
• Delete your account and associated data (subject to legal retention requirements)
• Export your data in a portable format
• Object to or restrict certain processing
• Withdraw consent where we rely on consent

To exercise these rights, contact us at privacy@bilingualstrade.com.

7. Data Retention

We retain your information for as long as your account is active and as needed to provide the Platform. After account closure, we retain:

• Transaction records: 7 years (US tax + AML requirements)
• KYC documents: 5 years after account closure (BSA requirements)
• Communication logs: 3 years
• Other personal data: deleted within 90 days of account closure unless legally required to retain

8. International Transfers

The Platform is operated from the United States. If you access it from outside the US, your information will be transferred to and processed in the US, which may have different data protection laws than your home country.

9. Children

The Platform is not directed at, and we do not knowingly collect personal information from, anyone under 18 years of age. If you believe a child has provided us with personal information, contact us and we will delete it.

10. Changes to This Policy

We may update this policy from time to time. Material changes will be communicated by email and through an in-app notice at least 30 days before they take effect.

11. Contact Us

Bilinguals
Email: privacy@bilingualstrade.com
Support: support@bilingualstrade.com
Compliance: compliance@bilingualstrade.com