Draft — needs legal review before real invites go out
This document was drafted to accurately describe how PiloTrader's beta actually works today, but it uses
placeholder text ([Company Legal Name], [Registered Address],
[Jurisdiction]) where a real legal entity, address, and governing law need to go.
Have a qualified lawyer review it — especially the Risk Disclosure — before this product accepts real money or
scales beyond a small invite-only beta.
This Privacy Policy explains what data PiloTrader collects, why, and the rights you have over it under the
GDPR and UK GDPR. The controller is [Company Legal Name],
[Registered Address].
1. What we collect
Account data — email address, a salted/hashed password (we never store your password itself), and, if you enroll them, a WebAuthn passkey public key or a TOTP secret for two-factor authentication.
Usage data — chat messages and the Plays/positions they produce, your watchlist, settings, and an audit log of account actions (logins, approvals, session activity).
Technical data — IP address and user-agent, kept only against active sessions and short-lived rate-limit windows, not as a standing log.
Referral data — if someone signs up with your referral code, we record that connection.
2. Why we collect it
To provide the Service (running your screens, monitoring positions, enforcing guardrails), to secure your
account, to send account-related email (password resets, email confirmation, and, if you opt in, a performance
digest), and to enforce the invite-only beta and fair-use limits.
3. Email
We confirm new email addresses with a one-time link before sending anything beyond transactional messages
(password resets, the confirmation link itself). The optional performance digest only ever goes to a confirmed
address, and you can turn it off in Settings at any time.
4. What we don't do
We don't sell your data. We don't use third-party advertising trackers. Live market-quote lookups go to our
data provider only for the ticker symbols involved, not any account-identifying information.
5. Where your data lives
Account and trading data is stored on Cloudflare's infrastructure. Optional integrations you or we enable —
email delivery and live market data — are operated by third-party providers acting as processors on our behalf,
bound by their own data-protection terms.
6. How long we keep it
For as long as your account exists. Deleting your account (Settings → Security → "Delete account") erases your
trading data and every trace of your account from our systems immediately and irreversibly — see Section 8.
7. Cookies
We use exactly one cookie: a session cookie that keeps you signed in. It's not used for tracking or advertising,
and there are no third-party cookies.
8. Your rights
Under the GDPR/UK GDPR you have the right to:
Access & portability — download a complete copy of your data any time from Settings → Security → "Download my data".
Erasure — permanently delete your account and all associated data from Settings → Security → "Delete account". This requires your password to confirm and cannot be undone.
Rectification — correct inaccurate account data by contacting us.
Object / restrict processing — contact us to discuss.
Complain to a supervisory authority — you can lodge a complaint with your local data protection authority at any time.
9. Children
The Service is not directed at anyone under the age required to hold a brokerage account in their jurisdiction,
and we don't knowingly collect data from them.
10. Changes
We'll announce material changes to this policy in-app.