Privacy Policy

1. Data controller

The controller of the personal data described in this policy is the owner of the AR4 Mercados brand, which operates the virtual commercial establishment ar4mercados.com. For any privacy matter you can contact us from the contact page or by email at contacto@ar4mercados.com. If your matter is a claim or a complaint as a consumer, you also have the Complaints Book.

Which law applies to us. The Site is operated from Peru and is governed by Law No. 29733, the Personal Data Protection Law, and by its Regulation, approved by Supreme Decree No. 016-2024-JUS, published on November 30, 2024 and in force since March 30, 2025 (it came into force 120 calendar days after its publication and replaced the previous regulation, S.D. No. 003-2013-JUS). The authority that oversees compliance is the National Authority for Personal Data Protection, which the Law assigns to the Ministry of Justice and Human Rights (article 32 of the Law). You can read the Law in the text published by the Peruvian State and the Regulation in the official edition of El Peruano. Throughout this document we cite the specific article that supports each thing we say, so you do not have to take our word for it.

If you live outside Peru. A good share of the people who use AR4 Mercados are in Mexico, Colombia, Chile, Argentina, Ecuador or Bolivia. This policy was written on the basis of Peruvian law because it is the law that binds us, but the rights described in section 7 —to know what data we hold, to correct it, to delete it and to object— also exist in the law of your country, and we recognize them for you wherever you come from. If your local law gives you something more than what appears here, yours prevails: we do not ask you to waive anything.

This is not legal advice. This document explains what we do with your data, in plain language and with the law cited. It is not a legal opinion and it does not replace a lawyer's opinion, neither ours nor yours.

2. What data we collect and why

• Account data — email address and password (encrypted, managed by Netlify Identity). Purpose: to give you access to your account, the Community and Premium.
• USDT exchange booking — if you leave a booking on the exchange page, we store: your email, which is not confirmed with a code: you type it twice and you are responsible for typing it correctly, because that is where the details and notices of your booking reach you; your phone, verified with an SMS code; your name, the amount, the agreed price, the chosen payment method and the transaction reference. If you are the one selling USDT, we also store your bank, the last four digits of your account and the network you send through, and —only if you provide it so that we can check your transfer— the identifier of your transaction, the amount of USDT that arrived and when it arrived. That identifier is data that is already public on the blockchain itself, which anyone can look up; we store it so we can prove that we received your transfer and so that the same transfer cannot be submitted twice.
  
  Your payment receipt. To let us know you have already paid, you upload to your booking the photo or screenshot of your receipt: the one for your bank transfer if you buy USDT from us, or the one for your transfer if you sell it to us (in addition to the transaction identifier). We store the file, its type, its size and the time you uploaded it. Purpose: to verify your payment and prevent fraud —matching the holder, the time, the amount and the transaction number against what we see in our account or on the network— and to be able to prove the payment if there is a complaint later. Who sees it: only the person responsible for the service, from their private panel. It is kept in private Supabase storage, with a random file name and no public address; to view it, the panel requests a link that expires after 10 minutes. It does not travel in emails or notifications and we do not give it to anyone else. How long it is kept: the same as the booking, 90 days, and then it is deleted. Upload only the receipt: your balance or other transactions do not need to be visible. If when booking you give us the address you will send your USDT from, we store that address and the one the network itself shows as the sender of your transfer, to check that the USDT comes from you; both are public blockchain data and are deleted with the booking, after 90 days. From S/ 2.000 we also store the source of funds you declare and your declaration that you are trading on your own account. Purpose: to close the transaction, to be able to reconcile it later and to comply with the reasonable diligence expected of an exchange service.
  
  Your full account and your USDT address, only while the transaction lasts. To be able to transfer or send you what is yours without copy errors, we store your full CCI (if you sell to us) or your USDT address (if you buy from us) while the booking is open. They are deleted from the database as soon as the transaction is completed or cancelled and, if it remained open, after 7 days; from then on only the last four digits of the account and the network remain, and the full data remains only in the transaction email. We also store when you notify us that you have sent your payment, when we confirm that we received it and, if you buy from us, that we checked that the holder of the account that paid matches your name; and an irreversible fingerprint of the SMS code you used, so that code cannot be used for a second booking.
  
  Private do-not-trade list. If we decide not to trade again with an email, a phone, a USDT address or an account —because of a third-party payment, signs of fraud or abuse of the service—, we record it in an internal list with the reason. Only the person responsible for the service sees it, it is used only to reject new bookings with that data and it is kept while the reason remains valid; you can ask us to review it or to tell you whether you appear on it (section 7). To know whether a booking is your first transaction with us we check your completed bookings, which are deleted after 90 days like the rest.
  
  What we do NOT store in our database: your full CCI or the USDT address where you receive, once the transaction is closed (the address you send to us from, yes, as explained above). Nor do we store copies of your identity document or your selfie: when you verify your identity, those images are processed by Didit and we only store the result (section 3.1). And we do not store your IP address: we store a code derived from it, which is used only to curb abusive use of the form and does not allow the original address to be recovered.
  
  If you have an AR4 account and you verify your phone in a booking, that number is saved in your profile so we do not ask you for a code again next time. You can ask us to delete it whenever you want (section 7), and it is deleted with your account.
  
  Retention periods: the booking is deleted after 90 days; verification codes are stored one-way encrypted —the code cannot be read from what is stored— and are deleted the next day. SMS codes are sent by Twilio and emails by Resend, each under its own terms (section 5).
  
  WhatsApp, only after paying. Before paying, you talk to us from your own booking («Track your booking») or by replying to its email. We give you the service's WhatsApp number only after you have paid and uploaded your receipt (or the identifier of your transfer); if you write to us there, we receive your number and what you send us, under WhatsApp's (Meta) terms, and we only use it to handle your transaction.
  
