Privacy Policy

1. Data Controller

TradeSave+ ("we", "us", "our") is the data controller responsible for your personal data. We are based in England, United Kingdom, and operate under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. If you have any questions about how we handle your data, please contact us through our Help Center.

2. Information We Collect

We collect the following categories of information:

a) Information you provide directly:

• Account Information: Email address and username when you create an account
• Trading Data: Trade entries, journal notes, performance metrics, and custom fields you input
• Images: Trade screenshots and images you upload, stored securely in our cloud storage
• Support Requests: Email address, subject, and message content when you submit a help request

b) Information collected through third-party authentication:

• Discord OAuth: If you sign in via Discord, we receive your Discord user ID, email address, username, and guild (server) membership information. We use guild membership to verify access eligibility. We do not access your Discord messages, friends list, or other private data.

c) Information collected automatically:

• Payment Information: Processed securely through Stripe — we do not store your card number, expiry date, or CVC on our servers. Stripe provides us with a customer ID, subscription status, and payment history.
• Usage Data: How you interact with our Service, including pages visited, features used, and session duration (only if you consent to analytics cookies)
• Error Data: Application crash reports and performance data collected automatically to help us fix bugs and improve reliability

d) Affiliate and referral data:

• Referral Tracking: If you arrive via an affiliate referral link, we store a referral code in a secure, HTTP-only cookie for 30 days to attribute the referral. If you sign up, we record which affiliate referred you.
• Affiliate Data: If you participate in our affiliate programme, we store your unique referral code, Stripe Connect account ID, commission records, and payout history.

3. How We Use Your Information

We use your information for the following purposes:

• Provide, maintain, and improve the TradeSave+ Service
• Process your subscription payments and manage your account
• Calculate and pay affiliate commissions
• Send important service updates, billing notifications, and security alerts
• Respond to your support requests
• Monitor and prevent fraud, abuse, and security threats
• Analyse aggregated usage patterns to improve our platform (only with your consent for analytics)
• Comply with legal obligations

We do not use your trading data, journal notes, or uploaded images for any purpose other than providing the Service to you. We do not train AI models on your data. We do not sell your personal data to any third party.

4. Lawful Basis for Processing (UK GDPR)

We process your personal data on the following legal bases:

• Contract (Article 6(1)(b)): Processing necessary to provide you with the TradeSave+ Service you have signed up for, including account management, trade data storage, payment processing, and affiliate programme administration
• Consent (Article 6(1)(a)): For analytics cookies, advertising cookies (Google Analytics, Google Ads, TikTok Pixel), and marketing communications where you have opted in. You may withdraw consent at any time.
• Legitimate Interest (Article 6(1)(f)): For improving our Service, preventing fraud, ensuring security, collecting error reports for bug fixing, and enforcing our Terms of Service. We have assessed that these interests do not override your fundamental rights and freedoms.
• Legal Obligation (Article 6(1)(c)): For retaining payment and tax records as required by UK law

5. Data Sharing & Third-Party Services

We do not sell your personal data. We share data with the following service providers, each of which is bound by data processing agreements:

a) Core infrastructure:

• Supabase: Hosts our database and handles authentication. Stores your account data, trading data, journal notes, and images. Supabase Privacy Policy
• Vercel: Hosts our web application. Processes HTTP requests containing your IP address and user agent. Vercel Privacy Policy

b) Payments:

• Stripe: Processes all payments, manages subscriptions, and handles affiliate payouts via Stripe Connect. Receives your email, payment method details, and billing address. Stripe Privacy Policy

c) Analytics & advertising (consent required):

• Google Analytics: Tracks page views and user engagement to help us understand how our Service is used. Only activated if you consent to analytics cookies. Google Privacy Policy
• Google Ads: Measures the effectiveness of our advertising campaigns through conversion tracking. Only activated if you consent to analytics cookies.
• TikTok Pixel: Tracks page views to measure advertising campaign performance on TikTok. Only activated if you consent to analytics cookies. TikTok Privacy Policy

d) Error monitoring:

• Sentry: Automatically collects application error reports and performance data in production to help us identify and fix bugs. This data includes error stack traces and browser information but does not include your trading data or personal notes. Sentry Privacy Policy

e) Third-party authentication:

• Discord: If you choose to sign in via Discord, we use Discord's OAuth2 service to authenticate your identity. We receive your Discord user ID, email, username, and server membership. Discord Privacy Policy

f) Market data providers (Fundamentals feature):

• We fetch economic and market data from third-party APIs (including FinanceFlow, FRED, and public government sources) to power our Fundamentals feature. These API calls are made server-side and do not transmit any of your personal data to these providers.

