Prop Hub
Terms of Service →
Privacy Policy
This Privacy Policy explains how Sharikat al-Marfa Ltd. (“Prop Hub”, “we”, “us”) collects, uses, discloses and protects personal data when you use our website prop-hub.pro and related services (the “Service”). By using the Service you agree to this Policy.
1. Who we are
Sharikat al-Marfa Ltd.
Suite 3, 1st Floor, La Ciotat Bld., Mont Fleuri, Mahe, Seychelles
Contact: [email protected]
2. Data we collect
| Category | Examples |
|---|---|
| Account | Email address; name and Google account identifier if you sign in with Google. |
| Authentication & security | Hashed password, two-factor (2FA) status, session and device identifiers, device fingerprint, IP address, browser/user-agent. |
| Approximate location | Country, region and city derived from your IP address (for security, fraud prevention and impossible-travel detection). |
| Identity verification (KYC) | Images of your government-issued ID, a selfie/liveness video and the biometric face template derived from it, device and IP signals — captured by our verification provider Didit when you choose to verify (required for payouts). We keep only the verification result and the data listed in section 5. |
| Payments & payouts | Payment metadata (amount, status, invoice/transaction IDs) and the crypto wallet address and network you provide for payouts. Payments are processed by our payment providers; we never receive wallet private keys or seed phrases. |
| On-site behaviour (security) | Pages you open on our sites (prop-hub.pro and its subdomains), active time on the page and on its sections, buttons and links you click (the button code and its on-screen label, or the link address — never the text you type into fields), and moves between our sites. Linked to a random visitor identifier and, after sign-up, to your account. Used only to prevent fraud and abuse of bonuses; collected regardless of analytics consent, kept for 90 days (the detailed event log — up to 180 days), not used for advertising and not shared. |
| Usage & analytics | Pages viewed, interactions, referrer, and marketing attribution (UTM tags, click IDs). Collected via Google Tag Manager and Yandex.Metrika only after you consent to cookies. |
| Communications | Messages and support requests you send us. |
3. Cookies & similar technologies
We use cookies and local storage for two purposes:
- Essential — session and security cookies required to operate the Service and keep you signed in, and a random first-party visitor identifier (
ph_device, cookie and local storage) used for security and anti-fraud, including the on-site behaviour record described above. These are always active. - Analytics — Google Tag Manager and Yandex.Metrika (which may include Webvisor session recording). These load only after you click “Accept” on the cookie banner; “Essential only” is offered with equal prominence. Until you accept, no analytics scripts run and no analytics cookies are set.
You can change your choice or withdraw consent at any time — as easily as you gave it — via the “Cookie settings” link at the bottom of every page of prop-hub.pro and app.prop-hub.pro (choose “Essential only”). Withdrawal removes the analytics cookies; it does not affect the lawfulness of processing before the withdrawal (Art. 7(3) GDPR). Each choice — accept, reject or withdraw — is recorded as a consent receipt: the exact banner text you saw (version and language), the time, the page, your IP address, browser and a random device identifier, so that we can demonstrate consent (Art. 7(1) GDPR).
4. How and why we use your data
- Provide, operate and secure the Service (accounts, challenges, funded accounts, payouts).
- Security and anti-fraud — detect account takeover, multi-accounting, abuse of the welcome bonus, bots and anomalous logins (including IP geolocation, impossible-travel analysis, behaviour on our sites and similarity between accounts). This is our legitimate interest in protecting the Service and its users.
- Identity verification (KYC) required before payouts, including checks that you are 18+, that the document is valid, that one person holds one account, and (where enabled) sanctions/AML screening.
- Process entry-fee payments and profit payouts.
- Analytics and product improvement (with your consent).
- Comply with legal obligations and enforce our Terms.
5. Identity verification (KYC)
Before your first payout we ask you to verify your identity. Verification is performed by Didit (didit.me), acting as our processor: you are taken to Didit’s secure page, where you photograph your ID document and record a short selfie video.
- What Didit processes: document images and data (name, date of birth, document number, issuing country, nationality, expiry date), the selfie/liveness video and a biometric face template used to confirm that you are a live person and that you match the document photo, device and IP information (e.g. VPN or data-centre detection), and — where we enable it — screening against sanctions and politically-exposed-person lists. The checks currently used are shown on the verification page.
- Consent to biometric processing: by starting verification you consent to the processing of your biometric data for this single purpose. You can decline, but payouts will then be unavailable.
- What we keep: the result (approved / declined and the reason), your full name, date of birth, document type, issuing country and nationality, document expiry date, verification date and risk flags. We do not store your document images, selfie or video, and we keep the document number only as an irreversible cryptographic hash (to detect one document being used on several accounts).
- Validity: a successful verification is valid for 180 days; after that we ask you to verify again before the next payout.
- Automated decisions: verification results are produced automatically. Where a result is unclear it is reviewed by our staff, and you can contact [email protected] to request a human review of a declined verification.
- Retention: Didit stores verification media under its own retention policy and our instructions; you may ask us to have it deleted, subject to legal obligations to keep KYC records.
6. Third parties we share data with
- Google — for “Sign in with Google” authentication.
- Payment providers (Plisio, CoinRemitter, TryBit) — to accept entry-fee payments in crypto.
- Didit — identity verification (KYC) before payouts, see section 5.
- Resend — delivery of transactional and support emails.
- ip-api.com — to resolve approximate location from IP for security.
- Google & Yandex — analytics, only after consent.
- Hosting and infrastructure providers — to run the Service.
- Polymarket — we read publicly available market data from Polymarket; we do not send your personal data to Polymarket.
- Authorities — where required by law or to prevent fraud or harm.
7. International transfers
We are established in the Seychelles and use service providers located in various countries. Where personal data is transferred internationally, we take reasonable steps to ensure it remains protected.
8. Retention
We keep personal data for as long as your account is active and as needed to provide the Service, and thereafter as required to meet legal, accounting, security and anti-fraud obligations (KYC/AML records in particular are retained for statutory periods). The on-site behaviour record is deleted after 90 days of inactivity.
9. Security
We protect data with encryption in transit, hashed passwords (argon2id with a server-side secret), access controls, session and refresh-token protections, and continuous anti-fraud monitoring. No method of transmission or storage is completely secure, but we work to protect your data.
10. Your rights
Subject to applicable law, you may request access to, correction or deletion of your personal data, object to or restrict certain processing, and request portability. To exercise these rights contact [email protected]. Some data (e.g. KYC/AML records) may be retained where the law requires.
11. Children
The Service is intended only for individuals aged 18 or older. We do not knowingly collect data from anyone under 18.
12. Changes
We may update this Policy. Material changes will be posted on this page with a new “Last updated” date.
13. Contact
Questions about this Policy: [email protected].