Version: 2026-07-24 Last updated: [date]

This Privacy Policy explains how [PAKD Indonesia legal entity name] ("PAKD," "we," "us") collects, uses, and protects personal data when you use Winx VIP (the "Service").

1. Data We Collect

You provide directly:

Full name, email address, phone number, and password (stored as a irreversible hash, never in plain text) when you register.
Your Reku exchange API key and secret, if and when you choose to connect an exchange account. These are encrypted at rest before storage and are never displayed back to you in full — only a masked form (e.g. ••••1234) is shown in the app.
Any information you submit through support requests or communications with us.

Collected automatically:

Session metadata: IP address and user-agent string, recorded against your login sessions for security purposes (e.g. detecting suspicious access).
Usage and trading data generated by your use of the Service: which Bots you subscribe to, their configuration, and the resulting trade/execution history, balances, and performance figures as read from your connected Reku account.

We do not collect biometric data, and the Service does not request access to your device's camera, contacts, or location.

2. How We Use Your Data

To create and manage your account, and authenticate you.
To operate the Service: executing your selected Bots via your connected Reku API key, and showing you your resulting balances, positions, and performance.
To calculate and, where applicable, collect the performance fee described in the Terms of Service.
To secure the Service: detecting fraud, abuse, or unauthorized access, and enforcing our Terms of Service.
To communicate with you about your account, security notices, or changes to our policies.
To comply with legal obligations we are subject to.

We do not sell your personal data, and we do not use your trading data or exchange credentials for any purpose beyond operating the Service for you.

3. Who We Share Data With

Reku (the exchange): we do not "share" your data with Reku in the usual sense — rather, we use the API key you generated and granted us to act on your instructions on Reku's platform, exactly as you would if you used Reku directly. Reku's own privacy practices govern how it handles data on its side; see Reku's own privacy policy.
Infrastructure and hosting providers that run the servers and database behind the Service, under confidentiality obligations, solely to provide the Service to you.
Legal and regulatory disclosures, where required by applicable law, regulation, court order, or governmental request.

We do not share your data with advertisers or data brokers, and we do not currently use third-party analytics or advertising trackers on the Service. [Confirm and update this section if that changes, or if any analytics tool is added.]

4. How We Protect Your Data

Passwords are stored as salted, irreversible hashes — never in plain text.
Reku API keys and secrets are encrypted at rest using envelope encryption; even with database access, they cannot be read without the separately managed encryption key.
All traffic between your device and the Service is encrypted in transit (HTTPS/TLS).
Access to production systems and data is restricted to personnel who need it to operate the Service.

No system is perfectly secure, and we cannot guarantee absolute security. See the Risk Disclosure for how this relates to trading risk specifically.

5. Data Retention

We retain your account and trading data for as long as your account is active, and for a reasonable period afterward to comply with legal, accounting, or dispute-resolution obligations. If you delete your account, we will delete or anonymize personal data that we are not otherwise required to retain. [Confirm a specific retention period once decided, e.g. "X years after account closure."]

6. Your Rights

Subject to applicable law (including Indonesia's Personal Data Protection Law), you may:

request access to the personal data we hold about you;
request correction of inaccurate data;
request deletion of your data, subject to our legal retention obligations;
disconnect your Reku account at any time, immediately revoking the Service's ability to act on it; and
request a copy of your data in a portable format.

To exercise these rights, contact us at [support email].

7. International Data Transfers

Our infrastructure may be hosted in a jurisdiction other than your own. Where that is the case, we take reasonable steps to ensure your data continues to receive an appropriate level of protection consistent with this Policy.

8. Children's Privacy

The Service is not directed at, and is not intended for use by, anyone under 18. We do not knowingly collect personal data from minors. If you believe a minor has provided us data, contact us so we can remove it.

9. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes take effect for a version identified by an updated version date, and where required we will ask you to re-accept the current version.

10. Contact

Questions about this Privacy Policy or your data: [support email] · [registered business address, if required].