Privacy policy

Data we collect

• Account data: your email address, a hashed password and basic account settings.
• Billing data: subscription status and invoices. Card details are handled by our payment provider; we do not store full card numbers.
• Trading connection data: the details needed to connect your trading accounts — OAuth access tokens for Tradovate, usernames and passwords for Rithmic, and usernames and API keys for TopstepX/ProjectX.
• Trading activity data: account identifiers, balances, equity, positions, orders and fills for the accounts you connect, and the copy settings you configure.
• Technical data: IP address, browser type, device information and logs generated when you use the site and Service.
• Support data: messages you send us.

How we use data

• To provide the Service: connecting your accounts, copying orders, showing your dashboard and copy logs.
• To manage your subscription, take payments and send transactional emails such as sign-in links, receipts and service notices.
• To keep the Service secure, prevent abuse and diagnose problems.
• To answer support requests.
• To meet legal, tax and accounting obligations.

We use trading connection data only to operate the Service on your instructions. We do not sell personal data, and we do not use your trading activity to trade on our own account.

Legal bases

Where data protection law requires a legal basis, we rely on performance of our contract with you (providing the Service), our legitimate interests (security, improving the Service), legal obligations (tax and accounting), and your consent where we ask for it.

Who we share data with

• Trading platforms you connect (such as Tradovate, Rithmic and ProjectX/TopstepX), to place and read orders on your accounts.
• Service providers who process data on our behalf: cloud hosting and trade-execution infrastructure, payment processing and email delivery. They may only use the data to provide services to us.
• Authorities or advisers where required by law or to protect our rights.
• A successor business if CopyFlock is sold or reorganised, subject to this policy.

Security

Data is transmitted over encrypted connections. Access to production systems and credentials is restricted to the people and systems that need it to run the Service. No system is perfectly secure; tell us at once if you suspect unauthorised access to your account. Changing your platform password or revoking access on the platform ends our ability to use the old credentials or token.

How long we keep data

We keep account and trading data while your account is active. When you disconnect a trading account, we stop using its connection details. When you close your CopyFlock account, we delete or anonymise personal data within a reasonable period, except where we must keep records such as invoices for legal or accounting reasons.

Cookies

We use cookies that are necessary to sign you in and keep the Service secure, and local storage to remember preferences such as light or dark mode. If we introduce analytics or other non-essential cookies, we will update this policy and ask for consent where required.

Your rights

Depending on where you live, you may have rights to access, correct, delete or export your personal data, to object to or restrict certain processing, and to withdraw consent. To exercise them, email [email protected]. You can also complain to your local data protection authority.

International transfers

Our service providers may process data in countries other than yours. Where required, we use appropriate safeguards for those transfers.

Children

The Service is not intended for anyone under 18, and we do not knowingly collect their data.

Changes to this policy

We may update this policy. The date at the top shows when it last changed. We will tell you about material changes by email or in the Service.