6. Cookies & Tracking Technologies

We use the following types of cookies and similar technologies:

Essential Cookies (always active):

• Authentication session cookies (keep you logged in)
• Referral tracking cookie (ref_code) — HTTP-only, secure, 30-day expiry, used solely to attribute affiliate referrals
• Cookie consent preference (stored in localStorage)

Analytics & Advertising Cookies (consent required):

• Google Analytics cookies — track page views and user engagement
• Google Ads cookies — measure advertising conversion
• TikTok Pixel cookies — measure advertising performance

You can manage your cookie preferences at any time by clearing your browser cookies and revisiting our site, where you will be presented with the cookie consent banner again. Essential cookies cannot be disabled as they are necessary for the Service to function. We do not use cookies to track you across other websites.

7. Data Security

We implement appropriate technical and organisational measures to protect your personal data, including:

• All data transmitted between your browser and our servers is encrypted using TLS/SSL
• Database access is protected by Row-Level Security (RLS) — each user can only access their own data
• Payment data is handled by Stripe (PCI DSS Level 1 certified) — we never store card details
• API endpoints are rate-limited to prevent abuse
• Authentication tokens are stored in secure, HTTP-only cookies
• Image uploads are isolated per user and validated for file type and size

While we take reasonable steps to protect your data, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security.

8. Data Retention

We retain your data for the following periods:

• Account & Trading Data: Retained while your account is active and for 30 days after account deletion to allow for recovery. After 30 days, all personal data, trading data, notes, and images are permanently deleted.
• Payment Records: Retained for 7 years as required by UK tax law (HMRC requirements)
• Support Tickets: Retained for 2 years after resolution, then deleted
• Affiliate & Commission Data: Retained for 7 years for tax compliance purposes
• Error Logs (Sentry): Automatically purged after 90 days
• Analytics Data: Retained according to Google Analytics and TikTok's standard retention policies (typically 14-26 months)

9. Your Rights Under UK GDPR

You have the following rights regarding your personal data:

• Right of Access: Request a copy of all personal data we hold about you
• Right to Rectification: Request correction of inaccurate or incomplete personal data
• Right to Erasure: Request deletion of your personal data (subject to legal retention requirements)
• Right to Data Portability: Request your data in a structured, commonly used, machine-readable format. You can export your trading data from your account settings.
• Right to Restrict Processing: Request that we limit how we use your data in certain circumstances
• Right to Object: Object to processing based on legitimate interests. We will stop processing unless we can demonstrate compelling legitimate grounds.
• Right to Withdraw Consent: Where processing is based on consent (e.g., analytics cookies), you may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal

To exercise any of these rights, please contact us through our Help Center. We will respond to your request within 30 days. There is no fee for exercising your rights, except in cases of manifestly unfounded or excessive requests.

10. International Data Transfers

Your data may be processed outside the United Kingdom by our service providers:

• Supabase: Database hosting (AWS regions)
• Stripe: Payment processing (United States)
• Vercel: Application hosting (global edge network)
• Google: Analytics and advertising (United States)
• TikTok: Advertising tracking (Singapore/United States)
• Sentry: Error monitoring (United States)

Where data is transferred outside the UK, we ensure appropriate safeguards are in place through Standard Contractual Clauses (SCCs), UK International Data Transfer Agreements (IDTAs), or adequacy decisions made by the UK Secretary of State.

11. Children's Data

TradeSave+ is not intended for use by anyone under the age of 18. We do not knowingly collect personal data from children under 18. If you are under 18, you must not use the Service or submit any personal data. If we become aware that we have collected personal data from a child under 18, we will take steps to delete that information promptly. If you believe a child under 18 has provided us with personal data, please contact us through our Help Center.

12. Automated Decision-Making

We do not use automated decision-making or profiling that produces legal effects or similarly significant effects on you. Subscription management (e.g., feature access based on your plan) is based solely on your chosen subscription tier and is not considered automated profiling under UK GDPR.

13. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you via email or through a prominent notice within the Service at least 14 days before the changes take effect. Your continued use of the Service after the changes take effect constitutes acceptance of the updated policy. We encourage you to review this page periodically.

14. Contact & Complaints

If you have any questions about this Privacy Policy, wish to exercise your data rights, or have a complaint about how we handle your data, please contact us through our Help Center.

If you are not satisfied with our response, you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.