Privacy policy.

1. The short version

We collect the minimum needed to run your rules and show you your own history. We never store your MT5 password and cannot see it. We do not sell personal data, run advertising, or share your trading activity with anyone who is not operating the service.

2. What we collect

Account data: your email address, password hash, and plan/billing status. Payment card details are handled entirely by our payment processor — they never touch our servers.

Connection metadata: broker name, server, and trading account number for each account you connect. Your MT5 password is used to establish the broker connection and is never written to our database; removing the account destroys the connection and the credential with it.

Trading and enforcement history: the trades, rule configurations, and enforcement events needed to evaluate your rules and render your analytics and audit trail. This is your data; it exists so your console works.

Technical data: standard server logs (IP address, user agent, timestamps) kept for security and abuse prevention.

3. What we use it for

Running the service you configured: evaluating rules, enforcing them, and showing you what happened. Operating the business: billing, support, abuse prevention, and legally required records. Product improvement uses aggregated, de-identified data only.

We do not use your data for advertising, do not build profiles for third parties, and do not train models on your trading activity.

4. Who else touches it

A short list of processors, each under contract, each receiving only what their function needs: cloud infrastructure (hosting and storage), a payment processor (billing), an email provider (transactional mail), and an error-monitoring service (crash reports without trading data). We will disclose the current list on request.

We disclose data to authorities only when legally compelled, and we notify you unless the law forbids it.

5. Retention and deletion

Account and trading history are kept while your account is active. When you delete your account, trading connections are severed immediately; personal data is deleted or de-identified within 30 days, except records we must keep for legal, tax, or fraud-prevention purposes, which are kept only as long as required.

6. Security

Data is encrypted in transit and at rest. Infrastructure is isolated per environment, access is role-restricted and logged, and enforcement events are recorded immutably. The full picture — including what we can never see — is on the Security page. Suspected vulnerabilities: security@tradepanda.app.

7. Your rights

Depending on where you live (including under GDPR and CCPA/CPRA), you may have rights to access, correct, export, delete, or restrict the processing of your personal data. Exercise any of them from the console or by emailing support@tradepanda.app — we answer within the legally required window, usually much faster.

We do not discriminate against you for exercising privacy rights, and we do not sell personal data, so there is nothing to opt out of selling.

8. Changes and contact

Material changes to this policy are announced by email or in the console at least 14 days before they take effect. Questions: support@tradepanda.app.