The data we keep, the data we never sell.

This Privacy Policy is effective 2026-10-10, version 2.3. It replaces version 2.2 of 2026-07-14 in full. Among other changes, it now describes sealed calls and their records, paying for Pro, records you choose to publish, and what an educator sees if you join a cohort. Previous versions are available on request from [email protected].

We will notify affected account holders before any material change takes effect where law or contract requires notice, with a summary of what changed and why. Non-material edits (typo fixes, link updates, cross-reference repairs) are made without a separate notice.

TradeLoop is responsible for the personal-data processing described in this notice. No legal name is published in the current company details. For the purposes of the EU and UK General Data Protection Regulation we are the data controller; for the purposes of the India Digital Personal Data Protection Act 2023 we are the data fiduciary; for the California Consumer Privacy Act / California Privacy Rights Act we are the business.

No registered-office address is published in the current company details. For legal correspondence, contact [email protected]. This page does not establish incorporation status or a registration timeline.

Data Protection Officer / Grievance Officer

Use the published privacy contact for requests about retrospective review and retained records. Formal designation of a Grievance Officer or Data Protection Officer is unconfirmed. Publishing an email address does not establish an appointment or staffed response commitment; applicable legal rights and deadlines still apply.

• Designation: Unconfirmed.
• Email: [email protected]. No staffed response window is confirmed here. Opening the link does not submit a request or confirm delivery.
• Escalation: unresolved complaints may be lodged with the supervisory authority in your jurisdiction — see the complaint routes.

Under GDPR Article 6 and the DPDP Act §6, every processing activity has a named lawful basis. The table below mirrors §1.2 of our Data Protection Impact Assessment (DPIA) exactly; the DPIA is an internal record, available on request. If you find a divergence, that's a documentation bug; please email [email protected].

The categories below mirror §1.3 of our DPIA exactly. We do not process any "special category" data under GDPR Article 9 (health, biometric, racial, political, religious, sexual-orientation data). We do not knowingly collect children's data — see children's data.

• Identity: email and name. When you buy Pro, the billing details the payment and its invoice need (such as billing name, address and, if you provide it, GSTIN) are stored with it.
• Authentication: bcrypt password hash, TOTP secret (Fernet-encrypted), refresh tokens, recovery codes. Plaintext passwords are never stored.
• Your evidence: your setups and their frozen versions; the price history you import (bid-price bars for one market per dataset, from the MetaTrader 5 export or CSV you upload, with the provenance you declare); your sealed calls, receipts, beliefs and reports. TradeLoop does not connect to your broker or read your account. Accounts that used earlier TradeLoop products may still hold those products' trade records and derived results until the account is deleted; they are no longer collected.
• Financial — payment: Razorpay payment and order IDs, plan, billing email, and billing GSTIN for Pro payments, refunds, disputes, and invoices, including records of earlier charges. We do not store raw card data; Razorpay processes the payment.
• Evidence — derived: the results computed from your own sealed calls, such as outcomes in R, consistency on repeated charts, and hindsight-check changes, with their intervals. They are private to your account, never pooled with other traders' data, and never sold.
• Operational: login timestamps, IP addresses (transient — kept for security audit log), audit-log entries (HMAC-chained), and content-free usage measures (sign-ins, seals, locks and similar actions).
• Analytics and campaign: after analytics opt-in, a randomised anonymous id, event name and time, route, referrer, UTM labels, and browser user agent. Signed-in events may also link to your account. We do not put your calls, setups, notes, prices, data files, or email in these event payloads.
• Communication preferences: the notifications you switch on and, for device notifications, their push subscription endpoint.

We use a small set of carefully-selected third-party services ("sub-processors") to deliver TradeLoop. A written Data Processing Agreement is required where applicable; inclusion in this notice does not establish that it has been executed. The full register is at /sub-processors with vendor, purpose, data categories, hosting jurisdiction, risk tier, and DPA-execution status.

The current list (also in §1.5 of our DPIA and in our internal vendor register):

• Render (Singapore) — application hosting, Postgres, Redis, encrypted backups
• Vercel (global edge) — CDN, static frontend hosting
• Cloudflare (global) — DNS, WAF, TLS termination, DDoS protection, and cookie-free aggregate page views / Web Vitals
• Razorpay (India) — payment processing only
• Resend (US) — transactional email (confirmation, password reset, data-ready messages)
• Sentry (US) — error monitoring with PII-scrubber active before-send
• BetterStack (EU / Germany) — uptime monitoring; public probe responses only
• PostHog (US / EU regions) — optional authenticated product-event mirror; when configured, forwarding requires consent and redaction controls
• Plausible (EU / Germany) — legacy integration retained in the register, but the browser shim is disabled and sends no data
• Crisp (France) — live chat support, consent-gated
• GitHub (US) — source code and CI hosting; no production user data transits GitHub

We do not sell, license, or rent your personal data. We do not run third-party advertising. We do not feed your data into machine-learning pipelines — ours or anyone else's. TradeLoop does not connect to brokers: you export price history from MetaTrader 5 yourself and import the file. Brokers are not sub-processors under GDPR Article 28.