  Today the whole exchange is done by booking with AR4. If /p2p were to link to a listing on Binance again, what you do inside that platform would be processed by it, under its own terms.
• Community profile — username, avatar, bio, trading style, posts, comments, reactions, followers and private messages. Purpose: to operate the social features you decide to use. Everything you post in the forum is publicly visible.
• Learning progress — completed modules and community points, linked to your profile. Purpose: your learning path, ranking and issuing of diplomas.
• Days you log in with your account — we store which days you visit the Site while logged in to your account: a single entry per day, with the day (Lima time), without the time. Nothing else: not the pages you view, not how many times you visit, not your IP address, not your device. Purpose: to measure how many people come back to the Community, in aggregate figures that only the person responsible for the Site sees. It is deleted when you delete your account (section 12) and, in any case, after 400 days.
• Watchlist and monitored levels — the instruments you add to your list and, if you use them, the prices at which you ask to be notified. Purpose: to show you your list on any device and to notify you when the price reaches that level. It is private data —it says what you are watching and at what price— and it is not shown to anyone else, unless you share it: if you tap «Share» on your list in Tools, we create a link with a random code and store that code linked to your account. Anyone with the link sees your instruments (their name and their symbol), as they are on your list at any given moment, and their price; never your username, your email, your levels or any other data of yours. You can stop sharing whenever you want from the same list: we delete the code and the link stops working in less than a minute. If you share again, the link is a different one. It is deleted when you delete your account (section 12).
• My AR4 (your personal dashboard) — /mi-ar4 brings together on a single screen data you already have in AR4: your chart list, your watchlist, your price alerts, your progress in the academy, your Community notifications and your credential. It stores nothing new about you and only you see it, while logged in. For the «My USDT exchange» card we look up the bookings from the last 30 days made with your account's email and, in addition, linked to it —through your identity verification done with this account or through the verified phone in your profile—, and we show you only their reference, whether it is a purchase or a sale and what step it is at: no amounts, no prices and no payment details, which remain behind «Track your booking». If you prefer not to see the summary at the top of the home page, the dashboard switch turns it off; that preference is stored only in your browser.
• Your morning summary (only if you turn it on) — the «Your summary for today» card in /mi-ar4 is calculated with the data from the previous point and stores nothing. If you also turn on the «Receive my summary every morning» switch (in My AR4 or in your profile), which is off by default, we store linked to your account: that you turned it on and when; a copy of the markets you follow (at most 12, only chart instruments, because the chart's «My list» lives in your browser); a copy of your email (your account's, taken from your session), only to find your USDT exchange booking with the same rule as the dashboard —made with that email and linked to your account—; and, for each day, whether the notification went out, was not needed or could not go out, and how many items it had. Purpose: to send you, Monday to Friday, around 7:30 (Lima time), a notification to your phone with today's calendar data that the market is watching in your instruments, the Flash headlines that mention them and whether your USDT exchange is still in progress, only if there is something that day. It contains no buy or sell signals or payment details, and since it is visible on a locked phone it does not include your booking reference. It counts within the cap of one notification per day: if you already received another notification of yours that day, the summary stays in My AR4. It is delivered by your browser's notification service (section 5). Basis: your consent (section 4). How to turn it off: with the same switch, whenever you want; at that moment we stop sending it and delete the copy of your email and of your markets, and only the sign-up and opt-out dates remain. Each day's record is deleted automatically after 30 days, and everything is deleted when you delete your account (section 12).
• X-ray of your history — the trade file you upload in /radiografia is read and analyzed only in your browser; it is not sent to AR4 or to third parties. If you analyze it with your free account, we store only your account identifier, how many X-rays you have used and the date of the first and the last one, to apply the 3-use limit. With Premium we store nothing. That record is deleted when you delete your account. The portfolios you build in the Portfolio lab are stored only in your browser: the server calculates the analysis and does not keep the portfolio.
• Chart practice sessions — if you save a practice session from the AR4 Chart, it is linked to your account so you can resume it later, together with your practice settings (practice balance, assumed costs and 20-trade challenges). The drawings and lines you make on the chart are stored in your own browser and, only if you are logged in, also a copy in your account, per instrument, so you can see them on another device. The same goes for your workspaces, your saved combinations and your chart settings templates: they live in your browser and, only if you are logged in, also a copy in your account to have them on any device; that copy contains only what you put on the chart (the name you gave them, markets, indicators, formulas and colors), no other data of yours. They are deleted when you delete your account. The analyses you share with a link travel inside the link itself and are not stored on our server.
• Community stories — if you publish a story, we store the image or video, the time, the reactions and who viewed it. The list of who viewed it is private to the author of the story, just as on other networks. Stories expire after 24 hours.
• Invitations (referral program) — if you arrive through another person's link, we store the link «this account invited you» by its internal identifier, only once. Purpose: to give the person who invited you their points and their raffle tickets, with a cap. It is used for nothing else.
• Chat usage counter — if you use Aria without Premium, each message leaves a zero-amount entry in your points ledger. Purpose: to count the free plan's daily cap on the server, where it cannot be bypassed. It records that there was a message and when, not what you wrote.
• Irreversible fingerprint of your email — the 100-point welcome bonus is paid only once per mailbox, and to be able to check this we store in a separate table a cryptographic fingerprint (SHA-256 hash) of your email, never the email. The address cannot be recovered from that fingerprint. Purpose: to prevent the same person from collecting the bonus over and over by creating and deleting accounts, which would drain the prize fund to the detriment of everyone else. It is the only use we give it: it is not used to identify you, nor for advertising, nor is it shared with anyone. Since the bonus is defined by the mailbox and not by the account, that fingerprint survives the deletion of your account (see exception (c) in section 9).
• Name for diplomas — the real first and last names you confirm when issuing your first diploma are stored securely in your account. Purpose: to print it on your diploma and validate its authenticity. It is not public: other users only see your username, and the public verification shows the name partially hidden (initials). It is confirmed only once; to correct a genuine error, write to us.
• Copy of your identity document — we ask you for the image of a valid official document (DNI or passport) only if you win a major prize and only to deliver it, and where applicable a short confirmation video call. Purpose: to check that the prize reaches the person who won it and that there are no multiple accounts. It is deleted after delivery. All the details —channel, partners, deadlines— are in section 3. It is different from the document number recorded in the Complaints Book form (next point): no image is uploaded there.
• Complaints Book form — if you register a claim or a complaint in the Complaints Book, we collect the data its Regulation requires (S.D. No. 011-2011-PCM): first and last names, document type and number, address and email (mandatory), phone and country of residence (optional), what you contracted and —if you wish to state them— the amount claimed, the payment method and the date of the event, plus the details of what happened, what you are requesting, and the code and the Lima date and time with which the form is registered. If the claimant is a minor, the law also requires the name and document of their father, mother or legal representative (see section 10). Purpose: to identify you as a consumer, handle the complaint and answer you within the deadline set by that law; it is not used for advertising or for anything else. There we do not ask you for passwords, card numbers or copies of documents. The form reaches Netlify's private forms inbox (section 5), it is not published anywhere, and it is kept for the period the Regulation requires even if you do not have an account on the Site (section 9). You can use the Book without being registered and without having paid anything.
• Payment data — if you subscribe to Premium or buy in the avatar store, your card is processed directly by Mercado Pago under its PCI-DSS standards. We only receive the payment confirmation and the subscription identifier, never your card number.
• Manual payment via Yape (Peru only) — if you choose this route instead of the card, when you tap «Ya yapeé — confirmar por correo» an email addressed to contacto@ar4mercados.com opens, the mailbox on AR4's own domain, in which you write us the transaction number, the date and time and the amount of the payment, the email you signed up with, and you attach the screenshot of your payment. With that we also receive the email address you are writing from and the data the screenshot itself shows (account holder's name, amount, transaction number and date). Purpose: to check that payment and activate Premium manually on your account, since there is no automatic confirmation. The transfer is processed by Yape, under its own terms. Through that channel we will never ask you for your password or verification codes (see section 3). You can ask us to delete the screenshot and the emails by exercising the rights in section 7.
• Conversations with the AI — the messages you send to Aria or to the Copilot are transmitted to the AI provider (Anthropic) to generate the answer, in accordance with its API terms. We do not use them for advertising and we do not sell them. We do not store the text of those conversations in our database: the thread is stored in your own browser's local storage —so it is not lost if you close the window— and the only thing that remains on our server is the usage counter from the previous point and, if you rate an answer as helpful or not helpful, that rating: the yes or the no, the reason if you write one (up to 280 characters, without emails, phones or links), the plan, the page type and the date, without the conversation, without your profile and without your IP address. So that the answer is accurate, public data from the site itself travels to Anthropic along with your message (the profile, module or article you are viewing, the date and the result of Aria's tools, such as a price or a risk calculation); to look up a price, the server only sends the asset's symbol to its data provider. If you want to delete it, clear the site data in your browser; logging out also removes the history stored on that device.
• Talking to Aria by voice — if you use the microphone in Aria's chat, your voice does not reach AR4: it is converted to text by your phone's or your browser's system (on Android, usually Google's services; on iPhone, Apple), under their own privacy terms, and only that text reaches us, which is treated the same as a written message (previous point). The microphone only listens when you tap it and turns off by itself when you finish your sentence: there is no continuous listening or wake word. The answers Aria reads aloud are produced by your own device's voice. To give you the time and the calendar of your country, Aria infers it from your device's time zone (or uses the one you choose in the chat): that country code travels with your message and is not stored in our database; your choice stays only in your browser. If one day we turn on a voice generated on a server, we will say so here before using it.
• Contact and suggestions forms — on the contact page we ask you for name and email (in the contact form) or only your message and, if you want us to answer you, your email (in the suggestions form). Purpose: to read and answer what you write to us. It reaches Netlify's private forms inbox (section 5) and is not published anywhere.
• Usage and technical data — pages visited and aggregate metrics through Cloudflare Web Analytics, which does not use cookies or create individual profiles and therefore always runs. Separately, measurement with Google Analytics 4 (which pages you browse and where you came from) and with the Google Ads tag (whether an ad of ours worked) is only activated if you accept it (see section 6). In the AR4 Chart, if you accepted measurement, which instrument and which timeframe are viewed is recorded anonymously —without your name or your account— to know what is really used, and the same in the Tools and in the market Copilot: which calculator was used and on which instrument, never the numbers you type into them (not your capital, not your win rate, not your trades). IP addresses are processed by the infrastructure (Netlify, Cloudflare, Supabase) to serve the page, balance the load and defend against attacks; we do not keep our own record of IP addresses linked to your account, nor do we store any IP address in clear. The only exception, and we explain it in full because we think it is better understood stated than hidden: so that you can try Aria's chat without creating an account we need to count how many messages you have sent, and someone without an account has nothing to count against. For that we store an irreversible digest of your IP address (SHA-256 with a secret key known only to our server, from which the original address cannot be recovered) together with a random identifier that your browser stores on your own device. They are not linked to any account or to your name, they are not used to measure you or for advertising, and they are deleted automatically after two days; only an aggregate count per day remains, with nothing that would allow anyone to be identified. If you create your account, this no longer applies: from then on the limit is counted against your profile.
• Local preferences — settings such as the closed welcome guide or the last section visited are stored in your own browser (localStorage) and do not leave your device. The only entry on that list that does travel to our server is ar4Visitante: a random number, with no data of yours inside, which is created only if you try Aria's chat without an account and which serves so that the trial limit is yours and not your whole network's —on mobile, a great many people share the same IP address, and without it some people would use up others' trial—. You can delete it whenever you want by clearing the site data in your browser.
• Tools trading journal — if you are logged in to Tools, each trade you record (instrument, buy or sell, entry, exit, stop and target prices, the result, your emotional state and your note) is stored on our server linked to your account, so you can see it from any device and calculate your statistics. It is private: the server only delivers it to you. You can export it to CSV from the same page; there trades are not deleted one by one, but you can ask us to delete your journal from the contact page, and it is deleted entirely when you delete your account (section 12).
• Community Trader journal — if you use the «Journal» tab in the Community, we store each entry you record: the date, the asset, whether it was a buy or a sell, whether it was on a demo account, in practice or on a real account, the entry, stop and target prices if you write them, the risk and the result measured in R (your unit of risk), whether you followed your plan, the emotions you mark before and after, the mistakes you tag, your note and, if you link it, one of your readings from the Forum. The money amount and its currency are optional. Purpose: for you to review your process; the statistics, the weekly review and the suggested readings are calculated in your browser with your own entries. It is private: the server only delivers your entries to you, with your session, and no screen on the Site shows them to another person —not to the moderation team nor on your public profile either—. The money amount never leaves your journal, except in the CSV file that you download. Recording entries does not give points or send you notifications. Like the rest of the database (section 8), it is within the technical reach of the person responsible for the Site.
  
