1. Who is responsible
[Company legal name], [Registered address], is the controller of your personal data for the Service. Contact us about privacy at [email protected].
2. What we collect
| Data | Examples | From |
|---|---|---|
| Account | Email, name, country; password (stored only as a hash by our sign-in provider); two-factor settings | You |
| MT5 connection | MT5 account number, broker server and name, demo or real, hedging or netting, EA version | The EA |
| Trading activity | Trades the EA opens and closes (market, side, size, prices, result, times), skipped trades and why, balance and equity | The EA |
| Settings | Risk size, markets, close-only and confirm-each choices | You |
| Billing | Plan, status, renewal dates and a Stripe customer reference; never your card number | Stripe |
| Technical | IP address, connection times, browser type, security and audit logs | Our systems |
| Phone alerts | A push address for each device you turn alerts on | Your browser |
| Support | What you write to us | You |
We never ask for or store your MetaTrader 5 password, and we do not use advertising trackers.
3. Why we use it
- To provide the Service (performing our contract with you): connecting your terminal, sending trades within your limits, showing your dashboard, sending alerts, billing.
- To keep it safe and working (our legitimate interests): preventing abuse and fraud, rate limiting, investigating incidents, improving reliability.
- To meet legal duties: accounting, tax and answering lawful requests.
- With your consent: phone alerts, and optional emails about new products. You can withdraw consent at any time.
4. Where it is kept
Our database and servers are in the European Union (Frankfurt, Germany). Some providers below may process data outside the EU; where they do, they use safeguards such as the European Commission's standard contractual clauses.
5. Who processes it
- Supabase — database and sign-in (EU, Frankfurt).
- Amazon Web Services — our servers and account emails (EU, Frankfurt).
- Cloudflare — website hosting, network security and the bot check on sign-up.
- Stripe — payments and invoices.
- Push services of your browser or phone (Google, Apple, Mozilla) — deliver alerts; the alert text is encrypted for your device.
We do not sell your data. If you open an account through a partner broker link, the broker receives only what you give it; we may learn that a referred account was opened, for commission purposes.
6. How long we keep it
- Account, settings and trading activity: while your account is open, then up to [6] years for legal and accounting reasons.
- Billing records: as long as tax law requires.
- Technical and security logs: up to [12] months.
- Push addresses: until you turn alerts off or the push service drops them.
7. Your rights
Depending on where you live, you can ask to access, correct, delete or export your data, object to or restrict some uses, and withdraw consent. Write to [email protected] from your account email; we answer within one month. You can also complain to your data protection authority.
8. Security
Data is encrypted in transit and at rest, access is limited to the people and systems that need it, staff use two-factor sign-in, and every customer only sees their own records. See security for how the trading connection is protected.
9. Changes and contact
We will post changes here and email you about important ones. Questions: [email protected].