We give affected account holders notice before adding a sub-processor where law or contract requires it. You may object by emailing [email protected] and we will work with you in good faith on an alternative.

TradeLoop's primary infrastructure is hosted in Render's Singapore region (our internal architecture decision ADR-0014). Some sub-processors operate in other jurisdictions:

For EU / EEA users

Personal data of EU / EEA users is transferred outside the EEA. We rely on Standard Contractual Clauses (SCCs) with each receiving sub-processor, plus a Transfer Impact Assessment per the EDPB's Recommendation 01/2020. SCC execution status by vendor is tracked publicly at /sub-processors and the per-vendor register is an internal record, available on request. As that register recorded on 2026-05-23, SCCs are in place through executed DPAs with Render, Cloudflare, Resend, Sentry and PostHog; Vercel's DPA needs a plan upgrade, Razorpay's awaits the vendor's reply and BetterStack's has not started. Where SCCs are not yet executed, the relevant processing is suspended for EU / EEA users on request. Email [email protected] to exercise this right.

For UK users

We rely on the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU SCCs, depending on the vendor's offered form. Execution status as above.

For Indian users

The DPDP Act §16 restricts cross-border transfer to jurisdictions on a Central Government notification list. As of 2026-07-14 Singapore is not on the restricted list; transfer to Render Singapore is permitted. If the restricted-list composition changes, we will migrate or re-paper accordingly.

For California users

We process California residents' data as a "business" under the CCPA / CPRA. We do not sell or share personal information for cross-context behavioural advertising, and we honour the "Do Not Sell or Share" opt-out at the consent banner. California-resident requests (access, deletion, correction, opt-out) follow the same data-rights channels as EU users.

TradeLoop stores your account, your setups and versions, the price-history files you import (as bars), and your sealed calls, receipts, beliefs and reports. Your data is private to your account. It is never pooled, compared with other traders, or shared, unless you publish it or join a cohort.

• Published records: only if you choose to publish a version's record or a sealed call, anyone with its link can read what the page lists before you publish it: your setup's name, market and timeframe, counts from locked blocks, the report's figures with their sample sizes and 95% intervals, the record's fingerprints, the dates of your first seal and last lock, and any name you type. A public call shows only its seal until its block is locked, then the call and its outcome. Your email, charts and other calls are never shown. You can unpublish at any time and the link stops working at once, but copies others made while it was public can't be withdrawn. Publications are in your export and are deleted with your account.
• Cohorts: only if you join an educator's cohort through its link and agree, that educator sees the name you choose for the cohort, your email if you choose to share it, when you joined, how many calls you have sealed, how many days you sealed calls on and the last of them, and your progress toward the evidence minimum. They never see your calls, charts, labels, notes, setups or outcomes. When you complete the sealed procedure, a completion record is issued: anyone with its link can read the name you chose, the academy and cohort, your counts of sealed calls and locked blocks, your first and last call dates and the record's fingerprint. You can withdraw it, and leave a cohort, at any time; from then on the educator sees nothing more of you. Memberships and completion records are in your export and are deleted with your account.
• Your files: you choose what to import. A file holds bid prices for one market; TradeLoop keeps its bars, a fingerprint of its contents and the provenance you declare, and uses it only for your own blind moments and their outcomes.
• Usage measures: TradeLoop records content-free usage measures, such as when you sign in, seal calls and lock blocks. They never include what you called, your setups or your data.
• Research sharing: off unless you switch it on in Settings. When it is on, only the evidence summaries the setting names are shared with TradeLoop's founder, never your setup text, notes, markets, prices, dates or data.
• Export: Settings → Export prepares everything TradeLoop holds for you, including a verifier that checks your receipts offline. Exporting is free on Free and on Pro.
• Deletion: Settings → Delete account deletes your setups, versions, datasets, sealed calls and their receipts, and any data from earlier TradeLoop products on the account. Access ends at once and removal from our systems completes within 24 hours; backups expire on their schedule. Security and legal records follow the retention boundaries below.
• Operator access: TradeLoop's operator can technically access stored data to run the service and to fix problems you report. It is not used for anything else, not shared, and not combined with other users' data.