  The case studies you decide to share. Only if you tap «Share as case study» is a copy of a closed entry published, with a closed list of data: the asset, whether it was a buy or a sell, the date, the risk and the result in R, whether you followed your plan and the lesson you write at that moment. Never the amount, the prices, your private note, your emotions or the linked reading. You choose whether it is signed with your username or as anonymous: if it is anonymous, neither other users nor the team's moderators see who wrote it; only the person responsible for the Site sees it, to be able to act if it breaks the rules. The list of cases is public: it can be seen without an account. The lesson first goes through the automatic content review (section 14). If someone reports a case, we store who reported it and why; the case goes to the moderation queue, and with three reports from different people it is automatically hidden until a person on the team decides. If a case of yours is hidden, you receive a moderation notice. Each decision is kept in the moderation log with a copy of the case and its lesson (section 9).
  
  How long it is kept, how you export it and how you delete it. Your entries are kept while you have an account or until you delete them yourself: you can delete any entry at any time and, if it was shared, its case is withdrawn with it; you can also withdraw a case without deleting the entry. The «Export CSV» button downloads your entries —up to the 1.000 most recent— with the full note and the amount. When you delete your account, your entries, your shared cases (with the reports they received) and the reports you made on other people's cases are deleted (section 12).
  
  Import from the Tools journal. Only if you tap «Import from the Tools journal» are your trades from that journal copied to this one, with your session and only yours. That journal does not change: it keeps its trades and its points. The copies are entries in this journal like any other (they are edited, deleted and exported the same way), and their note indicates where they come from.
• Prop firm payout log — if you record, from Prop firms or from a firm's profile, a payout that a funded account paid you, we store linked to your account: the firm, the date, the range of the amount (never the exact figure), the days it took since you requested it and the payment method. If you were paid in USDT and you give us the transaction identifier (TxID) and the address where you received it, our server uses them at that moment to check the transfer on the blockchain (section 5) and does not store them: it stores only irreversible cryptographic fingerprints (HMAC-SHA256 with a server key) of the TxID, of that address and of the address that sent the payment, so that the same payout is not recorded twice and to detect repeated or doubtful records; we also store whether the payout was verified or why not, and the day of the transfer according to the chain, without the time. If you report a payout that a firm denied you, we store the firm, the date, the range and what you write (up to 500 characters). What is published: only aggregate figures per firm —the median days to get paid, how many verified payouts there are, the period in months and the payment methods— and only when a firm has at least 5 verified payouts; never your name, your username, your address, your TxID or your amount. Reports of denied payouts are not published: only the person responsible for the Site sees them. Basis: your consent, which you give by ticking the form's checkbox. How long it is kept: you can delete any of your records yourself, whenever you want, from the same form; they are all deleted when you delete your account (section 12), and unverified records, those removed by moderation and reports of denied payouts are deleted automatically after 24 months.
• Digital credentials (Open Badges) — when you request the credential for an academy diploma or the AR4 readings Credential in Open Badges format, the Site generates it at that moment with data that is already public in the certificate verification and on your public readings page: for a diploma, the program, the issue date, the final grade and the certificate code; for the readings one, how many readings were judged against the real price, how many for and against, the percentage, the periods it counts and the reference of the AI Partners. It identifies you only with your public username (the link to your /t/usuario page) or, if you do not have a username, only with the certificate code: never with your real name or your email, not even with the initials shown by the diploma verification. When AR4's digital signature is turned on, the credential is signed so that anyone can check that no one altered it; if it is not, the credential itself says so. It is public by design: anyone who has the link, the file or the code —and, for the readings one, anyone who knows your username— can view it and verify it at /verificar-credencial or from other sites. We do not keep a copy of each credential generated or of what is pasted into the verification page. If you delete your account, your certificates leave the registry and your username is anonymized, so verification against our registry will stop confirming it; what we cannot do is delete the files you already downloaded or shared, and their signature will remain technically valid.
• Push notifications — if you turn them on, we store the technical address your browser generates to receive them, their encryption keys and the browser identifier. They are used only to send you notifications; when you turn them off we stop using them.
• USDT exchange price alerts — if in /p2p you create with your account an alert «Notify me when the price reaches X», we store linked to your account: whether you want to buy or sell USDT, the figure you chose, when you created it and when it expires, and how you want to be notified. If you choose email, we store a copy of your account's email (the one from your session, not one you type); if you choose the notification on your device, that device's technical address, and the alert only goes out if that device is still linked to your account. When the alert goes out we store when, at what price and whether it could be delivered. Purpose: to notify you only once when AR4's published price reaches your figure; it is not used for advertising or for anything else. The alert states the price, your figure and that the price may change, without any data of yours, because a notification is visible on a locked phone. The person responsible for the Site only sees aggregate figures (how many alerts are active on each side and the median figure), never who created them. They are delivered by the email service (Resend) or by your browser's notification service (section 5). Basis: your request, which you make when creating the alert, and which you can withdraw by cancelling it. How long it is kept: each alert lasts 30 days; you can cancel it earlier from the same page, and the row is deleted automatically 30 days after it expires (at most 60 days from when you created it). All of them are deleted when you delete your account (section 12).
• Chart price alerts — if in /grafico you create with your account an alert that reaches you as a notification even if you close the page («notify me when gold crosses above…», «when it moves 5 %»), we store linked to your account: the instrument, the type of alert, the level you chose, the price of that instrument when you created it (to know where it is measured from), when you created it and when it expires, up to which minute we have checked it, and the technical address of the device where you created it; the alert only goes out if that device is still linked to your account. We do not store your email for this. When it goes out we store when, at what price and whether it could be delivered. Purpose: to notify you only once when the price reaches your level; it is not used for advertising or for anything else, and no one on the team sees which alerts each person has. The alert states the instrument, the level, the price, the time and the source, without any data of yours, because a notification is visible on a locked phone. It is delivered by your browser's notification service (section 5). The alerts you choose «on this page» and your chart watchlist do not reach our servers: they are stored only in your browser. Basis: your request, which you make when creating the alert, and which you can withdraw by cancelling it. How long it is kept: each alert lasts 30 days; you can cancel it earlier from the same page, and the row is deleted automatically 30 days after it expires (at most 60 days from when you created it). All of them are deleted when you delete your account (section 12).
• Weekly Community summary by email (only if you request it) — if you tick in your profile the «Receive the weekly community summary by email» checkbox, which is unticked by default, we store a copy of your email (your account's, taken from your session; if you change it, it is updated the next time you open your profile), when you turned it on and which version of this text you accepted, and the date of the last send. Purpose: to send you, at most once a week, a summary of how your readings and ideas did —measured against the real price, just as in the Forum—, the most useful posts of the week, who got it right and the high-impact economic data for the following seven days. It is not used for advertising or for anything else, it is not shared with anyone except the service that delivers the email (Resend, section 5) and it is not sent to AI accounts or to suspended accounts. Basis: your consent (section 4). How to unsubscribe: with the «Unsubscribe» link at the bottom of each email, which opens a page where you confirm the unsubscription with a button, without logging in; with the unsubscribe button your email client shows you, which does it in one click; or by unticking the checkbox in your profile. In all three cases we stop sending it at that moment and delete the copy of your email: we keep only the sign-up date and the opt-out date, without the address, as a record that you requested it and withdrew it. If you delete your account, that record is deleted too (section 12).
• Meta (Facebook) Pixel and Google tags — we use them to measure the effectiveness of our advertising. Three things are communicated to Meta and nothing more: your visit; if you create an account, that the sign-up was completed; and if you subscribe to Premium, that the purchase was completed along with its amount in soles (today S/ 105 the monthly plan and S/ 1.050 the annual one). Google (Analytics 4 and Ads) receives those same three, plus the anonymous usage events from the previous point: which tool or which chart instrument was viewed. Under no circumstances is your name, your email, your document or your card details sent. They are not loaded if you do not authorize it: until you accept, the browser does not even communicate with Meta or with Google Ads. You can accept or reject it in the notice that appears on your first visit, and change your mind whenever you want with the button Measurement preferences, which is also at the bottom of every page. If you reject it, we also delete any advertising cookies that had been stored.
• Automatic content review — forum posts, comments and messages, and the lesson of the case studies you share from your Trader journal, go through an automatic moderation filter that uses Anthropic's AI service to detect abuse. That text is sent solely for that purpose and is not used to train models.

