Privacy Policy

Desk Solutions operates YA Markets at desksolutions.io. This Privacy Policy explains the personal information handled when you visit the website, create an account, apply for membership, use a workspace, make or verify a payment, or contact us.

This policy is intended to provide transparent handling standards. Your rights may also arise under the Privacy Act 1988 (Cth), the Australian Privacy Principles, consumer law, or other laws that apply to you or to Desk Solutions.

Depending on how you use YA Markets, we may handle:

• Identity and account details, including name, email address, account identifiers, handle, avatar, region, role, membership tier, approval state, and entitlements.
• Authentication and security details, including session records, login events, policy-acceptance records, IP address, browser or device information, rate-limit records, recovery state, and security logs.
• Billing records, including selected plan, renewal consent, Stripe customer, Checkout, payment-method, subscription, invoice, refund, and status identifiers.
• Workspace and product data, including chart settings, layouts, templates, preferences, watchlists, thresholds, saved state, learning activity, Paper Trading virtual balances, positions, simulated orders and fills, and feature interactions.
• Communications and community content, including support requests, feedback, Chat Room text and privately stored photo messages, reactions, reports, and related timestamps.
• Chat Room operational records, including current presence state, message status, room controls, content-review state, and moderation actions.
• Partner-route activity, including the partner, route, campaign, link-open or code-copy action, destination type, source page, timestamp, and any referral attribution supplied by a provider.
• Technical and operational records, including request timing, errors, service health, feature access, and abuse-prevention signals.

Supabase Auth handles account authentication and password credentials. Desk Solutions does not receive or display your password in ordinary operation.

Stripe-hosted Checkout handles full card details and supported wallets such as Apple Pay or Link. YA Markets does not store full card numbers or wallet credentials. We receive limited identifiers, status, card-brand or last-four details where supplied, and records needed to administer verification, subscriptions, invoices, refunds, and fraud or support issues.

We collect information directly from you when you register, choose a plan, configure the workspace, submit content, participate in the Chat Room, or contact us; automatically when your browser or device interacts with the service, including when you open a partner route or copy a referral code; and from service providers when they return authentication, billing, security, or referral status.

If you use Google sign-in, we receive the account information Google makes available with your authorization, such as your name, email address, and account identifier.

We use personal information where reasonably necessary to:

• Create and secure accounts, verify email addresses, recover access, and prevent abuse or fraud.
• Review membership applications, apply entitlements, administer trials, subscriptions, renewals, cancellations, refunds, and account status.
• Provide account-scoped workspace state, product features, Chat Room presence and participation, support, moderation, and service communications.
• Measure partner-route use, maintain basic activity counts, administer referral routes, and reconcile provider-confirmed attribution where available.
• Operate, diagnose, protect, and improve the website, runtime services, databases, and product workflows.
• Maintain accounting, security, audit, dispute, and compliance records.
• Meet legal obligations and enforce the Terms of Use.

Eligible Essential and Expert members can see the identity you use in the room, your text and photo messages, reactions, timestamps, and current online or in-room presence. Photo files use controlled member access but remain visible to the eligible members participating in the shared room. Do not post information you do not want shared with that member audience.

Reports, review notes, and moderation actions are handled by authorized administrators or moderators as needed to operate and protect the room. Content may be hidden from the current member view, restored, restricted, or retained while a report, safety issue, security event, or dispute is reviewed.

An administrative clear removes earlier content from the active member conversation view. It does not represent immediate erasure from moderation records, security evidence, backups, or scheduled retention processes.

Membership approval or rejection is made by an authorized Desk Solutions administrator. Software then applies recorded approval, membership, entitlement, trial, and billing states and synchronizes relevant Stripe events.

Security controls may automatically rate-limit or block a request that exceeds configured limits or fails authorization. YA Markets does not currently use an artificial-intelligence model to decide whether a membership application is approved. We will update this policy if automated decision practices materially change.

YA Markets uses cookies and similar browser storage for authenticated sessions, security, the private front gate while enabled, preferences, layouts, templates, chart settings, workspace state, and other product controls.

Some settings remain only on your device and some authenticated workspace state may synchronize to Supabase. Clearing browser data can sign you out or remove local preferences and saved state. Third-party embeds may use their own storage according to their policies.

We use Supabase for authentication, database, storage, and account-related application services; Vercel for web hosting and deployment; DigitalOcean for private runtime and market-data infrastructure; Stripe for payment verification, subscriptions, invoices, refunds, and billing management; and Google Workspace or configured SMTP services for authentication and support email.

These providers receive information needed to perform their services and process it under their own terms, privacy notices, and contractual roles. Stripe may process some payment and fraud-prevention information for its own legal and operational purposes as well as on our instructions.

YA Markets may display or link to third-party market feeds, TradingView widgets, YouTube embeds, broker or exchange pages, wallets, calendars, and affiliate partners. When your browser interacts with those services, the provider may receive technical, device, account, referral, or usage information under its own policy.

