-
Account data: your email address and password (the password is held by our authentication provider in hashed form; we never see it in plain text), your first and last name, and, if you gave them when you signed up, your country and a phone number. If you sign in with Google or Apple, we receive your email address and name from them. Optionally, a display handle if you choose to set one.
-
Evaluation and trading activity: your simulated orders, fills, positions, account stages, rule evaluations, and wallet ledger entries (fees paid, credits granted, amounts earned, withdrawals). Each wallet entry records which of your two balances it moved. This is core product data, generated by using the platform and held server-side in an append-only record.
-
Payment data: payments are processed by CuminPay. CuminPay's card form is rendered inside a Monaco Funded page rather than in a separate window, so the name on your card, your card number, its expiry date, its security code, and any billing address CuminPay asks for are typed on our page and sent from your browser directly to CuminPay. We never receive, transmit, or store your card number, its expiry date, or its security code. What reaches us is the payment confirmation, its reference, and the payment details CuminPay reports back to us, which can include the name and billing address on the card and its last four digits; we keep them in our payment records and our server logs.
-
Bank details: if you save bank details for an Earnings withdrawal, we store your first and last name, the bank name, the account type, the account number, and the account currency. You can change them at any time in your account settings. We store them so that a withdrawal can be paid, and we use them for nothing else. Saving them is not identity verification; that happens separately, at payout stage, as set out below. Where the account is shown back to you, or to us, only the last four digits appear. When you request a withdrawal we attach a copy of the details as they stood at that moment to that request, so that a later change cannot alter a payment already under way. Apart from your own signed-in app, which receives it and shows only the last four digits, the full account number leaves our systems only in the payment instruction we use to make the payment, and access to that instruction is restricted and logged.
-
Identity verification data (at payout stage): before a payout is made we are required to verify your identity. We ask for government-issued photo identification, and we use Didit, a specialist identity-verification provider, to check it. We give Didit a reference to your account and, where you have saved bank details, the name on them, so that the result comes back to the right account and the names can be compared. You complete the check on Didit's own verification page: the documents and images you provide go to Didit, not to us. What we receive and keep is the outcome of the verification, the name on the verified identity, which we compare against the name on your bank record, and a one-way code derived from the identity document so that one identity cannot verify two accounts; we do not receive or store copies of your documents. What we ask for and why is set out in the AML and Identity Verification Notice. Anti-money-laundering law may require verification records to be retained and certain matters to be reported to the Financial Intelligence Unit of Trinidad and Tobago.
-
Product analytics (web only, only with your consent): which screens are visited and which features are used, tied to a random first-party session identifier and, while you are signed in, to your account. Analytics events never include your name, email, or trading amounts, and they are sent only to our own servers. No third-party analytics service receives anything. On the mobile app, analytics is off.
-
Advertising measurement (our website): our website runs the Meta Pixel, Meta's advertising measurement tool, for every visitor. It tells Meta which pages of our website you visit, when you create an account, and when you top up and for how much, together with your IP address, your browser's details and identifiers Meta keeps in your browser. When you are signed in, or have just created an account, it also sends a hashed form of your email address and of your Monaco Funded user ID, which Meta uses to match these events to a Meta account you hold. We use it to measure and improve our advertising. Meta uses it under its own data policy. It does not run in our mobile apps or on our payment, password-reset or admin pages, and its automatic collection of form fields is switched off. You can block it with your browser's tracking protection or an ad blocker, and control how Meta uses it in your Meta account's ad settings.
-
Technical data: IP address, device and browser type, and similar connection data in our server logs, used for security and to operate the service.
-
Age confirmation: when you first open Afterhours, we record that you confirmed you are 18 or over, the wording you agreed to, and the date. We do not collect your date of birth for this purpose.
-
Location check: we may check the country you are connecting from when you enter, and record the result, because we offer the service only in the countries we support. We record the country, not your IP address, for this purpose.
-
Afterhours records: for each Afterhours evaluation, the positions you took and when, your result, and what it earned. This is how the evaluation is settled, and how we answer a query about a result.
-
Partner code: if you enter a partner code when you top up your account, we record which code you used and when. We use it to grant your Partner credit and to record what the partner who referred you has earned from your activity. The partner is never told who you are.