3. Identity verification for prize delivery

If you win a major prize (a funded account, the US$ 100 to trade with, any cash prize or a direct points redemption), the prize program rules require us to check that you are a real person and that you are you. This is what that means for your data:

• What we ask you for — a valid official document (DNI or passport) whose name matches the real name registered in your account and which proves that you are over 18. A short confirmation video call may be added.
• When — only after the prize has been awarded, and solely for that prize. We do not ask for documents to sign up, to take part, to accumulate points or to spin the Wheel.
• What for — to prevent the same person from taking the prize with several accounts and to make sure it reaches whoever won it. It is used for nothing else: not advertising, not profiling, not verification for other services.
• Legal basis — the performance of the raffle rules you accepted when taking part, together with your consent. You can refuse and there is no penalty whatsoever, but without validation the prize is not delivered and is voided, as the rules state.
• How it travels — the redemption is coordinated by email, at the address published on the Prizes page, which is the mailbox on AR4's own domain (contacto@ar4mercados.com). That is the only channel: no one from AR4 will ask you for your document through the Community, by private message, by WhatsApp or on social media. If they ask you for it there, it is an impersonation attempt.
• The video call is not recorded — it serves to confirm you live. We do not keep video, audio or screenshots of that call.
• Who it is shared with — when the prize is delivered by a partner (a prop firm, or the broker where the funds are credited), we communicate the minimum data needed to open your account: name and email. We tell you which partner it is before delivery. We do not forward them the image of your document: if the partner needs to verify you on its own, it will do so with you directly and under its own policy. Those partners may be outside Peru, so that communication is an international data transfer.
• How long it is kept — the copy of the document is deleted as soon as the prize has been delivered and, at most, 30 days after delivery. Of the validation we keep only the record that it was done and its date, without the image. If the prize is ultimately not delivered, the copy is deleted when the case is closed.

You can ask us to delete that copy before that deadline, with the same rights as in section 7. That copy does not go into the Community database: it travels and is stored only in the email inbox of the channel indicated above, and is deleted from there. Since the partner that delivers the prize may be outside Peru, that communication of your name and your email is an international transfer; what that means is in section 11.

3.1 Identity verification in the USDT exchange

To exchange USDT we ask you to verify your identity only once, with your DNI (both sides) and a selfie, before your first transaction: without it we do not show you the payment details. You do it in the profile of your AR4 account, which is free and is created with your real name, the one on your DNI, and the verification is linked to that account. It is only for people over 18. If it remains under review, we use your email to notify you of the result. This is what that means for your data:

• What for — to prevent fraud in the exchange service: above all, someone paying with another person's money (someone else's account or a stolen one), which is the most common scam in person-to-person exchange. We check that the document is authentic, that the face in the selfie is the one on the document, that the name on the DNI is the one you wrote for the booking and that you are of legal age. It is used for nothing else: not advertising, not profiling, nor any other service on the Site.
• Who does it — Didit (Didit Identity Spain, S.L., headquartered in Barcelona, Spain), a provider specialized in identity verification that acts as a data processor on behalf of AR4 (section 5). The photos of your DNI and your selfie are taken and processed on Didit's page, not on ours.
• What data Didit processes — the images of both sides of your DNI, your selfie and the data read from the document. Didit keeps them according to its policy and the retention period configured in AR4's account; you can ask us at any time to request that Didit delete them (section 7).
• What we store — only the result (approved or not, and the reason), the full name on your DNI, your DNI number converted into an irreversible fingerprint (the number cannot be recovered from it) together with its last 3 digits to recognize it, whether you are of legal age (yes or no: we do not store your date of birth), the session identifier in Didit, your email, your verified phone, the AR4 account it is linked to (older verifications, done in an exchange without an account, are linked only to your email and your phone) and the dates of the verification and of your consent. No image reaches our database.
• Who sees the result — your data is seen only by the person responsible for the exchange service, who sees «DNI verified» with your name and the last 3 digits when handling your booking, to check that the transfer comes from an account in your name. The only thing visible publicly is this: if you verify your identity with your AR4 account, your public profile shows a gold «Identity verified» check. That check does not show your name, your DNI or your photo, and anyone who sees your profile can see it. In the Community you appear under your nickname: your real name is not published.
• Legal basis — your express consent, which you give by ticking the authorization checkbox before starting and which is recorded with its date. The image of your face is sensitive data under Law No. 29733 (biometric data, article 2, item 5), and that is why that consent is requested separately and is not assumed. You can refuse without any consequence for the rest of the Site: the only thing that happens is that we cannot carry out that USDT exchange with you.
• How long it lasts — the verification is done only once and does not expire: it is valid while you use the service. If you are already verified —in your profile, or earlier in an exchange with the same email and the same mobile number— you do not repeat it; if you verified yourself earlier without an account, you can keep trading without an account with that same email and that same mobile number. We keep the result while you use the service and delete it after 24 months without trading, or earlier if you ask us (section 7; if you delete it, you will be asked for it again in your next transaction). The verified name also remains in the booking, with the same retention periods as the booking (section 2). Verifications that are not completed are deleted after 30 days.
• Your half-finished booking, only in your browser — if you start a booking without being verified, what you already typed (the amount, your name, your email and your mobile number) is stored only in your browser, on this device, for up to about 24 hours, while you create your account and get verified; it does not reach our database. When you finish, «Back to my exchange» resumes your booking and that data is deleted from the browser at that moment. You can also delete it yourself, by clearing this site's data in your browser.
• Minors — the exchange is only for people over 18. If the verification shows that you are a minor, the transaction is not carried out and we only record that you are not of legal age.
• International transfer — since Didit processes the data outside Peru, it is an international transfer based on your consent (section 11).

