Privacy policy

Luca RuppertSole proprietorship “TradersEdge by ML”[STRASSE HAUSNR][PLZ] GundersheimGermany

Email: support@mltradersedge.com · Phone: [TELEFON]

No data protection officer has been appointed, as there is no legal obligation to do so.

• Account data: email address, display name, password (only as a hash at our auth provider), language, plan.
• Trading data: trades, accounts, setups, notes, ratings, tags and screenshots that you create or import.
• Companion for Windows: login number, server and company name of logged-in MT5 accounts, deals, open positions, balance and equity, device name and app version. The Companion never reads or transmits credentials (passwords).
• Screenshot import: screenshots of your trading history that you upload. They may show your account number, balance, server and trades (symbol, direction, volume, prices, times, profit, costs). The images are processed solely to read the trades and are deleted immediately afterwards; only the trades you confirm in the preview are stored. To limit usage, we count the number of images per day.
• File import: export files (e.g. MT5 report, Tradovate CSV) are read in your browser and not stored. Only the deals and trades detected in them are transmitted and stored.
• Platform credentials: login number, server and investor password. The password is stored encrypted.
• Technical data: IP address, time, browser and error messages in server logs.
• Payment data: For paid plans, [ZAHLUNGSDIENSTLEISTER, z. B. Stripe] processes payment data. We only receive status and billing data, never full card details.

• Providing the app (account, journal, analytics, platform sync, payment processing): performance of contract, Art. 6(1)(b) GDPR.
• Security and abuse prevention (logs, rate limits, detecting master passwords): legitimate interest in secure operation, Art. 6(1)(f) GDPR.
• Anonymization for product improvement, benchmarks, market statistics and internal research: legitimate interest, Art. 6(1)(f) GDPR. Details in the section Anonymized statistics. You can object at any time.
• Legal obligations (e.g. retaining invoices): Art. 6(1)(c) GDPR.

We aggregate trading data from many users in anonymized form to improve TradersEdge, develop our analytics further, create benchmarks and market statistics, and for internal market and strategy research.

• Only groups with at least 20 different users; smaller groups return no result.
• No individual trades, account numbers, logins, email addresses or IDs in the results.
• Grouped into time windows of at least one hour, no earlier than 24 hours after a trade is closed.
• Analyzed internally by us only; never shared with or sold to third parties.

Anonymized results are no longer personal data (Recital 26 GDPR). You can object at any time (Art. 21 GDPR): Settings › Privacy. Learn more under Anonymized statistics.

We use carefully selected service providers who only process data on our instructions. We have concluded data processing agreements (Art. 28 GDPR) with all of them.

• Supabase – database, authentication and file storage; region EU (Ireland).
• Cloudflare – hosting and content delivery network.
• Anthropic PBC (USA) – reading screenshots in the screenshot import (AI model Claude via the Anthropic API). Anthropic processes the images only to provide this service. [TO BE VERIFIED: Anthropic does not use the images to train its models] [TO BE VERIFIED: retention at Anthropic under the agreement – enter period] [TO BE VERIFIED: transfer to the USA based on the EU-US Data Privacy Framework or EU Standard Contractual Clauses]
• [ZAHLUNGSDIENSTLEISTER, z. B. Stripe] – payment processing.
• [E-MAIL-VERSANDDIENST] – sending emails (e.g. confirmation, password reset).
• [ANBIETER SYNC-SERVER, EU] – servers of the sync service for platform connections (EU).

When connecting a platform, our sync service signs in to your broker's or prop firm's server with your credentials. That server is an independent controller.

Where service providers process data in the USA, transfers are based on the EU-US Data Privacy Framework or EU Standard Contractual Clauses (Art. 45, 46 GDPR).

• Investor passwords are stored encrypted. Only the sync service can decrypt them; they are never logged and never returned to the browser.
• Database-level access control (row-level security): each user only sees their own data.
• All connections are encrypted with TLS.

• Account and trading data: until your account is deleted.
• Investor password: until you disconnect; it is then deleted immediately.
• Import files: not stored, only processed in your browser.
• Screenshots: deleted immediately after reading; the daily image counter until your account is deleted.
• Companion devices: until you revoke them or delete your account; we only store a hash of the device token.
• Server logs: [X] days.
• Billing data: according to statutory retention periods (up to ten years).

We only use technically necessary entries: login session (cookie), language (cookie) and theme (local storage). There are no tracking cookies and no analytics or advertising services. Should we use such services in the future, we will ask for your consent first.

You have the right of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to withdraw consent (Art. 7(3) GDPR).

Right to object (Art. 21 GDPR): You can object at any time, on grounds relating to your particular situation, to processing based on legitimate interests. You can object to the use for anonymized statistics without giving reasons via the switch under Settings › Privacy.

You can lodge a complaint with a data protection supervisory authority. The authority responsible for us is the State Commissioner for Data Protection and Freedom of Information of Rhineland-Palatinate (Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz).

For any request, just email support@mltradersedge.com.

We do not make automated decisions with legal effect or similarly significant impact (Art. 22 GDPR).