Privacy Policy

1. Introduction and Scope

This Privacy Policy describes how Tradeiz ("Tradeiz", "we", "us", "our") collects, uses, stores, discloses, and protects personal data when you access or use tradeiz.com, our APIs, embedded charts, browser extensions, mobile applications, and any related services (collectively, the "Platform"). It also explains the rights you have over your personal data under the European Union General Data Protection Regulation ("GDPR"), the UK General Data Protection Regulation ("UK GDPR"), the California Consumer Privacy Act / California Privacy Rights Act ("CCPA/CPRA"), the Personal Information Protection and Electronic Documents Act ("PIPEDA"), the Lei Geral de Proteção de Dados ("LGPD"), Singapore's Personal Data Protection Act ("PDPA"), and other applicable laws.

For the purposes of GDPR / UK GDPR, the data controller is Tradeiz. You may contact us at [email protected] for any privacy-related inquiry.

2. Personal Data We Collect

We collect the categories of personal data described below. We collect only what is necessary to operate the Platform, provide the services you request, and comply with our legal obligations.

2.1 Account and Authentication Data

• Email address (required to register and authenticate).
• Hashed password (we never store plaintext passwords; passwords are hashed using a memory-hard algorithm with per-user salt).
• Display name or username, if you provide one.
• Authentication tokens, session identifiers, and refresh tokens.
• OAuth identifiers from third-party sign-in providers (Google, GitHub, Apple) where you choose to use them, limited to subject, email, and display name claims.

2.2 Payment and Subscription Data

• Billing email, country, and tax-residency information necessary to issue invoices.
• Subscription tier, renewal status, and transaction history.
• Payment-method tokens issued by our payment processor (Stripe). We do NOT store full card numbers, CVCs, or bank account numbers on Tradeiz infrastructure; that data is handled exclusively by our PCI-DSS-compliant processor.

2.3 Usage and Telemetry Data

• Pages visited, features used, charts opened, timestamps, and time spent on each view.
• Symbols, exchanges, intervals, overlays, and indicators you load or configure.
• YeScript strategies you save, share, mark as public, or fork from the community library.
• AI conversations: messages you send to the Tradeiz AI, the assistant's replies, tool-call traces (which read tools / write tools / data tools were invoked, with arguments and results), backtest metrics, and timing data.
• Error logs, stack traces, and performance metrics produced by your client.

2.4 Device and Network Data

• IP address, approximate geographic location derived from IP, and country (used for rate-limiting, fraud detection, and to satisfy jurisdictional restrictions).
• User-agent string, operating system, browser version, screen resolution, and device type.
• Referrer URL when you arrive at the Platform from an external link.
• Performance timing (page load, WebSocket latency, render duration).

2.5 Cookies and Similar Technologies

We use cookies, localStorage, sessionStorage, and similar browser-storage technologies as described in our Cookie Policy. We do not use cookies that require consent until you have provided that consent via the on-site cookie banner, except for strictly necessary cookies (session, authentication, CSRF, language preference, and consent state itself).

3. Lawful Bases for Processing (GDPR / UK GDPR)

Where the GDPR or UK GDPR applies, we process personal data on one or more of the following lawful bases:

• Performance of a contract (Art. 6(1)(b)) — to deliver the service you signed up for, including account access, payment processing, subscription management, and core Platform features.
• Legitimate interests (Art. 6(1)(f)) — to secure the Platform, prevent fraud and abuse, improve our services, conduct internal analytics on aggregated and de-identified data, and communicate service-related notices. Where we rely on legitimate interests, we have conducted a balancing test to ensure your rights and freedoms do not override those interests.
• Consent (Art. 6(1)(a)) — for non-essential cookies, marketing emails (where applicable), and any optional data collection. You can withdraw consent at any time via the in-product preferences page and by clearing the consent cookie.
• Legal obligation (Art. 6(1)(c)) — to respond to lawful requests by public authorities, comply with anti-money-laundering and counter-terrorist-financing obligations where applicable, and retain records as required by law.

4. How We Use Personal Data

• To create, maintain, and secure your account.
• To deliver, operate, and improve the Platform, including the Tradeiz AI, the YeScript editor, charting, real-time data feeds, and screener.
• To process subscription payments and provide invoicing.
• To detect, prevent, and respond to fraud, security incidents, and abuse (including rate-limiting and bot detection).
• To communicate with you about your account, service updates, security advisories, and changes to legal terms.
• To send product announcements, where you have opted in (and where applicable law allows).
• To comply with legal, regulatory, and audit obligations.
• To conduct internal research and analytics on aggregated, de-identified, or pseudonymised data.