4. On what legal basis we process each piece of data

In short: in Peru the rule is consent, and there are only limited, specified exceptions. What we need to provide the service you requested does not require asking you for separate permission; everything else —advertising, above all— does, and you can withdraw it whenever you want.

Law No. 29733 starts from the principle of consent (article 5) and details it in its article 13.5: consent must be prior, informed, express and unequivocal; its Regulation adds that it must also be free. Article 14 of the Law lists the specified cases in which that consent is not needed. This is what we apply, processing by processing:

• Your account, the Community, the academy, the diplomas and the Premium subscription — basis: performance of the contractual relationship (article 14, item 5 of the Law: data necessary for the preparation, conclusion and performance of a contract to which you are a party). Without an email there is no account, without an account there is no Community, and without the real name there is no diploma in your name. We cannot «stop processing» this data and keep providing you the service: what you can do is close the account (section 12).
• Advertising and measurement (Meta pixel, Google Analytics 4 and Google Ads) — basis: your consent, requested before loading anything and withdrawable in one click from the button Measurement preferences. The Regulation expressly allows that consent to be given by clicking or tapping a button. Until you decide, those tags are not downloaded (section 6).
• Push notifications and emails you turn on — basis: your consent, which you give by accepting the browser permission and withdraw by turning them off. The weekly Community summary by email is one of them: you give it by ticking the checkbox in your profile, which is unticked by default, and you withdraw it from the link in the email itself or by unticking it; we stop sending it at that very moment, without waiting the ten days the Regulation allows. The morning summary too: you give it by turning on its switch, which is off by default, and you withdraw it by turning it off.
• Identity verification in the USDT exchange (DNI and selfie with Didit) — basis: your express consent, which you give by ticking a separate checkbox before starting and which is recorded with its date. It is needed because the image of the face is sensitive data (article 2, item 5 of the Law). You can refuse: without the verification we cannot carry out that exchange with you, and nothing else changes (section 3.1).
• Identity validation to deliver a prize — basis: performance of the raffle rules you accepted when taking part, together with your consent for that specific delivery. You can refuse without penalty: what happens is that the prize is not delivered and is voided (section 3).
• Complaints Book form — basis: legal mandate. Article 150 of the Consumer Protection and Defense Code (Law No. 29571) provides that commercial establishments must have a Complaints Book, in physical or virtual form, and its Regulation (S.D. No. 011-2011-PCM) sets what data the form must contain and in what format. AR4 Mercados offers it in virtual form. We cannot cut down that list of data or stop keeping the form.
• Payment records — basis: legal mandate as well, this time tax-related: a receipt is not deleted on request because it must be kept for the tax administration.
• Site security and abuse prevention — here we do not invent a basis: what we do is process the same data you already gave us for the service (your account, your posts) and apply security measures, which is an obligation of ours, not a license to collect more (articles 9 and 16 of the Law). Audience statistics are looked at in aggregate form; article 14, item 8, allows processing data to which a dissociation or anonymization procedure has been applied.
• Prop firm payout log — basis: your consent, which you give by ticking the form's checkbox before submitting. You withdraw it by deleting your records from the same form (section 2).
• Cryptographic fingerprint of the email for the welcome bonus — basis: performance of the contract, in its points program part: the bonus is offered «once per mailbox» and without that fingerprint that condition cannot be met. It is not your email and does not allow it to be recovered (sections 2 and 9).

Withdrawing consent. Where the basis is your consent, you can withdraw it at any time, without justifying yourself and without it costing you more than giving it: article 13.7 of the Law says so. The Regulation also requires us to offer an accessible, unconditional, simple, quick and free means to make it effective, and to adapt the processing to that decision within a period that cannot exceed ten (10) days. Withdrawing it does not make what was processed before unlawful, and it does not affect what we need to keep your account open.

Advertising: the «no» is special. If what you want is for your data not to be used for advertising or commercial prospecting purposes, the Regulation requires us to give you a simple and free means and to address it within a maximum of ten (10) days, and for refusing not to be more complicated than having accepted. Here that is one click on «Measurement preferences».

5. Who we share data with

In short: we do not sell your data. It is handled only by the companies needed for the Site to work, each with a specific job and none with permission to use it for its own purposes.

We do not sell or rent your personal data. The Law calls a data processor (article 2, item 7) anyone who processes personal data on behalf of another, and that is the role of all the providers in the list below: they work for us, not for themselves. Two consequences that the Law sets down and that bind us: article 30 prohibits those services from using the data for a purpose different from the one stated in the contract, and also from transferring it to others; and article 18 provides that, if we add a processor after you gave us your consent, its actions are under our responsibility and we must inform you of it. We assume that responsibility for the whole list, whether added before or after: if one of them does something wrong with your data, the one who answers to you is us; we are not going to send you off to argue with a provider. This is the complete list, with what each one does:

• Netlify — hosting of the Site, server functions, identity management (accounts) and the private forms inbox where the contact form and the Complaints Book form arrive. Only the person responsible for the Site has access.
• Supabase — database where the Community profiles, posts, messages, learning progress and the two trading journals live, and the private storage for the USDT exchange receipts.
• Mercado Pago — processing of payments and subscriptions.
• Resend — delivery of the Site's own emails: the welcome one, the ones for USDT exchange bookings, the notice to whoever wins a prize and, if you turn it on, the weekly Community summary. It receives your address and the content of each email, only to deliver it.
• Twilio — sending of the SMS verification codes for USDT exchange bookings. It receives your phone number and the code, only to deliver it.
• Didit (Didit Identity Spain, S.L., Spain) — identity verification for the USDT exchange, which is done only once: it receives the images of your DNI and your selfie, and returns to us the result, the name on the document, its number (of which we store only a fingerprint and the last 3 digits) and whether you are of legal age (section 3.1).
• Yape — only if you choose manual payment via Yape: the transfer is processed by Yape, under its own privacy policy, and the confirmation (your payment details, your email and your screenshot) reaches us by email at contacto@ar4mercados.com. If you pay by card, it is not involved.
• WhatsApp (Meta) — only in the USDT exchange, if after paying you write to us at the service's number (section 2), under its own privacy policy.
• Anthropic — processing of the messages you send to the AI assistants and generation of editorial content.
• TronGrid and public BNB Smart Chain nodes — to check a USDT transfer (in the USDT exchange and in the prop firm payout log), our server queries these public blockchain services. They receive the transaction identifier and, on the TRON network, the address that received the transfer: data that is already public on the chain itself. They do not receive your name, your email or your device's IP, because the query is made by the server.
• Cloudflare — aggregate audience analytics (without cookies and without individual profiles) and infrastructure protection.
• Google — campaign measurement (Google Ads) and browsing statistics (Google Analytics 4), only if you accept (section 6). The fonts the Site is displayed with are served from our own domain: your browser does not request them from Google.
• Meta — the Facebook pixel, also only if you accept (and, separately, WhatsApp in the USDT exchange after paying, already described above).
• TradingView — some charts embedded in News, Ideas and Tools are theirs: when they load, your browser communicates with their servers in accordance with TradingView's policy.
• Binance, Bybit, OKX, Coinbase and Kraken — in the AR4 Chart, cryptocurrency candles and volume are requested by your own browser from the public interfaces of those five markets. That means they see the request (and with it your IP address), and also that we do not: those queries do not pass through any machine of ours, so there is no record of ours of which asset you look at.
• Yahoo Finance — currency, index, commodity and stock data arrive through a server function of ours that asks on your behalf and caches the answer for one minute. Here it is the opposite of the previous point: your browser does not talk to Yahoo, it talks to us.
• NASA (GIBS), Planespotters and Wikimedia Commons — in the map of the AR4 Terminal, the images for the map backgrounds (Map, Satellite, Satellite of the day and Relief), those for the 3D globe (day and night) and the rain layer are requested by your own browser from NASA's imagery service, and the photo of an aircraft, when you open its profile, is requested by your browser from Planespotters.net, which displays it with its photographer's name. The photos of mines, ports, refineries, power plants, ships and aircraft models are requested by your browser from Wikimedia Commons (thumb.wikimedia.org and upload.wikimedia.org), without sending them the page of origin, and each one carries its author and its license. They see that request and your IP address, in accordance with their own policies. The rest of the map data (ships, aircraft, routes and ports) arrives through server functions of ours.

