Legal

Privacy Policy

Last updated: 17 October 2026

This policy explains how Visual Markets Software Development Center – FZCO ("Visual Markets", "we") handles personal data on our website, visual.markets, and in Visual Markets Desk ("the App"): the workspace at desk.visual.markets, its apps for computers and phones, the installer, the service behind them at api.visual.markets, and the sign-in and downloads of our licensed products, such as Trading Arena.

1. Who we are
2. Our website
3. The App
4. Licences and workstations
5. Connecting your calendar
6. Cookies and storage in your browser
7. Security
8. Where and how long we keep data
9. Your rights
10. Children, and changes to this policy

1. Who we are

Visual Markets Software Development Center – FZCO
Building A1, Dubai Digital Park, Dubai Silicon Oasis, Dubai, UAE
Licensed by the Dubai Integrated Economic Zones Authority (DIEZ) under License No. 46044
LEI: 254900WQN078IQZD9118 · D-U-N-S Number®: 57-121-5880
Email: office@visual.markets · Phone: +971 54 200 1525

We are responsible for the personal data described here. Partners of Visual Markets may offer the App to their own people under their own brand; their people's accounts and data are kept apart from everyone else's, and the partner's administrators manage those accounts.

2. Our website

• The website has one form, the contact form, and no analytics and no advertising, and sets no cookies. When you send the form, your browser sends your email address, your name if you give one, your message and the role you picked to our server (api.visual.markets); we keep them in our database so that our support staff can read your message and answer you, and we delete them 14 days after you sent them, whether we have answered or not (our support staff may delete them sooner). With them we keep a one-way scrambled form of your internet address (it cannot be turned back into the address), only to stop a flood of messages from one place. When you write to us by email or call us instead, we use your message and contact details to answer you and to follow up on your request.
• If you turn the page's animations off, that choice is kept in your own browser (its local storage), not sent to us.
• The website loads its fonts from Google Fonts, so your browser asks Google's servers for them, which tells Google your IP address and browser. Google handles this under its own privacy policy.
• Our servers keep standard access records (IP address, time, the address requested, browser) for security and to find faults, for a limited time.

3. The App

The App is a private workspace for our teams and partners. Our administrators create the accounts; there is no public sign-up. Every user can create projects, up to a number our administrators set, and leads the projects they create. A team lead can invite users who already have an account into their team, by nickname; you accept or decline, and you can leave a team at any time. Only the people who take part in a project can open it: our administrators manage the accounts, not the projects, and cannot see the content of a project they do not take part in.