The table below mirrors §1.6 of our DPIA exactly. Where regulatory holds apply we honour the statutory window. Account erasure and retained security or legal records follow the boundaries below. Applicable legal deadlines still apply; see your data rights for the available request and self-service paths.

The current product computes evidence reports from your own sealed calls on past data: outcomes in R, how consistently you recognise your own setup, and how your labels change once you know the outcome. Each is a description of your own record, with its sample size and interval, not a decision about you. It does not monitor open positions, send trading messages, or place, modify, cancel, or block orders.

An account may also have retained legacy automated-decision records from tilt-signature processing. Those records and the rights below do not establish that live intervention delivery or account-wide prevention is available in this release.

For the purposes of GDPR Article 22 (automated individual decision-making, including profiling) and the DPDP Act §10 (Significant Data Fiduciary profiling obligations), TradeLoop discloses that:

• Right to obtain an explanation: where your account has retained automated-decision records, you can inspect their recorded evidence, baseline and cost estimate through GET /api/v1/me/automated-decisions. A retained record is not evidence that a live alert reached you or controlled a trade.
• Right to express your point of view: the appeal endpoint at POST /api/v1/me/automated-decisions/{id}/appeal accepts your reasoning for human review. Submission does not confirm that a reviewer has been assigned or that review has occurred.
• Right to contest the decision: the same appeal endpoint serves this function. If the appeal is rejected, you may lodge a complaint with the supervisory authority in your jurisdiction using the complaint routes below.
• Right to obtain human review: email [email protected] to request human review of a retained decision. A named reviewer and response window are not confirmed here; applicable legal rights and deadlines still apply.
• Right to restriction: POST /api/v1/me/restrict-processing restricts legacy tilt-signature processing for your account; your data is retained. Previously published anonymous cohort snapshots are not rewritten.

The full Data Protection Impact Assessment for the engine — covering necessity, proportionality, balancing tests, and residual risks — is available on request from [email protected]. We do not run any live LLM API call sites; your results come from deterministic in-house computation (ADR-0023). Every evidence report states its sample size and says plainly when there is not enough evidence.

You have the rights below under GDPR Articles 15–22 and the DPDP Act §11–§14. For every right we list the endpoint or settings path that fulfils it. Most are self-serve; email [email protected] if anything is unclear or you cannot reach the relevant surface.

• Right of access (GDPR Art 15 / DPDP §11): download a comprehensive machine-readable ZIP of your user-linked data via GET /api/v1/me/export-data, also available self-serve at Settings → Export (free on Free and on Pro). Authentication, revocation, broker, push, invitation, and other bearer secrets are omitted or redacted. If any mandatory data domain cannot be collected, no partial archive is returned. The download completes only after required data is collected; applicable legal response deadlines remain in force.
• Right to erasure / right to be forgotten (GDPR Art 17 / DPDP §12): two paths, immediate via DELETE /api/v1/auth/account (Settings → Delete account; requires typed confirmation and 2FA when enabled), or queued, admin-reviewed via POST /api/v1/me/erasure-request. A queued request is not completed erasure; applicable legal deadlines still apply. The audit-chain record documenting deletion remains in the active audit database, where no automated expiry is currently configured; the planned 365-day active / 7-year archive policy is not operational. The deletion tombstone uses a user-id hash and timestamp rather than the deleted account record. Claimed Score Cards are revoked, unlinked, and stripped of owner evidence and secrets; the slug and revocation status remain. Anonymous unclaimed cards remain controlled by the owner token issued at mint.
• Right to data portability (GDPR Art 20): the export above is machine-readable JSON inside a ZIP, including manifest.json describing every file's schema.
• Right to rectification (GDPR Art 16 / DPDP §12): edit your profile in Settings; for imported price data, the MetaTrader 5 export you made is the source — correct it there and import the corrected file. Email [email protected] for anything else.
• Right to restriction of processing (GDPR Art 18): POST /api/v1/me/restrict-processing pauses legacy tilt-signature processing — see automated decisions and restriction.
• Right to object (GDPR Art 21): you may object to any processing relying on legitimate interest (marketing emails, operational product events, error monitoring) at any time. One-click unsubscribe is in every marketing email.
• Right to withdraw consent (GDPR Art 7(3)): consent for analytics, live chat, and Sentry replay is given or refused in the consent banner on these legal pages. To change it, clear this site's cookies and site data in your browser; the banner then asks again. To withdraw a consent already recorded on our server, email [email protected]. See cookies and browser storage.
• Right to an explanation of automated decisions (GDPR Art 22): see the automated-decision disclosure and the request paths for each Art 22(3) safeguard.
• Right to nominate (DPDP §14): under the DPDP Act, an Indian data principal may nominate another individual to exercise their rights in case of death or incapacity. Email [email protected] to register a nomination.