When an authority requests it. We could hand over data if a competent authority legally requires it, limiting ourselves to what is strictly required and keeping a record of what was handed over and to whom. In the USDT exchange, in addition, if a transaction shows signs of fraud or money laundering, where appropriate we may report it to the competent authorities, such as the UIF-Perú, with the data of that transaction (Terms, section 27). We do not hand over data to anyone else: not to advertisers, not to brokers, not to the partners with whom we have a commercial agreement. The only declared exception is the delivery of a prize, and there only your name and your email go, and we tell you beforehand to which partner (section 3).

6. Cookies and similar technologies

In short: what the Site needs to work always runs; what is used to measure advertising is not loaded until you say yes, and saying no takes a single click.

We distinguish two things, and only the second one asks you:

• The essentials, which always run — the technical cookie that keeps you logged in and the local storage of your preferences (the theme, the closed welcome guide, the last section visited). Without that you could not get into your account. It is not used for advertising and does not leave your device. Added to this is Cloudflare Web Analytics, which counts visits in aggregate form without cookies, without identifying you and without following you to other sites.
• Google's and Meta's advertising and audience measurement, which only runs if you accept it — the Google Ads tag, Google Analytics 4 and the Meta pixel, which tell us which ads work and what path people take through the Site. They are not downloaded until you decide. On your first visit you will see a notice at the bottom with two buttons of the same size, «Accept» and «Reject»: rejecting takes exactly one click, the same as accepting, and the site works just as well in both cases.

Why we ask you. Because tracking that is not essential requires prior consent, and because the law requires that consent to be free: if rejecting were harder than accepting, it would not be free. The Regulation of Law 29733 expressly allows consent to be expressed by clicking or tapping a button, which is exactly what that notice does. Until you decide, your browser does not even communicate with Google Ads, with Google Analytics or with Meta. Nor with Google Fonts: the Site's fonts are served from our own domain (section 5).

Where your answer is stored. In your own browser's local storage, under the name ar4_consentimiento. It is not stored in your account or in our database, and that has two effects worth knowing: if you clear the site data, if you browse in private mode or if you come in from another device, we will ask you again; and your decision does not travel with your username from one phone to another.

Your choice is stored in your own browser and applies to the whole site. To change it, use the button Measurement preferences — it is also in the footer of every page, in the «Legal» column. When you reject, in addition to no longer loading them, we delete the advertising cookies that Google or Meta had set before (_fbp, _fbc, _gcl_au, _ga and similar ones).

7. Your rights and how to exercise them

In short: you can ask us to see, correct or delete your data, and object to our using it. It is free, it is requested through a single channel and we have a specific deadline to answer you: 8, 20 or 10 business days depending on what you request. If we say no, you have somewhere to complain.

Law No. 29733 —and the equivalent laws of your country of residence— grants you these rights over your own data:

• Information (article 18) — to know what your data is processed for, who may receive it, how long it is kept and how to exercise your rights. That information is, precisely, this document: the Law accepts that when data is collected online this obligation is met by publishing an accessible privacy policy.
• Access (article 19) — to obtain what data of yours we process, how we collected it, why, at whose request and what transfers we have made or plan to make.
• Updating, inclusion, rectification and erasure (article 20) — to correct what is wrong or incomplete and delete what is no longer needed for the purpose for which it was collected. While we process a rectification or an erasure, the Law requires us to block that data: no one else accesses it during the process.
• Preventing disclosure (article 21) — to prevent your data from being handed to third parties, especially when that affects your fundamental rights.
• Objection (article 22) — to object to the processing on well-founded and legitimate grounds relating to your personal situation. If the objection is justified, the data must be erased.
• Objective processing (article 23) — not to be subject to a decision with legal effects or that significantly affects you based solely on automated processing that evaluates your personality or your conduct. What this means here is in section 14.
• Portability — to request the data you gave us in a structured and commonly used format to take it to another service, when the processing is automated. It is regulated by the Regulation in force since 2025.
• Protection (article 24) and compensation (article 25) — to complain to the authority or to the Judiciary if we deny you a right, and to be compensated if a breach causes you harm.

How to request them. Write to us from the contact page or by email at contacto@ar4mercados.com, saying which right you want to exercise and over what data. To be able to answer you we need to be able to identify you: it is enough for the request to come from the same email you signed up with, or for you to tell us your username. It is free for you, we do not ask you for any special format and you do not need to explain why, except for objection, where the Law itself requires a well-founded reason.

How quickly we respond. The deadlines are set by the Regulation and are counted in business days (the Law, in its article 2, defines «days» as business days), from the day after you submit the request:

• Right to information: 8 days.
• Right of access: 20 days.
• Rectification, cancellation or objection: 10 days.
• Objection to advertising or commercial prospecting uses: 10 days, with a simple and free means to request it (here, the button Measurement preferences).

If the request arrives incomplete, we will tell you so you can complete it; the Regulation gives you ten (10) days to provide what is missing and, if it does not arrive, the request is deemed not submitted and you can start again whenever you want.

If we say no. A refusal, total or partial, has to be reasoned: we will tell you why, based on the Law, and we will remind you that you can appeal. Article 24 of the Law opens two paths for you, and you can choose: file a complaint with the National Authority for Personal Data Protection or go to the Judiciary through a habeas data action. How to do it, in section 16.

What you can do yourself, without writing to us or waiting for deadlines. Edit your Community profile; change your decision on measurement with «Measurement preferences»; withdraw the notification permission from your browser's or your phone's settings (once withdrawn we can no longer send them to you); delete Aria's chat history by logging out or clearing the site data in your browser; and delete your account from your profile → «Delete my account and my data». Deletion is immediate, before you confirm it you are told what is deleted and what is kept, and the full details are in section 12.

8. Security

In short: traffic is encrypted, passwords are not stored in clear, the database is not touched from the browser and the Site blocks by default everything external that is not on a list. And no system is infallible, so we also say what we would do if something went wrong.