5. How AI Conversations Are Handled

When you use the Tradeiz AI assistant, the following data flow applies:

• Your messages, the assistant's replies, tool-call traces, and conversation metadata (title, timestamps, message counts) are stored in our database against your account. You can list, rename, and soft-delete conversations from the in-product conversation history panel.
• To produce a reply, your message is sent to a large language model operated by a third-party AI provider under a business-grade contract that prohibits the provider from training on your inputs or outputs. The provider's name and contractual safeguards are not disclosed publicly to protect competitive positioning and to prevent prompt-injection / jailbreaking attempts; we will disclose them upon a verified data-subject access request.
• Tool calls produced by the AI may query our backend market-data services (Layer B tools) using your authenticated session. These queries are subject to the same rate-limiting and authorisation checks as any other user request and are logged for security and abuse-detection purposes.
• The AI cannot access your password, payment tokens, or other sensitive credentials. Its read scope is limited to chart state, market data, and your own saved strategies.
• You may permanently delete an AI conversation at any time by clicking "Delete conversation" in the history panel; deletion is processed as a soft delete with a 30-day grace period before permanent removal from active stores, after which removal from immutable backup snapshots completes within the standard backup-rotation window (up to 90 days).

6. Sharing and Disclosure

We do not sell your personal data. We may share personal data with the following categories of recipients only as necessary:

• Service providers / processors — including our infrastructure provider (cloud hosting), payment processor (Stripe), email delivery provider, error-tracking service, and AI model provider. Each processor is bound by a written data-processing agreement that meets the requirements of Art. 28 GDPR (where applicable) and limits processing to the purposes we instruct.
• Authorities, regulators, courts — where we are required by law, lawful court order, or governmental request, and where we have reasonably determined that the request is valid and properly issued.
• Successors — in connection with a corporate transaction such as a merger, acquisition, financing, or sale of assets, subject to the same protections described in this Policy.
• With your consent — for any other recipient, only where you have given explicit consent.

7. International Data Transfers

The Platform is operated on infrastructure that may be located outside your country of residence, including in jurisdictions that may not provide a level of data protection equivalent to that of your home jurisdiction. Where we transfer personal data from the European Economic Area, the United Kingdom, or Switzerland to a country not deemed "adequate" by the relevant authority, we rely on the European Commission's Standard Contractual Clauses (or the UK International Data Transfer Addendum), together with supplementary technical, organisational, and contractual measures, as required.

8. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying any legal, accounting, or reporting requirements:

• Account data — retained while your account is active and for up to 24 months after closure (to allow for account reactivation), after which it is deleted or anonymised.
• Payment / invoicing data — retained for the period required by applicable tax and accounting law in the relevant jurisdiction, typically 7 to 10 years.
• AI conversation data — retained until you delete the conversation, plus a 30-day soft-delete grace period before purge from active stores; backup snapshots are rotated on the standard cycle (up to 90 days).
• Server logs — IP-bearing logs are retained for up to 90 days for security and abuse-detection purposes; aggregated, IP-stripped analytics may be retained longer.
• Marketing-consent records — retained for as long as you remain subscribed, plus 24 months thereafter to evidence consent or withdrawal.

9. Your Rights

Depending on your jurisdiction of residence, you have the following rights:

• Right of access — to obtain confirmation of whether we process your personal data and, if so, a copy of that data.
• Right to rectification — to have inaccurate or incomplete personal data corrected.
• Right to erasure ("right to be forgotten") — to request deletion of your personal data, subject to legal-retention exceptions.
• Right to restriction of processing — to ask us to limit how we process your personal data in specified circumstances.
• Right to data portability — to receive your personal data in a structured, commonly used, machine-readable format and to transmit it to another controller where technically feasible.
• Right to object — to object to processing based on legitimate interests, including profiling, and to direct marketing.
• Rights against automated decision-making — not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects. The Tradeiz AI does not make automated decisions of this nature; all trading and investment decisions remain under your control.
• Right to withdraw consent — where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.
• Right to lodge a complaint — with a data-protection supervisory authority in your jurisdiction.

For California residents, you additionally have the rights to know what personal information we collect, to delete, to correct, to opt out of "sale" or "sharing" (we do not sell or share for cross-context behavioural advertising), and to limit use of sensitive personal information.

To exercise any right, contact [email protected]. We will respond within the timelines required by applicable law (generally within 30 days, extendable by 60 days for complex requests under GDPR).

10. Security

We implement technical and organisational measures designed to protect personal data against unauthorised or unlawful processing, accidental loss, destruction, or damage. These measures include encryption in transit (TLS 1.2+), encryption at rest for sensitive fields, role-based access controls, audit logging, network segmentation, periodic security review, and incident-response procedures. No method of transmission over the Internet or method of electronic storage is 100% secure; we cannot guarantee absolute security.

11. Children's Privacy

The Platform is not directed to individuals under the age of 18. We do not knowingly collect personal data from children under 18. If we become aware that we have collected personal data from a person under 18 without verifiable parental consent, we will delete that data.

12. Changes to this Policy

We may update this Privacy Policy from time to time. When we make material changes, we will provide notice through the Platform and update the "Last Updated" date at the top of this page. Your continued use of the Platform after such changes constitutes acceptance of the updated Policy.

13. Contact

Privacy inquiries and rights requests: [email protected]
General support: [email protected]

See also: Terms of Service · Cookie Policy · Disclaimer · Risk Disclosure.