Privacy Policy

Effective date: [EFFECTIVE DATE] · Last updated: [LAST UPDATED]

This policy explains what personal data [COMPANY LEGAL NAME] (“we”) collects when you use PipStack, why, and your choices.

1. Who we are

The controller of your personal data is [COMPANY LEGAL NAME], [REGISTERED ADDRESS]. Contact: [PRIVACY EMAIL].

2. What we collect

Telegram identity: your Telegram user ID and username, and messages you send to our bot (for example support requests).
Billing: email address, plan and payment status. Card and wallet details are processed by Stripe and NOWPayments; we don’t receive full card numbers.
Connected trading accounts: the cTrader account numbers you connect, broker name, account type (demo/live), currency, and an encrypted access token issued by cTrader.
Trading activity: the signals processed for you, orders placed, skipped or rejected (with reasons), fills, and your risk settings.
Referral data: if you arrived through a partner link, the partner code (stored for up to 90 days before purchase).
Technical data: basic logs (time, IP address, request type) for security and troubleshooting.

3. What we never collect

Your cTrader or broker password. You sign in on cTrader’s own page; we receive only a revocable access token.
Your Telegram login or session. We read connected channels through a bot added by the channel owner.

4. How we use it

To provide the Service: copy signals into your connected accounts according to your settings, and send you notifications (contract).
To bill you and pay partner commissions (contract, legal obligation).
To keep the Service secure, prevent abuse and fix problems (legitimate interests).
To meet legal obligations, such as tax records [OTHER LEGAL BASES].

Service providers that process data for us: Cloudflare (hosting), Supabase (database), Stripe and NOWPayments (payments), Telegram (messaging), Spotware/cTrader (account connection and trading), and [OTHER PROCESSORS, e.g. error monitoring]. We don’t sell your personal data. If you joined through a partner link, that partner sees aggregated referral and commission figures, not your trades.

6. How long we keep it

Access tokens are deleted when you disconnect or close your account. Trading and billing records are kept for [RETENTION PERIOD] for tax, dispute and audit purposes, then deleted or anonymised.

7. Security

Access tokens are encrypted at rest and decrypted only by the service that places trades. Access to production systems is restricted and logged. No system is perfectly secure; tell us at [SECURITY EMAIL] if you find a problem.

8. Your rights

Depending on where you live, you may access, correct, delete or export your data, object to or restrict processing, and complain to your data protection authority. You can request deletion in the bot or by contacting us. [INTERNATIONAL TRANSFER MECHANISMS]

9. Contact

[PRIVACY EMAIL] · [POSTAL ADDRESS]