Protecting your data is not a courtesy on our part: the Law imposes it on us as a security principle (article 9) and as a specific obligation to adopt technical, organizational and legal measures (article 16). This is what is in place today:

• Everything travels encrypted. The Site is served only over HTTPS and any unencrypted request is rewritten to encrypted before it goes out.
• We do not see passwords. They are managed by Netlify Identity and stored with a cryptographic digest, never in plain text. No one at AR4 can read your password, not even us.
• A 6-digit PIN, in addition to the password. When you log in on a new device we ask you for a PIN that you choose, as a second step after your password. It is used only to confirm that login. We store it only as an irreversible cryptographic digest (scrypt, with a salt specific to your account): no one at AR4 can read it, not even us. After 5 failed attempts it is locked for 15 minutes and after 10 in a row it must be reset. If you forget it, we send to your email a code that expires in 15 minutes and works only once; of the code, too, we store only its digest. Your device remembers that you already confirmed the PIN for 30 days or until you log out. When you delete your account, it is deleted.
• Passkeys (Face ID, Touch ID, fingerprint or Windows Hello). If you turn on a passkey to log in without typing your PIN, we store only the passkey's identifier, its public key, a usage counter, the type of device (for example, «iPhone») and the dates you added it and last used it. Your face or your fingerprint are checked inside your device and we never receive or store them: we only receive a signature confirming that it is you. You can remove the passkey whenever you want from «Passkeys», and it is deleted when you delete your account.
• The database is not touched from the browser. Everything that reads or writes data goes through server functions that use keys that are never published, and sensitive operations —admin panel, subscriptions, diplomas, grading of the academy quizzes— check your identity on every request, on the server, not on your screen.
• Allowlist for external resources. The Site declares to the browser, through a content security policy, exactly which domains can run code, load fonts or open connections. What is not on that list does not load. In addition, the Site cannot be embedded inside another page, which is the usual trap to make you click something you did not intend to.
• What is published is only what should be published. The process that prepares each release deliberately excludes the server code, the keys and the payment path material, and stops if it detects that any of that has slipped in.

And what we cannot promise you. No system is infallible and anyone who tells you otherwise is selling you something. What we can commit to is not hiding it: if there were an incident affecting your data, what section 13 says applies, with deadlines that we do not set.

Your part. Use a password you do not reuse on other sites and do not share your account. And remember what section 3 says: no one from AR4 is going to ask you for your password, nor for your document by WhatsApp, social media or Community private messages.

9. Retention and deletion

In short: we keep each piece of data for as long as it is needed for what it was collected for, and not a day longer — except when a law requires us to keep it, which are the cases in the table.

Article 8 of Law No. 29733 says it plainly: personal data is kept «only for the time necessary to fulfill the purpose of the processing». This is that accounting, data item by data item:

We keep your data while your account is active. If you delete it, we delete your personal data within a reasonable period, with three exceptions: (a) payment records that tax regulations require us to keep; (b) public Community content that other users have quoted, which may be anonymized instead of deleted so as not to break third parties' conversations; and (c) the cryptographic fingerprint of your email described in section 2, which is kept indefinitely.

Why that fingerprint (c) is not deleted. It exists solely so that the welcome bonus is paid only once per mailbox. If we deleted it along with the account, it would be enough to delete and sign up again to collect it again, as many times as one wished, and points give raffle tickets: the control would cease to exist exactly where it can be circumvented. It is not your email and does not allow it to be recovered, it is not used to identify you or to contact you, and it is not cross-referenced with any other data. If you still want us to delete it, you can ask us by exercising the rights in section 7; if you do, that mailbox will be able to collect the bonus again in a future sign-up.

Complaints Book form. It is kept separately, together with the answer we give you, for two (2) years counted from the date your complaint or claim was registered: this is set by article 12 of the Complaints Book Regulation (S.D. No. 011-2011-PCM), because the law requires us to be able to show it to Indecopi. That period does not depend on whether you have an account or delete it. Once the period has elapsed, the form is deleted. Apart from keeping it, the law requires us to answer you within a maximum of fifteen (15) business days, with no possibility of extension (article 24 of the Consumer Protection and Defense Code, amended by Law No. 31435, and the Regulation as adapted by S.D. No. 101-2022-PCM).

10. Minors

In short: this is for people over 18. If we find out that an account belongs to a minor, we close it. The only time we process a minor's data is when someone files a complaint on their behalf, because consumer law requires it.

Why 18 and not 14. The Regulation of Law 29733 generally allows a minor between 14 and 18 years old to consent by themselves to the processing of their data in digital services, and requires the permission of the father, mother or guardian below 14. But it adds a prohibition that here overrides everything else: that consent is never valid for accessing goods or services restricted for their age. Everything surrounding this Site —opening an account with a broker, trading in financial markets, taking part in raffles with prizes— is. That is why the cutoff is at 18 and we do not accept accounts below that age, even if the minor and their parents agreed.

The Site is intended for people over 18. We do not knowingly collect data from minors to create accounts or for any function of the Site; if we detect an account belonging to a minor, we will delete it. If you are a parent or guardian and believe that a minor has provided us with data, contact us to have it deleted.

A single exception, and the law mandates it: the Complaints Book form can be filed on behalf of a consumer who is a minor, and in that case the Regulation also requires the name and document of their father, mother or legal representative. That data is used solely to process that complaint, is kept with the form (sections 2 and 9) and does not create an account or enable any function of the Site.

11. International transfers: where your data is

In short: your data does not stay in Peru. The companies that make the Site work have their infrastructure outside the country, and the law allows that under conditions. Here we say what they are and which one we rely on.

The fact, first. AR4 Mercados does not have its own servers. Everything you see and everything you store relies on providers —Netlify, Supabase, Mercado Pago, Google, Meta, Cloudflare, Anthropic, and for emails and SMS, Resend and Twilio; and, for identity verification in the USDT exchange, Didit— which are foreign companies and process data on infrastructure located outside Peru. Almost all of them are incorporated in the United States —the exceptions are Mercado Pago, from the Argentine group Mercado Libre, and Didit, incorporated in Spain— and several spread their network across different regions of the world, so data may pass through more than one country before reaching its destination. When you sign up, post in the Community or pay, your data leaves the country. We cannot promise you otherwise and we are not going to.

What the law says. Law No. 29733 calls this cross-border flow and regulates it in its article 15: the general rule is that data only travels to countries with an adequate level of protection and, when the destination does not have it, whoever sends it must guarantee that it is processed there in accordance with Peruvian Law. The same law lists cases in which that additional requirement does not apply; two apply to us directly:

• Item 4 of article 15 — when the data is necessary for the performance of a contractual relationship to which you are a party, and it expressly includes user authentication, improvement and support of the service, monitoring of its quality and billing of the account. That is exactly what Netlify (your login), Supabase (your profile and your posts) and Mercado Pago (your subscription) do.
• Item 7 of article 15 — when you gave your prior, informed, express and unequivocal consent. That is the case for Google's and Meta's advertising measurement, which does not load until you accept (section 6). If you do not accept, that data does not leave.

The safeguard we rely on. In addition to those two routes, the Regulation allows whoever exports data to rely on model contractual clauses or other legal instruments that impose on the recipient, at a minimum, the same obligations we are subject to, and provides for the authority to publish models of those clauses. We rely on the data processing agreements that each provider offers its customers with that content. The Regulation also requires the cross-border flow to be communicated to the authority for its entry in the National Registry; on that procedure, see section 15.

And an honest consequence. Data leaving the country means that, in addition to Peruvian law, it is subject to the laws of the place where it is hosted. If that is decisive for you, the only way to avoid it is not to create an account: almost the whole Site —news, charts, guides, tools— can be read and used without signing up.

12. What exactly happens when you delete your account

In short: the button really deletes, it stops your subscription billing within the same process, and there are five things that are not deleted, for reasons that are explained. It is irreversible.

