The rails we operate on

What we are not

We are not a registered investment adviser, broker-dealer, commodity trading advisor, money transmitter, or custodian. You remain trader of record on your exchange.

Your choice

You choose your exchange and one of two paths. North Star: our software runs its strategy, which follows fixed rules that are the same for every account, and places the orders in your own exchange account. Build your own: you set the pair and settings, and our software places those orders in your own exchange account. We never recommend a pair. A silent change to your automation's settings would break this rail.

No custody — FinCEN / state money transmission

Funds never sit here. Exchange keys must be trade-only: a key is stored encrypted and goes live only after your exchange confirms it cannot withdraw or transfer, and we re-check that every 12 hours. Withdraw and transfer stay off. If we cannot move value, we are not transmitting money. Taking a withdraw key would collapse this rail.

Not advice — Advisers Act / CFTC

We do not tell you which asset to hold or which way to trade. North Star follows fixed rules that are the same for every account; choosing it, or building your own automation instead, is your decision. We do not publish performance figures as marketing.

Sanctions — OFAC

Signup records that you are 18 or older, not sanctioned, and not in a denied region. That is an attestation. It is not a live OFAC feed. A live screen is later work. We do not infer.

Advertising — FTC

No promised results. No fake testimonials. No AI that 'decides' for you. Fixed rules run the automation you chose.

Your data

Every member can download their data and erase their desk, and we do not sell personal data or share it for ads. Your data is stored on our servers in the United States. These are the controls we offer; they are not a certification under the EU GDPR, the California CCPA/CPRA, or any other privacy law. Questions: info@lumenbotfi.com.

Email and SMS — CAN-SPAM / TCPA

We email only what you ask for: sign-in links, verification, password resets, your signed agreement, and notices you opt into. No texts. We do not send unsolicited financial advice.

One person, one desk

No customer subusers. Support staff can view your desk read-only to help you; they can't trade or change anything.

Your data

We keep only what the desk needs. We do not sell or share personal data for ads. Exchange keys are stored encrypted and go live only after your exchange confirms withdraw is off. Export and erase are yours. We never recommend a pair.

What this desk holds

• Account. Email, password hash, region attestation, 18+ attestation, and your 2FA (TOTP) secret if you turn 2FA on.
• Session. Session id, last seen, optional IP. A session ends after 8 hours without activity (operators and the master login: 12 hours) and after 30 days at most. Up to 5 devices stay signed in at once (operators and the master login: 24); a new sign-in beyond that signs out the oldest.
• Venue link. Exchange name, API key name, whitelist label, and the API key, secret, and passphrase (if your exchange uses one) — stored encrypted at rest, never displayed, and deleted when you erase your desk — plus a one-way fingerprint of the key. A key goes live only after your exchange confirms it cannot withdraw or transfer.
• Your automations. Whether you chose North Star, and the pair and settings of any automation you build. We never pick a pair for you.
• Records. Your automations, settings, fills, journal, and support tickets are kept while your account is open. When you erase it, everything that identifies you is deleted and your trading history is de-identified — kept without your name or email (order numbers — the exchange's and ours — stay on those records). Security and audit records are kept 90 days and activity events 30 days, then removed automatically — except records of live trading actions (orders, fills, and live on/off changes), which are kept permanently as the record of what happened with real money. Our copies of emails and alerts are removed 14 days after they are sent; any not yet delivered are kept until they are.
• Where it is stored. On our servers in the United States (Hetzner, Ashburn, Virginia). Service providers that handle some of it: Hetzner (hosting), Microsoft 365 (sending our emails), Stripe (payments), Supabase (our trading-records database, in the US — de-identified shorts trading records), Telegram (alert messages, only if you link it), and Google Analytics (public-page visits, only if you allow it).

What this desk never holds

• Live use of any key that can withdraw or transfer (we check every 12 hours)
• Seed phrases or exchange passwords
• Card numbers or bank accounts
• A live OFAC list (signup is an attestation we record)
• Advertising identifiers or sale of personal data

Your rights

• Access / portability. Download your data as Excel or JSON: automations, orders, fills, shorts, support messages, sign-ins, agreement details, North Star records, and audit.
• Erase. Erase your desk from Your data: we delete your account and everything that identifies you — sign-ins, exchange keys, support messages, notes, and signed-agreement details. Your trading history (automations, orders, fills, shorts) is de-identified — kept without your name or email (order numbers — the exchange's and ours — stay on those records) — and used to research and improve our strategies. Erase is refused while live trading is on, live positions or orders are open, or recent live activity is still settling (about 10 minutes), and while your subscription is active or can't be confirmed as cancelled — cancel it in Billing first, or contact support.
• Correct. Change your email or password on your desk. For anything else, email info@lumenbotfi.com.
• Sessions. See your signed-in devices, sign out the others, or sign out anytime.
• Do not sell or share. We do not sell personal data and do not share it for cross-context behavioral advertising.
• Questions and requests. Email info@lumenbotfi.com about your data. We run no paid ads.

Essential cookies keep you signed in and protect your forms (session, pending 2FA, and CSRF). We use Google Analytics to understand site visits on our public pages; it loads only if you accept it in the cookie notice, and you can opt out there. Analytics never runs on your desk. No advertising pixels. No sale of personal information. No share for cross-context ads.

Data request: info@lumenbotfi.com · Your data on the desk · Do not sell or share

Risk

Trading cryptocurrency involves substantial risk of loss and is not suitable for every investor. Past performance is not indicative of future results. Paper is paper. Live is live. We do not publish performance figures as marketing.

What enrolling in North Star means

Desk signup is not North Star. North Star is a separate enrollment. After you enroll, our software runs the North Star strategy, which follows fixed rules that are the same for every account, on your trade-only exchange account. You do not approve each fill. Withdraw stays off. Exchange keys are stored encrypted and go live only after your exchange confirms withdraw is off. Everything starts in paper (practice) mode; live starts only when you press Start yourself, after your key is cleared for live.