When a signed-in member opens a partner route or copies a referral code, YA Markets records that action with the relevant account, partner route, campaign, destination type, source page, and timestamp. We use these records for basic route counts, administration, security, and referral reconciliation. A link-open or code-copy record does not confirm that the member created an account, deposited funds, or traded with the provider.

Where provider reporting is enabled, an affiliate provider may return a referral identifier and status information relating to signup, deposit, trading, campaign, or commission activity. We use provider-supplied information to verify attribution and administer the partner relationship. We do not use it to place trades, assess personal suitability, or create a personal recommendation.

We do not sell personal information as a standalone business activity. We may disclose information to the providers described above, professional advisers, insurers, auditors, a successor to the service, or authorities and other parties where reasonably necessary to comply with law, protect safety or security, investigate fraud, resolve a dispute, or enforce an agreement.

We may publish or share aggregated or de-identified information that does not reasonably identify an individual.

Based on our current configuration and the providers' published location information, the following countries are the locations in which personal information is most likely to be disclosed, stored, or processed. A listed country does not apply to every person or every transaction.

Primary project data held by Supabase follows the region selected in the project settings. Before changing that region or adding a provider, we review the destination country, purpose, information involved, contractual protections, access controls, and the provider's current subprocessor list, then update this register where the likely destinations materially change.

Privacy protections may differ between countries. Where Australian Privacy Principle 8 applies, we take reasonable steps appropriate to the service and information involved before disclosing personal information overseas, subject to any exception permitted by law.

• DigitalOcean — Australia. The private market-data runtime and related operational infrastructure are hosted in Sydney.
• Vercel — Australia and the United States. Web functions are configured for Sydney. Deployment, security, logging, support, and globally distributed edge delivery may involve the United States or the country from which a visitor connects.
• Supabase — the configured primary project region, the United States, and Singapore. Primary database, authentication, and storage data is stored and primarily processed in the selected project region. Platform, security, support, and authorized subprocessor operations may also involve the United States and Singapore.
• Stripe — Australia, the United States, Ireland, the United Kingdom, Canada, India, Malaysia, the Philippines, Colombia, and Japan. The countries involved depend on the payment, fraud-prevention, billing, and support services used for a transaction or account.
• Google Workspace and Google sign-in — Australia, the United States, Canada, India, Ireland, Japan, Malaysia, Mexico, the Philippines, Poland, Romania, Sri Lanka, Switzerland, and the United Kingdom. These locations may be involved in authentication, email delivery, abuse prevention, and customer-initiated support, depending on routing and the service used.

We retain information for as long as reasonably needed to operate an active account, provide purchased access, maintain security and audit evidence, answer support requests, administer billing and disputes, and comply with accounting or legal requirements.

Chat Room messages and media are managed under rolling operational limits. Content removed from the active room view may remain for a limited period, while reports, moderation records, security evidence, and dispute records may be retained for longer where reasonably necessary. Partner-route and provider-attribution records are retained while needed to administer and reconcile the relevant route or relationship.

Clearing visible Paper Trading fills removes them from the current simulator history. Compact transaction, replay-protection, security, audit, backup, or dispute records may remain where reasonably needed to operate and protect the service.

Deletion of an account does not require immediate deletion of records that must be retained for payment, refund, fraud, security, backup, dispute, or legal purposes. Browser-stored information may remain until you clear it. We review operational retention as product systems mature rather than promising a fixed period that does not match every record type.

We use access controls, server-side authorization, encrypted transport, provider security controls, restricted secrets, audit records, and other reasonable measures appropriate to the service. No online system, provider, database, email, device, or transmission method is completely secure.

Use a strong unique password, protect your email and devices, sign out on shared devices, and contact us if you suspect unauthorized access.

You may ask to access or correct personal information, request an account export or deletion, or raise another privacy request by emailing privacy@desksolutions.io.

We may verify your identity and clarify the scope before acting. A request may be limited where the law permits or requires us to retain information, protect another person, preserve security or fraud evidence, or refuse an unfounded or unlawful request. Self-service export and deletion tools are not currently available.

Send a privacy complaint to privacy@desksolutions.io, or to support@desksolutions.io if needed, with enough detail for us to investigate. We will assess it and respond within a reasonable period, taking the issue's complexity and any applicable legal requirements into account.

If Australian privacy law applies and you are not satisfied with our response, you may be able to contact the Office of the Australian Information Commissioner. This does not limit any other rights available to you.

YA Markets is for adults and is not intended for anyone under 18 or under the age of legal majority in their location. Contact us if you believe a child has provided personal information.

We may update this policy as the service, providers, and legal requirements change. The current version will be posted on desksolutions.io, and material changes will be communicated by reasonable means where required.

Privacy enquiries: privacy@desksolutions.io. Fallback and general support: support@desksolutions.io.