Privacy Policy
This policy explains what personal data NextScalp collects when you use the @nextscalp_bot Telegram bot or the nextscalp.com website, why we collect it, how long we keep it, and what rights you have over it.
1. Controller
The data controller is NextScalp. Contact: support@nextscalp.com.
2. Data we collect and why
2.1 Telegram account data
When you start the bot, Telegram passes us your numeric Telegram user ID and, optionally, your first name and username. We store the Telegram ID as your primary identifier. We do not store your phone number, email address, or any other Telegram profile data beyond what you voluntarily share in bot commands.
Legal basis: contract performance (Article 6(1)(b) GDPR) - the ID is needed to route alerts to you.
2.2 Watchlists and preferences
Pairs you add via /watch, symbols you blacklist, price alert thresholds, and
bot settings (signal types, tier, notification preferences) are stored in our database
linked to your Telegram ID.
Legal basis: contract performance.
2.3 Payment records
Premium subscriptions are paid through Crypto Pay (operated by Telegram). We store invoice IDs, payment amounts, currency (USDT, TON, BTC, ETH), timestamps, and subscription period in our database. We never see or store your wallet address or private keys. Crypto Pay handles the transaction layer; their privacy policy governs that side of the payment.
Legal basis: contract performance and legal obligation (record-keeping).
2.4 AI co-pilot interactions
When you use the on-demand AI features (/ai, /ask,
/psy, /market), we log a token-usage event (timestamp,
approximate token count, feature name) for quota management and abuse prevention. We do
not persistently store the content of your messages or AI responses beyond the Telegram
conversation itself.
Legal basis: legitimate interest (quota enforcement and abuse prevention).
2.5 Signal lifecycle events
Each signal we deliver generates an anonymised event log (signal type, symbol, timestamp, whether it passed or was suppressed) used for self-evaluation and quality auditing. These records contain no personally identifiable information beyond the fact that a signal was delivered to a given tier.
Legal basis: legitimate interest (product quality and self-auditing).
2.6 Website analytics
The nextscalp.com website uses GoatCounter, a privacy-friendly analytics tool that counts page views without cookies, without fingerprinting, and without any cross-site tracking. GoatCounter stores only aggregated counts and approximate country/referrer data. No personal data is collected or shared with third parties through website analytics.
Legal basis: legitimate interest (understanding aggregate site usage).
3. Data storage and security
All personal data is stored in Supabase (PostgreSQL), hosted in the EU (Frankfurt, AWS eu-central-1). Data in transit is encrypted with TLS 1.2+. Data at rest is encrypted by the hosting provider. Access to the database is restricted to the NextScalp application service and the controller.
4. Retention periods
| Data category | Retention |
|---|---|
| Account (Telegram ID, preferences) | Until you request deletion or 2 years of inactivity |
| Watchlists and blacklists | Until you remove them or account deletion |
| Payment records | 7 years (legal/tax obligation) |
| AI token-usage events | 90 days rolling |
| Signal lifecycle events | 365 days rolling |
5. Third-party processors
- Supabase Inc. - database hosting. Supabase Privacy Policy.
- Telegram Messenger Inc. - message delivery and Crypto Pay. Telegram Privacy Policy.
- Anthropic PBC - AI inference (on-demand features only, no persistent storage). Anthropic Privacy Policy.
- GoatCounter - website analytics (no cookies, no cross-site tracking). GoatCounter Privacy Policy.
We do not sell, rent, or share your personal data with advertisers or data brokers.
6. Your rights (GDPR)
If you are located in the European Economic Area, you have the following rights:
- Access - request a copy of the personal data we hold about you.
- Rectification - ask us to correct inaccurate data.
- Erasure - request deletion of your account and associated data (subject to retention obligations for payment records).
- Restriction - ask us to limit processing while a dispute is resolved.
- Portability - receive your data in a machine-readable format.
- Objection - object to processing based on legitimate interest.
To exercise any right, email support@nextscalp.com. We will respond within 30 days. You also have the right to lodge a complaint with your national supervisory authority.
7. Data transfers outside the EEA
Anthropic PBC is based in the United States. When you use AI features, your request content is sent to Anthropic's API for inference and is not retained by Anthropic beyond the duration of the request under their API terms. This transfer relies on Standard Contractual Clauses where applicable.
8. Children
NextScalp is not directed at individuals under 18 years of age. We do not knowingly collect data from minors. If you believe a minor has provided us data, contact us and we will delete it promptly.
9. Changes to this policy
We may update this policy as the product evolves. If changes are material, we will notify active users via the bot. The effective date at the top of this page reflects the most recent revision.
10. Contact
Email: support@nextscalp.com
Telegram:
@nextscalp_bot