Privacy
Policy.

1. Data We Collect

We collect the following categories of personal data:

We do not collect government-issued ID, financial statements, or biometric data during the evaluation phase. Know-Your-Customer (KYC) identity verification is required at the time a funded account is issued — see our Terms & Conditions for details.

2. How We Use Your Data

• Account management: Creating and maintaining your account, authentication, and password recovery.
• Service delivery: Processing challenge purchases, tracking evaluation progress, issuing funded accounts, processing payout requests.
• Communications: Sending transactional emails (account confirmation, password reset, payout confirmation). We may send marketing emails if you have opted in; you can opt out at any time.
• Fraud prevention: Detecting and preventing prohibited trading practices, account sharing, or abuse of the referral system.
• Platform improvement: Aggregated, anonymised analytics to understand how the platform is used and to improve it.
• Legal and compliance: Complying with applicable laws, responding to lawful requests, enforcing these Terms.
• Marketing attribution: Understanding which referral sources or campaigns bring users to TBM Funded so we can compensate partners appropriately and optimise marketing spend.

3. Legal Basis for Processing

Where GDPR or equivalent law applies, we rely on the following legal bases:

• Contract performance — processing necessary to fulfil your challenge purchase and provide the funded account service.
• Legitimate interests — fraud prevention, referral attribution, platform analytics, and security.
• Legal obligation — retaining financial records as required by UAE commercial law.
• Consent — marketing communications (you can withdraw consent at any time by unsubscribing).

4. Data Storage and Sub-Processors

Your data is stored and processed by the following third-party services:

Each processor is bound by a data processing agreement or equivalent contractual protections. We do not sell your personal data to third parties.

5. Cookies and Tracking

We use the following cookies and local storage mechanisms:

• Session cookie (Supabase auth) — required for login. Duration: session + refresh token.
• Referral cookie (tbm_ref) — stores the partner referral code from a /r/ link. Duration: 30 days.
• Visitor cookie (tbm_vid) — an anonymous id used to credit the referring partner if you sign up later. Contains no personal data. Duration: 12 months.
• Discount cookie (tbm_discount) — stores a spin-wheel discount if won. Duration: 24 hours.
• UTM data (localStorage) — stores campaign parameters from the landing URL for attribution. Cleared after signup.
• Analytics (Vercel Analytics) — privacy-friendly, no persistent cookies, no cross-site tracking.

We do not use third-party advertising trackers (Facebook Pixel, Google Ads, etc.) at this time.

6. Data Retention

• Account data: retained for the lifetime of your account and deleted within 30 days of a verified deletion request, subject to legal retention requirements.
• Payment and transaction records: retained for a minimum of 7 years to comply with UAE commercial record-keeping requirements.
• Challenge and performance data: retained for the duration of your account.
• Support communications: retained for up to 2 years.
• Analytics data: aggregated and anonymised; no personal retention limit.

7. Your Rights

Subject to applicable law, you have the right to:

• Access — request a copy of the personal data we hold about you.
• Rectification — request correction of inaccurate or incomplete data.
• Erasure — request deletion of your personal data (subject to legal retention obligations).
• Restriction — request that we restrict processing of your data in certain circumstances.
• Portability — receive your account data in a machine-readable format.
• Objection — object to processing based on legitimate interests.
• Withdraw consent — withdraw consent to marketing communications at any time via the unsubscribe link in any email.

To exercise any of these rights, email support@tbmfunded.com with the subject line "Data Request". We will respond within 30 days.

8. International Data Transfers

Because our infrastructure providers (Supabase, Vercel, Resend) are based or operate servers in the United States, your data may be transferred to and processed in the USA and other countries outside the UAE. We ensure that such transfers are subject to appropriate safeguards — including standard contractual clauses or equivalent mechanisms — in line with applicable data protection law.

9. Security

We implement appropriate technical and organisational measures to protect your personal data: passwords are hashed and never stored in plain text, database access is gated by row-level security (Supabase RLS), API endpoints require authenticated sessions, and payment processing is handled entirely by our certified processor (NOWPayments). No system is 100% secure. If you believe your account has been compromised, contact us immediately.

10. Children's Privacy

TBM Funded is not directed at individuals under 18. We do not knowingly collect personal data from minors. If we become aware that we have done so, we will delete it promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Changes are effective upon posting. We will notify registered users of material changes by email.

12. Contact and Data Requests

For privacy enquiries or to exercise your data rights, contact: support@tbmfunded.com

TBM Funded, a trading name of TBM Capital L.L.C-FZ · Meydan Grandstand, 6th floor, Meydan Road, Nad Al Sheba, Dubai, U.A.E. · Formation/Registration No. 2650044 · Licence No. 2650044.01