TradeLoop is a financial-trading product intended for adults 18 years or older. We do not knowingly collect personal data from anyone under 18. If you become aware that a minor has registered, email [email protected] to report it and request erasure. Applicable protections for children's data and deletion obligations remain in force. Any retained security or legal records follow the retention boundaries in this notice.

TradeLoop's app pages (the homepage, sign-in and sign-up, and your setups, data and settings) load no analytics, chat, or advertising scripts. They keep only what the app needs in this browser:

• Your sign-in session: access and refresh tokens and a copy of your account record, in local storage. Signing out removes them.
• A trusted browser: if you tick “Trust this browser for 30 days” at two-step sign-in, a tradeloop_2fa_trust cookie that scripts can't read, for 30 days.
• Your display choices: theme and single-key shortcuts, in local storage.
• Paying for Pro: Razorpay's checkout runs in your browser under Razorpay's own privacy policy.

These legal and policy pages ask for consent with a banner. Browser funnel events remain off until analytics consent. Authenticated operational account events stay first-party under legitimate interest. Sentry session replay and Crisp live chat also remain off until their purposes are granted. Your choice is kept in a tl-consent-state cookie (one year) and in local storage; without an account, the server's consent record also sets a tl_anon_identity cookie that scripts can't read, for one year. With analytics consent, a random anonymous id is kept in local storage. Cloudflare Web Analytics runs separately for cookie-free aggregate page views and Web Vitals; it does not use TradeLoop's anonymous or account ids. The legacy Plausible browser shim is disabled. The optional PostHog event mirror must pass consent and redaction controls when configured.

The banner offers three tiers:

• Strict (default): essential storage only. No first-party funnel events, no chat, and no session replay. Cookie-free aggregate Cloudflare measurement still runs separately.
• Balanced: Strict + first-party pseudonymous product / funnel analytics + masked Sentry error replay.
• Full: Balanced + live chat (Crisp) and marketing email. Transactional email remains part of the service regardless of this preset.

To clear what TradeLoop stores in your browser, sign out, then clear this site's cookies and site data in your browser's settings. On these pages the banner then asks again, and nothing optional loads until you choose. To withdraw a consent already recorded on our server, email [email protected]. We keep a consent ledger of your choice so a regulator requesting proof of opt-in can be served from a single audit-grade record.

If a personal data breach is discovered that is likely to result in risk to your rights and freedoms, TradeLoop will notify the relevant supervisory authority within 72 hours of becoming aware where GDPR Article 33 applies. Affected data subjects are notified directly via the email on file within the same window when the breach is likely to result in a high risk to their rights (GDPR Art 34). In India, TradeLoop reports a breach, like any cyber incident, to CERT-In within 6 hours of noticing it (CERT-In Directions of 28 April 2022). When the breach provisions of India's DPDP Rules take effect, TradeLoop will also tell every affected person without delay, whatever the risk, and the Data Protection Board of India without delay, with a detailed report within 72 hours unless the Board allows longer (DPDP Act §8(6); DPDP Rules 2025, Rule 7). The incident is logged blamelessly, and its post-mortem is available on request from [email protected].

If you believe our processing of your personal data infringes the law, you have the right to lodge a complaint with the supervisory authority in your jurisdiction. We would prefer to fix the problem first — please email [email protected] if you want to contact us directly. You do not need a reply from us before approaching the authority. No staffed response window or officer designation is confirmed here.

• EU / EEA residents: the Data Protection Authority in your member state (e.g. CNIL in France, DPC in Ireland, BfDI in Germany — the full list of DPAs is published by the European Data Protection Board).
• UK residents: the Information Commissioner's Office (ICO).
• Indian residents: the Data Protection Board of India under §27 of the Digital Personal Data Protection Act 2023. Until the Board is operationalised, complaints can be addressed via the Ministry of Electronics and Information Technology.
• California residents: the California Attorney General and the California Privacy Protection Agency (CPPA).

Published contact for privacy requests and correspondence:

[email protected]

Formal officer designation and a staffed response window are unconfirmed. This contact listing does not establish delivery or an appointment, and does not limit your legal rights or complaint routes.

For non-privacy legal correspondence, write to [email protected]. Our broader contact lines (founder, support, security disclosure) are at /contact; the public security disclosure policy is at /security.

Material changes to this Privacy Policy are announced to affected account holders where law or contract requires notice. The version number bumps and the effective date at the top of the page updates. Continued use of TradeLoop after a material change takes effect constitutes acceptance of the updated policy. Older versions are available on request from [email protected]. If we ever consolidate, fork, or wind down TradeLoop, we will honour the data-portability and erasure rights described above before any data is transferred or destroyed.