What we keep

• Your account: your name, nickname (by which other users find you in the App), email address, role, the projects you take part in and your permissions there, your time zone, when you signed in, and failed sign-in attempts. You can change your name and nickname yourself. If you add a photo, your browser first cuts it to a small square, which also removes its location and camera details; it is shown to the people you share a project or a chat with, and anyone else sees your initials. Your password is kept only as a salted hash. If you sign in with a passkey, we keep its public key; your fingerprint, face or PIN never leave your device. If you turn on the sign-in code, we keep its key encrypted and your recovery codes only as hashes.
• Your devices: each computer or phone that signs in to your account with your password (the App's apps, the installer, our products' core services) makes a key of its own, which never leaves it; we keep only its public half, with the name the device gives (such as "Visual Markets Desk on LAPTOP-7"), which program it is, the internet address it was last seen from, and when it was first and last seen. Your sign-in on that device works only with that key, so a copy of it opens nothing elsewhere. You see your devices under My account and can remove any one, which ends its sign-in at once; you are told in the App when a new device signs in. When you sign out of an app, its sign-in ends on our server too.
• Fingerprint, face or PIN in the apps: if you set it up on a computer or phone (Windows Hello, or your phone's fingerprint, face or PIN), the device keeps a key that works only after you show yourself; we keep only its public half, the device's name, and when it was added and last used. Your fingerprint, face or PIN never leave the device. It confirms that it is you before a password or a code is shown, and the app then opens its kept sign-in only after it. You see and remove these devices under My account; a password reset link or a disabled account removes them all.
• Your work: what you and your team enter: projects, tasks, calendar events (title, time, organizer, participants, location and notes), trading venues and accounts with the ledger accounts linked to them, attachments and other project content.
• Secure Storage: your own groups and cards of logins, passwords, authenticator keys, notes and files. Only you can open it; our administrators cannot. You may share a card of yours into a project where you have full access: the people of that project then read that card, read only (its notes and files excepted), and a password or a code on request; it stays yours, and you take it out at any time. Everything you keep in it is stored encrypted for you alone: every field's value, your notes and their pictures, your files, and what we found about a password (why it is weak, how often it was seen in data breaches); only the names of your groups, cards and fields, and their icons, are not, and the search looks through card and group names only. Passwords, codes and authenticator keys are shown or copied only when you ask, after you confirm it is you (your password, sign-in code, passkey, or fingerprint, face or PIN, for 5 minutes), each time recorded in the activity log without the value. When you save a password, we check it against Pwned Passwords, a public list of passwords from known data breaches, without sending it: only the first 5 characters of its SHA-1 hash leave our server, and the match is made here.
• Your own export: you can make a file of your Secure Storage, projects and ledger accounts to read offline (My account, Export my data), after you confirm it is you. The file is sealed with a password you choose, on your device: in the apps and in the browser (in the version of the App that runs on our server, on that server, as anything shown there). We do not keep the file or its password; the activity log records only that an export was made, and how many items it held.
• Ledger accounts: your own accounts with their ledgers (entries, the statements and files you import, documents, pictures such as a logo, signature or stamp, comments, checks and closed months), and your reporting currency. Only you and the accountants you invite can open them: an accountant reads them and can write only in chats, marks and check comments; you can remove an accountant at any time. Our administrators cannot open them. If you connect an account at a trading venue through the venue's open API, we keep the connection's settings and keep its secrets encrypted for you alone; they are never shown again or recorded, and we use them only to sign in to that venue's API and read your account's balance and ledger when you ask. To convert reports between currencies, our administrators fetch month-end exchange rates from public sources (the European Central Bank and trading venues' open APIs); those requests carry no personal data.
• Chats: the messages, pictures and files you exchange with another user, or with everyone in a project in its chat, the App's own messages there (such as team invitations and their answers, or that a note mentions you), and what each of you has read. A chat between two people is visible only to them, a project's chat only to the people who take part in the project; our administrators cannot read either, and they are not recorded in the activity log. Before a picture is sent, your browser makes it smaller, which also removes its location and camera details. When you delete a chat, it disappears for you; once both people have deleted messages, we delete them, with their pictures and files. A project's chat is deleted with its project.
• Notices: messages from the App itself ("Visual Markets") about the App, such as planned maintenance, in a chat of their own at the top of your chats.
• Support: when you open a request on the Support page, your messages, pictures and files and the answers are kept together in it. The support people and administrators of your organisation (and, when it has no support people, Visual Markets' support people) read the request and a read-only card of your account: your name, nickname and email, its status, when you last signed in, your subscriptions, and the names, addresses and status of the servers you have connected. They never see your projects, your other chats, your Secure Storage or your ledgers, and they cannot set or see your password. Notes they write about a request are for support people only. Each time they open your account card it is written to the activity log. We delete a request, with its messages and notes, 12 months after support has closed it.
• External participants: when a team member adds you to an event, we keep the name and email address they enter, to plan the meeting. If the organizer chooses to send invitations, you receive them from the organizer's own calendar.
• Activity log: a record of changes (who changed what, and when), so that mistakes can be traced and corrected. A project's entries are visible to its team lead, a ledger account's to its holder, your Secure Storage's to you alone; the entries about accounts, sign-ins, licences and workstations to our administrators.
• Usage figures: daily counts for our administrators, such as how many users, projects, tasks, events, chats, messages and files there are and how much storage they take, to plan the App's capacity. They contain no names and no content.

