The data controller responsible for your personal data is:

For any questions or requests relating to your personal data, please contact us at the address above.

We collect the following categories of personal data:

Account data

• Full name
• Email address
• Password (stored in hashed form - never readable)
• Subscription plan and billing status

Trading data

• Trade history imported from connected trading platforms (open/close prices, volume, profit/loss, timestamps)
• Notes and tags you add manually
• Playbook content and strategy rules you create

Payment data

• Payments are processed by Stripe. We do not store your card number or full payment details. We only receive a payment confirmation and a Stripe customer reference.

Technical data

• IP address and browser/device type, collected automatically when you access the Service
• Session data necessary for the Service to function

We use your data solely to operate and improve the Service:

• To create and manage your account
• To provide the journaling, analytics, and reporting features of the platform
• To process your subscription payments via Stripe
• To send transactional emails (account confirmation, password reset, billing notifications, and free trial reminders)
• To respond to your support requests
• To maintain the security and integrity of the Service

We do not use your data for advertising, profiling, or any purpose beyond what is described above.

Under GDPR, we process your personal data on the following legal bases:

• Contract performance - processing your account data and trading data is necessary to provide the Service you subscribed to
• Legitimate interests - processing technical data to maintain security and prevent fraud
• Legal obligation - retaining billing records as required by Portuguese and EU law

Your data is stored on secure servers provided by Amazon Web Services (AWS). AWS is certified under ISO 27001 and other industry security standards.

We implement appropriate technical and organisational measures to protect your data against unauthorised access, loss, or disclosure, including encrypted connections (HTTPS), hashed passwords, and access controls.

We share your data only with the following third-party services, which are strictly necessary to operate the Service:

We do not sell your data to third parties. We do not share your data with advertisers or marketing platforms.

If you arrive at Tracker Fx via an affiliate or referral link, we collect information to attribute the referral correctly and to calculate commissions for approved Affiliates.

What we collect for referral attribution

• The affiliate or referral code present in the URL (e.g., ?ref=XXXX)
• A session cookie and/or localStorage entry to persist the referral within your browser session
• Conversion event data (e.g., when a referred user completes a subscription)

How this data is used

• To attribute new sign-ups to the correct Affiliate for commission purposes
• To calculate, record, and pay Affiliate commissions
• To detect and prevent referral fraud

What is shared with Affiliates

Approved Affiliates can see aggregated statistics in their Affiliate Dashboard — such as total clicks, referral counts, and commission amounts. We do not share individual user identities, email addresses, or personal details with Affiliates.

Referral attribution data is retained for as long as the associated commission record is required for accounting and legal purposes (typically 5 years in Portugal), after which it is anonymised or deleted.

Your data is hosted on Amazon Web Services (AWS) infrastructure. Depending on your region and AWS configuration, data may be processed in data centres located inside or outside the European Economic Area (EEA).

Where data is transferred outside the EEA, we ensure appropriate safeguards are in place, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission, where applicable
• Transfers to countries with an EU adequacy decision
• Reliance on AWS's own GDPR compliance frameworks and Data Processing Addendum

Similarly, Stripe may process payment data in the United States under Standard Contractual Clauses. You may request further information about the specific safeguards in place by contacting us at support@trackerfx.com.

Tracker Fx uses only the cookies strictly necessary to operate the platform. We do not use advertising, tracking, or analytics cookies.

• Session cookies — to keep you logged in during your visit
• Security cookies — to protect against cross-site request forgery (CSRF)
• Referral cookie — stores an affiliate/referral code for attribution purposes (see Section 7). Duration: 30 days or until a subscription is completed
• Preference cookies — to remember UI preferences such as accepted cookie banner. Duration: 1 year

We do not use Google Analytics, Facebook Pixel, or any third-party advertising or tracking technologies.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will:

• Notify the competent supervisory authority (CNPD — Comissão Nacional de Proteção de Dados) within 72 hours of becoming aware of the breach, in accordance with Art. 33 GDPR
• Notify affected users without undue delay when the breach is likely to result in a high risk to their rights and freedoms, in accordance with Art. 34 GDPR

Breach notifications to affected users will be sent to the registered email address and will include a description of the nature of the breach, the categories and approximate number of individuals concerned, the likely consequences, and the measures taken to address it.

If you suspect your account has been compromised, please contact us immediately at support@trackerfx.com.

We do not use automated decision-making or profiling in a way that produces legal or similarly significant effects for you, as defined under Art. 22 of the GDPR.

The analytics and statistics displayed in your Tracker Fx dashboard are derived solely from your own trading data and are provided to you for your personal review — they do not constitute automated decisions about you made by us.

We retain your personal data for as long as your account is active. If you request deletion of your account, we will delete or anonymise your personal data within 30 days, subject to the following exceptions:

• Financial records (invoices, payment history) are retained for 10 years as required by Portuguese tax law
• Affiliate commission records may be retained for up to 5 years for accounting purposes
• Anonymised or aggregated analytics data (which cannot identify you) may be retained indefinitely
• Data we are legally required to retain in connection with a legal claim, investigation, or regulatory obligation

To delete your account and all associated data, contact us at support@trackerfx.com with the subject line "Account Deletion Request".

Under GDPR, you have the following rights regarding your personal data:

• Right of access - request a copy of the personal data we hold about you
• Right to rectification - request correction of inaccurate or incomplete data
• Right to erasure - request deletion of your personal data ("right to be forgotten")
• Right to restriction - request that we limit the processing of your data in certain circumstances
• Right to data portability - request your data in a structured, machine-readable format
• Right to object - object to processing based on legitimate interests

To exercise any of these rights, contact us at support@trackerfx.com. We will respond within 30 days. You also have the right to lodge a complaint with the Portuguese data protection authority, the CNPD (Comissão Nacional de Proteção de Dados), at cnpd.pt.

Tracker Fx is not directed at children. The Service requires users to be at least 18 years of age. We do not knowingly collect personal data from anyone under 18. If we become aware that a minor has created an account, we will delete it promptly.

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top of this page and, where changes are material, notify you by email.

Continued use of the Service after the effective date of any changes constitutes your acceptance of the updated policy.

For any privacy-related questions or to exercise your rights, please contact us: