Privacy Policy

The data controller responsible for your personal data is:

For any questions or requests relating to your personal data, please contact us at the address above.

We collect the following categories of personal data:

Account data

• Full name
• Email address
• Password (stored in hashed form - never readable)
• Subscription plan and billing status

Trading data

• Trade history imported from connected trading platforms (open/close prices, volume, profit/loss, timestamps)
• Notes and tags you add manually
• Playbook content and strategy rules you create

Payment data

• Payments are processed by Stripe. We do not store your card number or full payment details. We only receive a payment confirmation and a Stripe customer reference.

Technical data

• IP address and browser/device type, collected automatically when you access the Service
• Session data necessary for the Service to function

We use your data solely to operate and improve the Service:

• To create and manage your account
• To provide the journaling, analytics, and reporting features of the platform
• To process your subscription payments via Stripe
• To send transactional emails (account confirmation, password reset, billing notifications, and free trial reminders)
• To respond to your support requests
• To maintain the security and integrity of the Service

We do not use your data for advertising, profiling, or any purpose beyond what is described above.

Under GDPR, we process your personal data on the following legal bases:

• Contract performance - processing your account data and trading data is necessary to provide the Service you subscribed to
• Legitimate interests - processing technical data to maintain security and prevent fraud
• Consent - loading optional analytics cookies (Google Analytics) is based on the consent you give through the cookie banner. You can withdraw consent at any time
• Legal obligation - retaining billing records as required by Portuguese and EU law

Your data is stored on secure servers provided by Hetzner Online GmbH, with data centres located within the European Union. Hetzner is certified under ISO 27001 and other industry security standards.

We implement appropriate technical and organisational measures to protect your data against unauthorised access, loss, or disclosure, including encrypted connections (HTTPS), hashed passwords, and access controls.

We share your data only with the following third-party services, which are strictly necessary to operate the Service:

We do not sell your data to third parties. We do not share your data with advertisers or marketing platforms.

If you arrive at Tracker Fx via an affiliate or referral link, we collect information to attribute the referral correctly and to calculate commissions for approved Affiliates.

What we collect for referral attribution

• The affiliate or referral code present in the URL (e.g., ?ref=XXXX)
• A session cookie and/or localStorage entry to persist the referral within your browser session
• Conversion event data (e.g., when a referred user completes a subscription)

How this data is used

• To attribute new sign-ups to the correct Affiliate for commission purposes
• To calculate, record, and pay Affiliate commissions
• To detect and prevent referral fraud

What is shared with Affiliates

Approved Affiliates can see aggregated statistics in their Affiliate Dashboard - such as total clicks, referral counts, and commission amounts. We do not share individual user identities, email addresses, or personal details with Affiliates.

Referral attribution data is retained for as long as the associated commission record is required for accounting and legal purposes (typically 5 years in Portugal), after which it is anonymised or deleted.

Your data is primarily processed within the European Union: Tracker Fx is hosted on Hetzner Online GmbH infrastructure located in the EU. However, certain third-party services we rely on may process data outside the European Economic Area (EEA):

• Stripe processes payment data in the United States under European Commission Standard Contractual Clauses (SCCs).
• Google Analytics (only loaded if you accept analytics cookies) processes data in the United States. Google is certified under the EU-U.S. Data Privacy Framework and relies on Standard Contractual Clauses for transfers.

Where data is transferred outside the EEA, we ensure appropriate safeguards are in place, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• Transfers to countries with an EU adequacy decision
• Reliance on each provider's own GDPR compliance frameworks and Data Processing Addenda

You may request further information about the specific safeguards in place by contacting us at support@trackerfx.com.

Tracker Fx uses cookies in two categories: strictly necessary cookies to operate the platform, and optional analytics cookies to understand how visitors use the website. You can accept or reject analytics cookies via the consent banner shown on your first visit; your choice is remembered locally and can be changed at any time by clearing your browser storage for this site.

Strictly necessary (always active)

• Session cookies - to keep you logged in during your visit
• Security cookies - to protect against cross-site request forgery (CSRF)
• Referral cookie - stores an affiliate/referral code for attribution purposes (see Section 7). Duration: 30 days or until a subscription is completed
• Consent storage - your cookie banner choice is stored in your browser's localStorage. Duration: until cleared

Analytics (only with your consent)

• Google Analytics 4 - measures aggregated traffic, page views, and traffic sources to help us improve the website. IP addresses are anonymised before storage. We do not use Google Signals or cross-device advertising features. Duration: up to 14 months

We do not use Facebook Pixel, advertising cookies, or any other third-party advertising technologies.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will:

• Notify the competent supervisory authority (CNPD - Comissão Nacional de Proteção de Dados) within 72 hours of becoming aware of the breach, in accordance with Art. 33 GDPR
• Notify affected users without undue delay when the breach is likely to result in a high risk to their rights and freedoms, in accordance with Art. 34 GDPR

Breach notifications to affected users will be sent to the registered email address and will include a description of the nature of the breach, the categories and approximate number of individuals concerned, the likely consequences, and the measures taken to address it.

If you suspect your account has been compromised, please contact us immediately at support@trackerfx.com.

We do not use automated decision-making or profiling in a way that produces legal or similarly significant effects for you, as defined under Art. 22 of the GDPR.

The analytics and statistics displayed in your Tracker Fx dashboard are derived solely from your own trading data and are provided to you for your personal review - they do not constitute automated decisions about you made by us.

We retain your personal data for as long as your account is active. If you request deletion of your account, we will delete or anonymise your personal data within 30 days, subject to the following exceptions:

• Financial records (invoices, payment history) are retained for 10 years as required by Portuguese tax law
• Affiliate commission records may be retained for up to 5 years for accounting purposes
• Anonymised or aggregated analytics data (which cannot identify you) may be retained indefinitely
• Data we are legally required to retain in connection with a legal claim, investigation, or regulatory obligation

To delete your account and all associated data, contact us at support@trackerfx.com with the subject line "Account Deletion Request".

Under GDPR, you have the following rights regarding your personal data:

• Right of access - request a copy of the personal data we hold about you
• Right to rectification - request correction of inaccurate or incomplete data
• Right to erasure - request deletion of your personal data ("right to be forgotten")
• Right to restriction - request that we limit the processing of your data in certain circumstances
• Right to data portability - request your data in a structured, machine-readable format
• Right to object - object to processing based on legitimate interests

To exercise any of these rights, contact us at support@trackerfx.com. We will respond within 30 days. You also have the right to lodge a complaint with the Portuguese data protection authority, the CNPD (Comissão Nacional de Proteção de Dados), at cnpd.pt.

Tracker Fx is not directed at children. The Service requires users to be at least 18 years of age. We do not knowingly collect personal data from anyone under 18. If we become aware that a minor has created an account, we will delete it promptly.

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top of this page and, where changes are material, notify you by email.

Continued use of the Service after the effective date of any changes constitutes your acceptance of the updated policy.

For any privacy-related questions or to exercise your rights, please contact us: