Privacy Policy
1. Who we are
Tradexilus (“we”, “us”, “our”) is the data controller for the personal data processed through the Tradexilus application and website at trade-discipline-app.vercel.app.
Contact for privacy matters: privacy@tradexilus.com.
2. What data we process
We deliberately keep the data we collect to a minimum. We process:
| Category | Examples | Purpose |
|---|---|---|
| Account data | Email address, name (optional), hashed password | Authentication, account management |
| Billing data | Stripe customer ID, subscription status, plan | Subscription billing, access control |
| Broker connection | MetaApi account ID, broker server name, encrypted login token | Live trade enforcement through MetaApi |
| Trading data | Trade history, journal entries, rule configuration, violation logs | Discipline engine, analytics |
| Technical data | IP address (transient), browser type, timestamps | Security, abuse prevention, debugging |
We do not collect biometric data, location data, health data, or information about political opinions, religious beliefs, sexual orientation, or trade union membership.
3. Legal bases (GDPR art. 6)
- Performance of a contract (art. 6(1)(b)) — for account creation, billing, broker connection, and rule enforcement.
- Legitimate interests (art. 6(1)(f)) — for security, fraud prevention, system reliability, and lightweight product analytics.
- Legal obligation (art. 6(1)(c)) — for invoicing and accounting under Italian tax law.
- Consent (art. 6(1)(a)) — only where explicitly requested (e.g. marketing emails, if any).
4. Sub-processors
We rely on the following service providers, all bound by data-processing agreements:
| Provider | Purpose | Region |
|---|---|---|
| Vercel Inc. | Application hosting and edge delivery | EU / global CDN |
| Neon (Postgres) | Primary database | EU (Frankfurt) |
| Upstash | Redis cache for rule data and worker heartbeats | EU (Ireland) |
| Fly.io | Always-on worker for trade enforcement | EU (London) |
| MetaApi Cloud | Bridge to MT4/MT5 broker accounts | EU (London) |
| Stripe Payments Europe Ltd. | Subscription billing and card processing | EU (Ireland) |
All sub-processors above operate within the EEA. Where data is transferred outside the EEA in the future, we will rely on the European Commission’s Standard Contractual Clauses and additional safeguards as required by Schrems II.
5. How long we keep your data
- Account & trading data: while your account is active, plus up to 12 months after closure to handle disputes and back-ups.
- Billing records: 10 years, as required by Italian tax law.
- Technical logs: up to 90 days.
6. Your rights (GDPR art. 15–22)
You have the right to:
- Access the personal data we hold about you.
- Request correction of inaccurate data.
- Request deletion (“right to be forgotten”) where applicable.
- Restrict or object to processing based on legitimate interests.
- Receive a portable export of your account and trading data.
- Withdraw consent at any time (without affecting prior lawful processing).
- Lodge a complaint with the Italian Garante per la protezione dei dati personali (garanteprivacy.it) or your local supervisory authority.
Requests can be sent to privacy@tradexilus.com. We respond within 30 days as required by GDPR art. 12.
7. Security
Passwords are stored hashed with bcrypt. MetaApi broker tokens are encrypted at rest with AES-256-GCM using a key that is never exposed to the browser. All transport happens over TLS 1.2+. Database access is restricted to our application and worker, not exposed publicly. We use the principle of least privilege internally.
8. Cookies and tracking
We use only strictly necessary cookies (authentication session, language preference). We do not use third-party advertising or cross-site tracking cookies. See the Cookies page for details.
9. Changes
If we materially update this policy we will notify you by email and/or by a banner in the application. The “Last updated” date above always reflects the current version.