4. Licences and workstations

If you hold a licence for one of our products, such as Trading Arena:

• Your subscription: the plan, its status and dates, and the settings it gives you (for example how many workstations may be active and how many may trade). Every change to it is kept in its history.
• Your workstations: the product's core service signs in with your account when it starts. Each computer makes an identifier for itself (from its equipment and a random part; it says nothing about you), and its sign-in is bound to it and to the computer's own key (see Your devices). We keep, as one of your workstations: that identifier, the computer's name, the IP address it signs in from, when it was first and last seen, the products installed on it, and whether each is active or trading. You see your workstations in the App, and can move them, switch trading on or off, rename and delete them.
• The installer: the installer for Windows signs in with your account and installs the products your plans include. It keeps your sign-in sealed to the computer's security chip (TPM) where the computer has one, so a copy opens nowhere else, and keeps no password.
• Downloads and updates: our products' downloads are open to everyone and need no account. A product or the installer may ask which version is the newest, to offer it to you; it never updates by itself.

5. Connecting your calendar (optional)

You can connect your own Microsoft Outlook or Google Calendar in My account. You grant the access at Microsoft or Google; the App never sees your Microsoft or Google password.

• What the App may access: your email address, to show which calendar is connected; the list of your calendars, so that you can choose among them; and your calendar events, with permission to read and change them. If you also allow meeting links, it may create online meetings with your account (a Microsoft Teams meeting or a Google Meet space), only when you ask for a link in an event. It has no access to your email, contacts, files or any other data.
• What it reads: the events of the calendars you chose, for the period it works on: title, time, location or meeting link, organizer, attendees (names, email addresses and replies) and description.
• What it does with them, only as you choose in My account:
  • copies your calendar's events for the coming days (you choose how many) into a project of yours in the App, one you lead: one only you take part in, or one with your team, whose people then see the copies too (the App warns you before);
  • copies the Visual Markets events you take part in to your calendar, and keeps those copies up to date;
  • for an event you organize and choose to send invitations for, creates it in your calendar as a meeting with the participants who have an email address, so that your calendar sends them the invitation, any updates and the cancellation. Their replies are shown in the App;
  • when you ask for a meeting link, creates the meeting with your account and puts its link in the event's location.
• What we store: the email address of the connected account, a connection token (encrypted, usable only by the App), the identifiers of copied events, and the copies made in the project you chose.
• What we never do: sell calendar data, share it with third parties, use it for advertising, or use it to train artificial-intelligence models. Copies in the App are visible only to the people of the project you chose.
• Ending it: choose Disconnect in My account at any time. The App deletes its connection token and stops all access. Copies already made stay where they are, in your calendar and in the App, until you delete them. You can also withdraw the access at Microsoft (myapps.microsoft.com, or account.live.com/consent/Manage for a personal account) or at Google (myaccount.google.com/permissions).

6. Cookies and storage in your browser

The App uses only the cookies it needs to work: one that keeps you signed in, two that remember if you chose the version of the App that runs on our server and keep that session, and a short-lived one while you connect a calendar. There are no advertising, analytics or tracking cookies. The App's apps for computers and phones keep your sign-in in the device's own secure storage, bound to the device's key and, where you set up fingerprint, face or PIN, sealed behind it; they never keep your password.

7. Security

All connections are encrypted (HTTPS). Passwords are hashed; stored secrets, Secure Storage's contents, sign-in code keys and calendar tokens are encrypted. Sign-ins of the apps, the installer and our products' core services are bound to the device's own key, each renewal is used once, and a sign-in used from two places is ended. Access is limited by role and by permissions in each project, and every change is logged.

8. Where and how long we keep data

The App's data is stored on servers operated by Visual Markets in London, United Kingdom. We keep account and project data while the account or project is in use, and backups of it for a limited time. Activity-log entries are deleted automatically once they are older than a fixed period, the same for everyone (12 months unless we set another, never under 3); nobody deletes them by hand. When an account is disabled, our administrators may hand the projects it led to another participant, archive them (read only), or delete them after telling the people concerned in advance (ledger records are never deleted); its chats with others and its photo may be deleted the same way. Subscriptions are kept with their history after they end. A ledger account is deleted only by its holder, after archiving it. To have your account and its personal data deleted, write to us.

9. Your rights

You can ask to see, correct or delete your personal data, or object to how we use it. Write to office@visual.markets. We answer under the UAE Personal Data Protection Law and, for users in the European Union, the General Data Protection Regulation.

10. Children, and changes to this policy

Our website and the App are not intended for anyone under 18.

When we change how we handle personal data, we update this page; the date at the top shows the current version.