Privacy Policy

Effective date: 21 October 2026. This policy explains what personal information PumpkinVine (operated by KILLARA SECURITIES PTY LTD, "we", "us") collects when you use this website, our trading terminals and related services, how we use it, who we share it with, and the rights you have. We handle personal information in accordance with the Privacy Act 1988 (Cth) and the Australian Privacy Principles.

• To create and sign in to your account, and confirm that actions come from you (e.g. verification codes).

• To open trading accounts, execute orders, assess challenge and practice results, and pay rewards and rebates.

• To process deposits and withdrawals, and verify who is withdrawing to prevent fraud and money laundering.

• To answer support requests and send notices about your account and trading.

• To keep the platform secure and stable, investigate faults, and meet legal, regulatory and audit obligations.

We do not sell your personal information or use it for third-party advertising.

You can choose "Continue with Google" to sign in or sign up. We then use Google Sign-In (OpenID Connect, requesting only the basic openid, email and profile scopes) and receive an identity token signed by Google. From it we read and store only two things: your Google account's unique ID and your email address (and we check that Google has verified that email). We do not access your contacts, Google Drive, Gmail or any other Google data, and we do not store your Google profile photo.

• This data is used only for the sign-in and account purposes above. It is not used for advertising, not sold, not shared with any third party (except where required by law), and not used to develop, improve or train any artificial intelligence or machine learning models.

• PumpkinVine's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

• Storage and protection: it is kept with your other account information in our database in Alibaba Cloud's Hong Kong region, encrypted in transit, and accessible only to the operations staff who need it.

• Retention and deletion: we keep it for as long as your account exists. You can email [email protected] at any time to unlink Google or close your account, and we will delete this Google data (except records we must keep by law). You can also revoke PumpkinVine's access at any time in your Google Account settings (myaccount.google.com/permissions).

This website sets a single cookie to remember your language. Your sign-in session and a few interface preferences (such as trade alerts and notices you have dismissed) are kept in your browser's local storage; signing out or clearing your browser data removes them. We do not use advertising or analytics cookies or scripts. The sign-in and sign-up pages load Google's sign-in component, which is governed by Google's privacy policy.

Only as far as needed to provide the service, with:

Identity documents are used only to verify who is withdrawing. Only reviewers can see them, every view is logged, and they are not given to any third party unless the law requires it.

Our servers and database are hosted in Alibaba Cloud's Hong Kong region. Cloudflare and Google may process information related to their services in their global locations, including the United States. By using the service you acknowledge that your personal information will be transferred outside Australia; we require these providers to protect it to a standard comparable to this policy.

• Account, trading and funds records: for as long as your account is open, then for the period required by law and regulation (generally at least 7 years), after which they are deleted or anonymised.

• Identity documents: retained long-term for compliance and later review, including after verification is approved.

• Server and access logs: as needed for operations, generally no longer than 6 months.

All traffic uses HTTPS; passwords are stored only as hashes; sensitive fields such as exchange passwords are encrypted at rest; the database is reachable only from our private network and is backed up daily; admin access is role-based and views of sensitive data are logged. No system is perfectly secure. If a data breach is likely to cause you serious harm, we will notify you and the regulator as the law requires.

• Access and correction: you can view and edit most of your information on your account pages at any time; contact us to access or correct anything else.

• Closing your account: you can ask us to close your account, and we will delete or anonymise your information as far as the law allows (records we must keep by law excepted).

• Complaints: if you believe we have mishandled your personal information, please contact us first; we will respond within 30 days. If you are not satisfied, you can complain to the Office of the Australian Information Commissioner (OAIC, www.oaic.gov.au).

The service is only for people aged 18 or over. We do not knowingly collect information from minors and will delete it if we find we have.

When our practices change we will update this page and its effective date; for significant changes we will also tell you by email or an in-app notice.