You can delete your account yourself from your profile → «Delete my account and my data», without writing to us and without waiting for deadlines. Before you confirm it, the screen shows you what is deleted and what is kept. This is what happens, in this order:

• Deleted: your private messages and their conversations, together with the images you sent in them; your stories and their files; all the profile photos you uploaded, not just the last one; your notification subscriptions; your notifications; your watchlist, the levels you were monitoring and the link with which you shared it; your chart practice sessions; your chart drawings, workspaces, combinations and templates saved in your account; your Tools trading journal; your Trader journal, with your shared case studies (and the reports they received) and the reports you made on other people's cases; your subscription to the weekly summary by email, with the copy of your email and the sign-up and opt-out dates; your morning summary, with the copy of your email and of your markets and the send log; the days you logged in with your account; your prop firm payout records and your reports of denied payouts; your USDT exchange price alerts; your chart price alerts; and the trail you left on other people's stories (what you viewed and what you reacted to).
• Your profile is anonymized. The username becomes a meaningless identifier, and the bio, avatar, social links, trading style, phone and points are emptied.
• Billing is stopped. If you have an active Premium subscription, we cancel it in Mercado Pago at this point, within the same deletion process. If that cancellation failed, we tell you so in those words and ask you to cancel it yourself from Membership or to write to us: by then what is in the two previous points has already been deleted, and billing does not stop by itself. We tell you this clearly because it is what really happens.
• Your login account is closed —email, password and the real name stored for diplomas— and it is checked that it was really closed. Before that, your certificates leave the verification registry: from that moment on, neither that registry nor the digital credentials verification confirms them. If that step, or the username change, did not go well, the response tells you so in these words: «we deleted your personal data, but we could not…», and asks you to retry. We will never tell you «it was deleted» halfway.

What is not deleted, and why. Five things: (a) your Community posts and comments, which remain without an identifiable author instead of disappearing, because deleting them would break the conversations of third parties who replied to you; (b) the payment records that tax regulations require us to keep; (c) the cryptographic fingerprint of your email for the welcome bonus, for the reasons explained in section 9 — and that one we do delete if you expressly ask us; and (d) the messages you wrote in the Community chat, which remain just like posts —without an identifiable author— because deleting them would leave other people's conversations half-finished; and (e) the moderation log, which keeps the trail of the team's decisions on reported content, attached to your already anonymized profile (section 9). Nor can we delete the digital credentials you already downloaded or shared: they are on your device or wherever you sent them, even though our registry no longer confirms them. If you also filed a form in the Complaints Book, that form follows its own two-year period, regardless of your account.

It is irreversible. There is no trash bin or grace period: when it is over, it is over. If what you want is only to stop receiving things, you are better off rejecting measurement, removing notifications and leaving the account idle.

13. If there were a breach or a security incident

In short: if something happens that affects your data, we have 48 hours to notify the authority and 48 hours to notify you, in clear language. We do not decide this: the Regulation mandates it.

Article 34 of the Regulation of Law 29733 regulates the notification of security incidents. This is what it requires us to do, and what you can demand from us:

• Notify the National Authority for Personal Data Protection within 48 hours of becoming aware of the incident, when it exposes large volumes of data, may affect many people, involves sensitive data or causes harm. If we notified later, we would have to say why and prove it.
• Notify you within 48 hours, without undue delay, in simple and clear language, when the incident may affect your rights, also telling you what we have done to reduce the harm.
• The obligation does not disappear because we believe the problem has already been resolved internally. That is written in the law, and it is precisely the excuse used to say nothing.
• If the incident occurs in the digital environment, the notification also goes to the National Digital Security Center, so that it is recorded.

When we write to you about something like this, we will tell you what happened, what data of yours is involved, what consequences it may have for you and what you should do (for example, change your password). We are not going to hide behind a «for security reasons we cannot give details».

14. Automated decisions and AI moderation

In short: here there are things a program decides (moderation, points, quiz grades, ranking order). None has legal effects on you, and if any seems unfair to you, a person reviews it.

Article 23 of Law No. 29733 gives you the right not to be subject to a decision with legal effects, or that significantly affects you, based solely on automated processing that evaluates your personality or your conduct. So that you can exercise it, first we have to tell you what is automated here:

• Content moderation — what you post in the forum, comments, messages and the lesson of the case studies from your Trader journal go through an automatic filter that uses Anthropic's AI service to detect abuse. That text is sent only for that and is not used to train models. The most serious possible consequence is that a message is blocked or hidden.
• Points, streaks, missions and raffle tickets — they are calculated by the server with fixed rules, the same for everyone, and with caps designed so that no one can manufacture points. No human hands out points at will.
• Academy quizzes — they are graded on the server, not in your browser, precisely so that the grade does not depend on what can be tampered with from the visitor's side.
• Order of the broker and exchange rankings — it comes from a published formula, the same for everyone, which you can read and recalculate yourself in Methodology. It is not a decision about you, but it is worth knowing that it is automated and verifiable.
• Aria and the Copilot generate text to guide you. They decide nothing about your account, they do not score and, as the Site itself says everywhere, they do not give buy or sell signals or investment advice.

None of this produces legal effects on you or shuts you out of an essential service. The most that can happen is that a message is blocked or that a prize is not delivered for breaking the rules; in both cases you can write to us and a person reviews it. AR4 Mercados is run by its founder, so we will not always be fast; what is not going to happen is that there is no one on the other side.

15. The personal data bank and the National Registry

In short: Peruvian law calls «personal data bank» any organized set of data about people, and the authority keeps a public registry of those banks. Here we tell you which ones we have and what that registry is for.

Law No. 29733 defines a personal data bank (article 2, item 1) as an organized set of personal data, automated or not, whatever its medium and its form of creation or access. In plain terms: every ordered database in which people appear. The ones that support this Site are three:

• Accounts and Community — the login registry (email and password) and the profiles, posts, messages, learning progress and diplomas.
• Forms and complaints — the private inbox where the contact form, suggestions and the Complaints Book forms arrive.
• Payments and subscriptions — the record of what was charged and which account it corresponds to. Card data is not here: it never passes through us.

The National Registry. Article 34 of the Law creates the National Registry for Personal Data Protection, run by the Authority, to register public and private data banks and the data needed so that their data subjects can exercise their rights. The Regulation in force (article 42) establishes that those who create, modify or cancel personal data banks are required to process the registration of those acts, and that anyone can consult the information that Registry contains. Registering a data bank does not give the authority access to its content: that only happens within an ongoing administrative proceeding.

If you want to know the status of the registration of AR4 Mercados' data bank, ask us through the contact channel in section 1 and we will answer you. We prefer to refer you to a verifiable fact rather than stamp here a statement you cannot verify on your own.

16. If we do not comply: who you can complain to

In short: two different authorities that do not overlap. For your personal data, the ANPD. For a consumer problem, Indecopi. And you can always go to the Judiciary.

• For personal data: the National Authority for Personal Data Protection, which the Law assigns to the Ministry of Justice and Human Rights (article 32). If we deny you a right from section 7, totally or partially, or if we simply do not answer you within the deadline, article 24 of the Law allows you to file a complaint with it or to go to the Judiciary through a habeas data action. Its official information and its channels are at gob.pe/institucion/anpd.
• For a consumer problem: Indecopi. It is the entity that supervises the Complaints Book and the Consumer Protection and Defense Code. Start with the Complaints Book form —we have 30 calendar days to answer you— and, if the answer does not satisfy you, you can take it to Indecopi (indecopi.gob.pe). Registering a form is not a requirement to file a complaint, and we cannot make anything conditional on your having filed it.

Nothing in this policy takes those paths away from you, and we do not ask you to waive any of them. We ask you for one thing only, and it is a favor, not a condition: write to us first, because we can almost always fix it without you having to go anywhere.

17. Changes to this policy

When we update this policy the "last updated" date on this page will change; if the change were substantial in how we process your data, we will announce it visibly on the Site before it comes into force. A change never applies retroactively to legitimize a use that was not declared when you gave us the data: if we wanted to use your data for a new purpose, we would ask you first, as the purpose principle requires (article 6 of the Law). The version you can download as a PDF is generated from this same page, so it cannot say anything different from what you are reading.

Document drafted with professional judgment and with the law cited article by article so that you can check it: Law No. 29733 and its Regulation (S.D. No. 016-2024-JUS, in force since March 30, 2025), and the Complaints Book Regulation (S.D. No. 011-2011-PCM). It is not legal advice and does not replace review by a lawyer specialized in data protection, which remains advisable —particularly before large-scale advertising campaigns and to confirm the procedures before the National Authority for Personal Data Protection.