Privacy Policy
Last updated: Effective Date
This Privacy Policy explains how Company Name ("we", "us") collects, uses, stores, and shares personal data when you use our website at stratos-trading.com, the StratOS web app at app.stratos-trading.com (the "Web App"), the StratOS Companion App, StratOS Trading Dashboard, Chrome extension, and related services (collectively, the "Services").
We comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Data controller: Company Name, Registered Address, company number Company Number. Contact: Support Email.
What data we collect
1. Account and subscription data (via Whop)
When you purchase a subscription via our payment partner Whop, we receive from Whop: - Your name and email address - The product/tier you purchased and your subscription status - A Whop-issued license key bound to your purchase - A Whop-issued user identifier (does not include payment details — Whop holds those)
We do not collect or store credit card numbers, bank details, or other payment instrument data. All payment processing is performed by Whop.
2. Licence-validation data
When you activate the desktop applications: - Your licence key (already known to us) - A randomly-generated machine identifier (UUID) created on your machine — not derived from hardware - Validation timestamps
This is used solely to enforce the per-machine licensing limits described in our Terms.
3. Web App workspace data (stored on our servers)
When you use the Web App, we store the following in your private workspace so the service can work: - Strategies you build, convert or upload (including Pine Script and MQL5 code you paste), and their settings - Backtests, optimisation runs, validation reports, case studies and saved results - Your conversations with the AI assistant, and the strategies it builds for you - Market data downloaded through a third-party account you connect (for example Databento), cached for your use only - API keys you choose to connect (for example a Databento or Anthropic key). These are encrypted at rest and never shown again after you save them
Your workspace is private to you. We don't sell it, share it with other customers, or use your strategies to trade. Staff access it only when you ask for support, or where needed for security or legal reasons.
AI processing: when you use the AI assistant, the relevant parts of your conversation and strategy are sent to our AI provider (Anthropic) to generate a response. Anthropic processes this data on our behalf and doesn't use it to train its models under our commercial terms. If you connect your own Anthropic key, those requests are made under your own Anthropic account.
4. Desktop application data (local only)
The desktop applications (Companion App and Trading Dashboard) store the following only on your own machine, and we don't receive it: - Strategy configurations, backtest results, optimisation studies, setfiles - TradingView output you choose to import - MT5 account credentials (Trading Dashboard only, encrypted at rest in your local config)
5. Website analytics
If we use a privacy-friendly analytics tool (currently Analytics Provider — to be confirmed), we collect: - Aggregated page view counts - Referring URL - Country (derived from IP, IP itself not stored) - Browser type and screen size category
This data is aggregated and not linked to any individual.
6. Support correspondence
If you email us or use Discord, we retain the content of those messages so we can support you and improve the product.
7. Beta waitlist
If you join the waitlist, we store your email address, and optionally the markets you trade and how you heard about us. We use it only to invite you to the beta and send launch news. Every email includes an unsubscribe link. Unsubscribing deletes your waitlist entry.
8. Server logs
Our backend (api.stratos-trading.com) logs: - IP addresses (for rate limiting and abuse prevention) — kept up to 30 days - API requests (endpoint paths, timestamps, response codes — not request bodies) - Webhook delivery status from Whop
Why we collect it (lawful basis)
| Data | Lawful basis under UK GDPR |
|---|---|
| Subscription and account info | Contract — needed to deliver the Services you bought |
| Web App workspace data, connected API keys | Contract — needed to run the Web App for you |
| AI assistant conversations | Contract — needed to provide the AI features you use |
| Beta waitlist | Consent — you can withdraw at any time |
| Licence-validation data | Legitimate interest — preventing piracy and per-machine sharing |
| Server logs | Legitimate interest — security, fraud prevention, debugging |
| Support correspondence | Legitimate interest — responding to your support requests |
| Analytics | Legitimate interest — improving the product. Aggregated, no consent banner required |
| Email marketing (if any) | Consent — only sent if you opt in |
Who we share data with
We do not sell your personal data. We share with:
- Whop Inc. — for payment processing and subscription management
- Cloudflare — DNS, web hosting (R2 storage for downloads + backups), bot protection
- Hetzner Online GmbH — hosting our backend and Web App servers in Germany
- Anthropic PBC — AI processing for the AI assistant (see section 3)
- Market-data providers you connect (e.g. Databento) — only the requests needed to download data you choose, made with your own key
- Discord Inc. — only if you join our Discord community; subject to Discord's terms
- Email/analytics providers — when you opt in to email or interact with the website
- Law enforcement or regulators — only if legally required
Some of these are based outside the UK/EEA. We rely on UK adequacy decisions and Standard Contractual Clauses where required for international transfers.
How long we keep it
- Subscription data: as long as you have an active subscription, plus 7 years after termination for accounting compliance
- Web App workspace (strategies, results, AI conversations, cached data, connected keys): while your subscription is active, then deleted 30 days after it ends unless you resubscribe. You can export or delete it at any time
- Waitlist: until you join, unsubscribe, or 18 months pass, whichever is first
- Licence-validation logs: 12 months
- Server logs: 30 days
- Support correspondence: 2 years
- Analytics: 2 years, then aggregated/anonymised
Your rights
Under UK GDPR you have the right to:
- Access — request a copy of the personal data we hold about you
- Rectification — correct inaccurate data
- Erasure — request deletion (subject to legal retention obligations)
- Restriction — ask us to limit processing
- Portability — receive your data in a structured, machine-readable format
- Object — to processing based on legitimate interest
- Withdraw consent — at any time, for any data processed on consent basis
- Lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk
To exercise any right, email Support Email. We respond within one month.
Cookies
The stratos-trading.com website itself uses minimal cookies — only those strictly necessary to deliver the site (no tracking cookies enabled by default). If we add functionality that requires non-essential cookies, a consent banner will be shown.
The Web App uses a strictly necessary session cookie to keep you signed in. The desktop applications don't use web cookies (they communicate via direct API calls, not a browser session).
Security
We protect your data with: - TLS encryption for all API, Web App and website traffic - Encryption at rest for API keys you connect, and isolation of each customer's workspace and strategy code - Encrypted backups (AES-256 via Restic to Cloudflare R2 EU) - Database access restricted to the application service account on the production server - Regular security updates of all hosted infrastructure - No payment data stored on our systems (all processed by Whop)
No system is perfectly secure. If a personal data breach occurs that's likely to result in risk to your rights and freedoms, we will notify the ICO within 72 hours and you directly without undue delay.
Children's data
The Services are not aimed at and not intended for use by anyone under 18. We do not knowingly collect data from minors. If you believe we have inadvertently collected such data, please email us and we will delete it.
International users
If you access the Services from outside the UK, you understand that your data will be transferred to and processed in the UK and EU. By using the Services you consent to this transfer.
Changes to this policy
We may update this policy as our practices change or in response to legal updates. Material changes will be notified by email and posted here with the "Last updated" date adjusted. Continued use of the Services after the effective date constitutes acceptance.
Contact
Privacy enquiries: Support Email Postal: Company Name, Registered Address