PRIVACY POLICY

Last Updated: November 2026

1. OVERVIEW AND DATA CONTROLLER

Sweep Funding ("we," "us," or "our") respects your privacy and is committed to protecting your personal data in compliance with the General Data Protection Regulation (EU) 2016/679 ("GDPR") and applicable international data protection laws. This Privacy Policy explains how we collect, process, store, and safeguard personal information when you visit our website or use our simulated trading evaluation Services.

2. CATEGORIES OF PERSONAL DATA WE COLLECT

We collect and process only the personal data strictly necessary to operate our platform, prevent fraud, and fulfill contractual obligations:

  1. Account & Registration Data: Full legal name, email address, username, password hash, country of residence, and Discord/social handles voluntarily provided for community rewards.
  2. Billing & Transaction Data: Purchase history, selected program configurations, discount/affiliate codes used, transaction IDs, and partial payment method metadata. (Note: Full credit/debit card numbers are processed directly by PCI-DSS compliant payment processors and are never stored on Sweep Funding servers).
  3. KYC/AML Compliance Data: When you qualify for a Funded Simulation Account or request a Performance Reward, our authorized KYC verification partner collects your government-issued ID, selfie/liveness check, date of birth, residential address, and sanctions-screening results.
  4. Simulated Trading & Technical Telemetry: Platform login IDs (cTrader, Match-Trader, DXtrade), simulated order logs, IP addresses, device fingerprints, browser type, and session timestamps used to monitor risk compliance and detect prohibited practices (such as account sharing or latency arbitrage).

3. LEGAL BASES AND PURPOSES OF PROCESSING

Under GDPR Article 6, we process your personal data under the following legal bases:

  • Performance of a Contract (Art. 6(1)(b)): To provision your simulated trading credentials, track evaluation metrics, process purchases, and disburse Performance Rewards.
  • Legal & Regulatory Compliance (Art. 6(1)(c)): To conduct mandatory AML/CTF and sanctions screening, maintain accounting records, and respond to lawful requests from competent authorities.
  • Legitimate Interests (Art. 6(1)(f)): To detect fraud, prevent chargebacks, enforce anti-arbitrage/account-sharing rules, secure our IT infrastructure, and improve platform performance.
  • Consent (Art. 6(1)(a)): For optional marketing communications, promotional newsletters, and non-essential analytics cookies (which you may withdraw at any time).

4. DATA SHARING AND THIRD-PARTY PROCESSORS

We never sell, rent, or trade your personal data to third-party data brokers. We share personal data strictly with trusted infrastructure and compliance sub-processors bound by Data Processing Agreements (DPAs):

  • Prop-Tech & Trading Infrastructure Providers: To provision and synchronize simulated accounts on cTrader, Match-Trader, and DXtrade.
  • Payment & Payout Processors: To process evaluation fees and disburse approved Performance Rewards.
  • KYC/AML Identity Verification Providers: To verify user identity and screen against global sanctions lists.
  • Cloud Hosting & Security Services: To host our web application, prevent DDoS attacks, and maintain encrypted backups.

5. INTERNATIONAL DATA TRANSFERS

Where personal data is transferred outside the European Economic Area (EEA) or the United Kingdom to our technology or verification partners, we ensure appropriate safeguards are in place, including European Commission Standard Contractual Clauses (SCCs) or adequacy decisions.

6. DATA RETENTION

We retain personal data only as long as necessary for the purposes outlined in this Policy:

  • Account and simulated trading records are retained for the duration of your active relationship plus up to five (5) years to defend against legal claims or chargeback disputes.
  • Financial, invoicing, and KYC/AML compliance records are retained for the statutory period required by applicable tax and anti-money laundering laws (typically 5 to 10 years).

7. YOUR PRIVACY RIGHTS (GDPR & GLOBAL USERS)

Subject to statutory exceptions, you have the right to:

  • Access: Request a copy of the personal data we hold about you.
  • Rectification: Request correction of inaccurate or incomplete personal information.
  • Erasure ("Right to be Forgotten"): Request deletion of your personal data where no overriding legal or compliance retention obligation applies.
  • Restriction & Objection: Object to processing based on legitimate interests or request restricted processing.
  • Data Portability: Receive your registration data in a structured, machine-readable format.

To exercise any of these rights, contact our Data Protection contact at support@sweepfunding.com. We respond to all verified requests within 30 days.

8. COOKIES AND SECURITY MEASURES

We implement industry-standard technical and organizational security measures, including TLS/SSL encryption in transit, encrypted databases, role-based access controls, and continuous anomaly monitoring. Our website uses essential session cookies required for dashboard authentication and optional analytics cookies to optimize user experience.

9. CURRENT PRE-LAUNCH WEBSITE: VISITOR ANALYTICS AND EXTERNAL SERVICES

This section describes the current public pre-launch website separately from the account, payment, identity-verification, and trading services described above. The current website does not offer account sign-in, payment processing, or identity verification, and does not set authentication or analytics cookies. It does not save a cookie choice in your browser or display a cookie-consent banner.

Visitor analytics

Lovable's visitor analytics records clicks on buttons and links for every visitor. Page visits, time on page, page speed, and errors are also recorded for every visitor, without cookies and without identifying anyone.

It records the pages visited, where visitors came from, their country, browser, operating system and device type, how long they stay, how fast pages load, errors, and clicks on buttons and links. It uses no cookies, stores nothing on the visitor's device, does not keep IP addresses, and does not identify visitors. Detailed data is kept for 90 days and daily summaries for a year.

Lovable collects this data for us. Lovable's privacy policy explains how it handles it.

Google Fonts

This website loads its fonts from Google Fonts. Your browser sends Google the font requests, including your IP address and request headers such as browser information and the referring website. Font files may be stored in your browser's cache. Google receives these requests; this font integration does not set cookies. Google's privacy policy explains how Google handles this information.

Discord and social links

Discord and Instagram are external links, not embedded content. Clicking a link takes you to that provider, which receives your connection information and may use its own cookies or storage under its own privacy policy. These services are not loaded as embedded widgets on this website.