-
How you found us: when your account is created we record how you arrived, once: the campaign tags in the link you followed (its source, medium, campaign and content, where the link carried them) and the address of the page that linked you. We keep only the site and page of that address, never anything after it, so if you arrived from a link that carried your email address or a sign-in token in it, that part is discarded before anything is stored. We record this whether or not you accept analytics cookies, because it is a business record of how the account began rather than tracking: it tells us which of our own channels and partners bring people to us, and it is what decides what a partner who referred you has earned. It is written once, at sign-up, and never updated afterwards, so it does not follow what you do later. Most sign-ups record nothing here, and nothing is invented when there is nothing to record. We do not use it for advertising, we do not share it, and it is never used to recognise you on any website or app that is not ours.
-
Push notification token (mobile app only, only if you turn notifications on): if you allow notifications, your device gives us a token that identifies that install so a message can reach it. We store the token, which platform it came from, and when we last saw it. We use it for one purpose: to tell you about your own account -- that an evaluation passed, that an account reached its maximum drawdown, that a daily-loss lockout began, that a funded account is active, or that a withdrawal was accepted, sent or returned. We do not send promotional messages by push, and if you have asked us for a spending limit, a cooling-off period or a self-exclusion we would not send them to you even if we did. Turning notifications off in the app, or in your device settings, stops it: we retire the token and the messages stop. A token identifies an installation of the app, not you, and it is not used for advertising, not shared, and not used to recognise you anywhere else. It is separate from the device identifier described below, which we keep for a different purpose and would keep whether or not you use notifications.
-
Device identification: to enforce the terms of our offers, we identify the device you are using. In our mobile apps this is a random identifier we create once and keep on your device; on the web, where no such identifier exists, we derive a signature from your browser and device settings. We use it to enforce the terms of our offers and to prevent misuse. When you redeem a partner code, we also record the IP address and browser your request came from, for the same reason. We do not use any of it for advertising, we do not share it, and we do not use it to recognise you on any website or app that is not ours.
-
Last screen: We record which screen of the platform you last used and when you were last active. We use this to support you. We never record what you typed.
-
Problem and error reports: what you write when you report a problem, with the screen, platform and app version it came from; and when the app hits an error, the error, the screen it happened on, your browser or device type, and the app version. We use them to fix the platform.
-
Supabase - authentication and database hosting, Virginia, United States.
-
Railway - trading-engine hosting Virginia, United States.
-
Cloudflare - hosting and delivery of our website.
-
Cloudflare Turnstile - checks that a sign-up, sign-in or password reset comes from a person and not an automated program, using signals from your browser or device for that one check.
-
Expo (EAS) - delivery of app updates to the mobile app and push notifications.
-
Apple and Google - app distribution on their stores.
-
Google and Apple - sign-in, if you choose to use it.
-
CuminPay - payment processing. Its payment form sends its messages through Google's Apps Script service.
-
Didit - identity verification before your first withdrawal. You provide your identity documents on Didit's own verification page; we receive the outcome and the name on the verified identity, and we do not receive or store copies of your documents.
-
Resend - email delivery (account verification, password reset, and the notifications you choose); Resend also holds your email address and first name as a contact so you can manage those emails, in the United States.
-
Meta Platforms - advertising measurement on our website (the Meta Pixel).
-
Account data: kept while your account is active and for 30 days after closure; the verification, payment and payout records the law requires are kept for at least 7 years.
-
Trading, evaluation, and wallet records: kept for platform integrity and for at least 7 years, the period financial-recordkeeping and anti-money-laundering law requires. These records may be retained even if you delete your account.
-
Age confirmations and location-check records: kept for as long as the account exists and for at least 7 years after, as a record of the confirmations and checks described above.
-
Bank details and the payment instructions produced from them: kept while your account is active and for at least 7 years after closure, the period financial-recordkeeping and anti-money-laundering law requires of payment records.
-
Afterhours records: kept with the trading records above.
-
Partner code records: kept with the wallet records above.
-
Device identification records: kept with the partner code records above.
-
Marketing contact records (what we sent you and your choices about it): kept while your account is active and for at least 2 years after closure.
-
Notification log: for the life of your account and the platform's records.
-
Problem and error reports: for the life of the platform's records.
-
Analytics events: at least 24 months.
-
Advertising measurement: held by Meta under its own policies; we keep none of it.
Copyright 2026 Monaco Western Limited. All rights reserved.