This policy explains what personal data TradeXtool processes, why, and what your rights are. We keep it short because we collect as little as we can.
Who is responsible
to be added, to be added (KvK to be added) is the controller of your personal data. Contact: support@tradextool.com.
What we process
Account: email address, name and username, and a salted hash of your password (never the password itself). If you sign in with Google: your Google account ID, name and verified email address.
What you build and run: your strategies, runs, backtests, signals and paper positions.
TradeX AI: what you type into TradeX AI and the strategy it returned, so you can open earlier builds again and so we can see what it costs. Deleted with your account.
Exchange connections: API keys you add, stored encrypted. We refuse keys that can withdraw funds.
Subscription: plan, status and dates, and Stripe's customer and subscription IDs. Your card details go to Stripe directly; we never see or store them.
Security logs: sign-ins, your IP address and browser type, and important account actions, to protect your account.
Visitor counts: we count how many people visit and which pages they open, so we know whether anyone is finding us. We do not store your IP address for this. Each day we generate a random key, and your address plus browser is turned into a short one way code with it. That lets us count how many different people came, never who. We throw the key away after two days, and from then on no code can be traced back to an address, not even by us. Because of that we cannot recognise you from one day to the next: someone visiting on three days counts as three. Of the site that linked you to us we keep only its name, never the full address. There are no tracking cookies and no third party analytics.
Why, and on what basis
To provide the service you signed up for: performance of the contract (GDPR art. 6(1)(b)).
To keep accounts secure and prevent abuse: legitimate interest (art. 6(1)(f)).
To keep invoices and payment records for as long as tax law requires: legal obligation (art. 6(1)(c)).
We do not sell your data, do not use it for advertising, and do not build profiles about you.
Who else processes it
OVHcloud: our servers, located in Canada. The EU recognises Canada as offering an adequate level of data protection.
Stripe: payments and invoices.
Google: only if you choose to sign in with Google.
Zoho: our business email (EU data centre), for messages you send to support.
Anthropic: only when you use TradeX AI. The text you type (and, when you ask for a change, the strategy you are editing) is sent to Anthropic's API to build the strategy. Nothing else about you is sent, and under Anthropic's commercial terms it is not used to train their models. Anthropic is based in the United States; the transfer is covered by its data processing terms, which include the EU standard contractual clauses.
Market data comes from public exchange feeds and contains no personal data.
How long we keep it
As long as you have an account. When you delete your account, your data is deleted straight away; security logs are kept without your name. Payment records are kept for the period tax law requires (seven years in the Netherlands).
Cookies
One functional cookie that keeps you signed in, and a short-lived one during Google sign-in. No tracking or advertising cookies, so there is nothing to consent to.
Your rights
You can see, correct, download and delete your data yourself on your account page ("Download my data", "Delete account"). You can also ask us to restrict or stop processing, or object to it. If you think we handle your data wrongly, you can complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
Security
Encrypted connections everywhere, passwords stored as salted hashes, API keys encrypted at rest, and server access only with keys, never passwords.