Privacy Policy
1. Data we collect
Email address, password (hashed), purchase history, license activations (account ID + timestamp), support communications. If you use TradeLens Cloud, we also store the trade history you import or sync — instruments, entry and exit prices, volumes, profit/loss, and timestamps — so the app can compute your statistics and the AI coach can review your trades. We do not collect your MT5 broker password (the optional MT5 connection is read-only; its investor password is never stored by us — it is passed once to our broker-connectivity processor, MetaApi, to establish the read-only connection and is held only by them), your live account balance or funds, or browsing data outside ProEA pages.
2. How we use data
Account access, license validation (verify your EA is on a permitted MT5 account), customer support, requested emails, product improvement and advertising measurement. We measure page visits, clicks, engagement and conversions. Optional analytics can associate activity with browser identifiers; this is not the same as anonymous aggregate reporting. Advertising measurement may send hashed contact details and event identifiers to the platforms below when enabled under the cookie choice described in §6. For TradeLens Cloud, imported trade data powers your own dashboard and AI coaching. We do not sell or rent that trade history.
3. Third-party processors
Supabase provides authentication and database storage; Stripe processes payments (card data never touches our servers); Resend delivers transactional emails and marketing emails you request; Vercel hosts the site and provides cookieless web analytics. When configured, PostHog provides product analytics and may provide session replay according to its project settings, while Meta, X and Google provide advertising measurement. These optional integrations follow the cookie choice described in §6. Only if you connect an MT4/MT5 account for auto-sync, MetaApi processes your read-only investor password and the trade history it retrieves to sync your trades.
4. Data retention
Active accounts: until you delete. After /account/delete: 30 days for legal/tax retention, then full purge. This includes any TradeLens Cloud trade history you imported. License logs are anonymized (user_id replaced with NULL) on deletion to preserve audit trail.
5. Your rights (PDPA + GDPR)
Access, rectification, deletion, data portability, withdrawal of consent. Most can be exercised in /account; for the rest, email privacy@pulltrade.app and we respond within 30 days.
6. Cookies
Essential cookies keep sign-in and privacy choices working. Optional analytics, session replay and advertising start only after you select Accept. Reject keeps them off. You can change your choice through Privacy choices in the footer. PostHog records only approved public pages, with all inputs masked; member/account pages, checkout, private trade data, browser console logs and network bodies are excluded. New replays are retained for 30 days. We discard client IP addresses after enrichment. Anonymous operational order counts remain separate from consented browsing funnels. Vercel provides cookieless aggregate analytics independently. Email subscriptions are a separate choice and can be cancelled using the unsubscribe link. Contact privacy@pulltrade.app for assistance.
7. Contact
Questions? Email legal@pulltrade.app or use the in-app support widget.