What we collect
We collect account details (name, email, country), KYC documents (government ID, proof of address), trading-practice activity inside the Program, and payment information processed by our payment partner. We do not collect anything we don't need to run the Program.
Why we collect it
We use your data to verify eligibility, prevent fraud, deliver coaching, grade your skill rubric, and award prizes when you qualify. We do not use your data for advertising and do not build behavioral profiles for resale.
Encryption + screening
KYC documents are encrypted at rest using a key stored in our environment as KYC_ENCRYPTION_KEY and accessed only by authorized staff. Every signup is screened against the OFAC sanctions list and other applicable watchlists before we accept payment.
Who we share with
We share verification data with Next Funded only at the moment of prize award, and with our payment processor solely to handle your payments. We never sell your personal information to anyone, ever.
How long we keep it
Account data is kept while your account is active and for 5 years afterward for legal and audit purposes. KYC records are retained for 7 years to satisfy financial-services regulations. Verified fraud cases may be retained longer where law enforcement requires it.
Your rights
You can request access to your data, correction of inaccurate fields, deletion of your account, or a portable export — at any time. Caribbean residents are granted GDPR-equivalent protections regardless of where the law technically applies. Email support@victoryprotocol.academy to exercise any right.
Children
Victory Protocol is strictly for adults 18 and older. We do not knowingly collect any data from minors. If we learn an account belongs to a minor, we will delete it promptly and refund any tuition paid.
Cookies
We use only essential session cookies to keep you logged in. We do not use tracking pixels, do not run third-party analytics, and do not embed advertising trackers anywhere on the Program.
International transfer
Our servers are based in the United States. When you use the Program from outside the US, your data is transferred to and processed in the US under standard contractual clauses and equivalent safeguards. By enrolling, you consent to this transfer.
Changes to this policy
If we make material changes to this Privacy Policy, we will notify you at least 30 days before they take effect — by email and a banner inside the Program. Minor wording or formatting changes may be made without notice.
Contact
Privacy questions, data requests, or complaints? Email support@victoryprotocol.academy. We respond within 3 business days, and within 30 days for formal data-subject requests.
Browser extension (RiskCommander for Tradovate)
If you install the Victory Protocol RiskCommander extension, it reads your Tradovate account state from the Tradovate page you already have open: your open position, your realized profit and loss for the session, your account balance, how far the account sits from its drawdown floor, and whether a platform-level loss limit is set. It also reads your operator token so it can identify your account. It sends that reading to your own Victory Protocol account over HTTPS, and reads back whether one of the limits you set has been reached. Nothing goes anywhere else. We do not sell it, share it with advertisers, or use it for anything except enforcing the limits you configured. The extension places no orders and cannot move money. Uninstalling it from your browser stops the collection immediately; to delete the readings already stored on your account, email support@victoryprotocol.academy.