Privacy Policy

1. Who is responsible for your data

Pipcue is operated by [COMPANY LEGAL NAME], [ADDRESS], tax ID [TAX ID] ("we", "us"). You can reach us at support@pipcue.com.

We are the data controller for the personal data described here. This policy explains what we collect when you use Pipcue, why, who we share it with, how long we keep it and what rights you have.

2. What we collect

We collect only what the Service needs to work. In detail:

• Account: email address, password hash or Google sign-in identifier, username, timezone, and the date you signed up.
• Billing: plan, interval, subscription status, invoice records and payment provider references. Card numbers never reach us; they stay with the payment provider.
• Hosted MT5 credentials: MT5 login, broker server and trading password (encrypted at rest), plus files you upload (.ex5, .set) and chart settings.
• License sets and connected apps: license keys, webhook secrets, their rotation history, and a fingerprint of each connected-app token (never the token itself).
• Terminals: broker, server, account number, balance, equity, open positions, EA version, last report time and the lot multiplier you set.
• Alerts and executions: the alert payloads you send, the commands we queue, every fill, failure and skip with its reason and timestamp.
• Journal: closed trades synced from your terminals, your notes, tags, moods, plan-followed flags and screenshots.
• Ask AI: the questions you type and a summary of your setup (plan, license sets, terminals, hosted instances, rules, copier, recent failures) sent with each message. Never your secrets. We keep a server copy for at most two days for a daily team digest.
• Feedback: the type, message, optional screenshot and the page, browser, screen size and plan attached to it.
• Audit log: security and billing events (sign-in, password or email change, subscription changes, secret rotation, hosted credential changes, data export, account deletion) with the acting IP address.
• Network metadata: IP address, request times and user agent in server logs and rate-limit counters.
• How you found us: if you arrive at sign-up from a link with campaign tags (utm_*), an ad click id or a referral code, we keep those tags, the page you landed on and the referring site, and store them with your account when you sign up.
• Cookies: a session cookie so you stay signed in, a sign-up source cookie described in section 10, and a theme preference stored in your browser.
• Error telemetry: stack traces and request context when something breaks, stripped of personal data where we can.

3. Why we use it and on what legal basis

Each purpose below names the legal basis we rely on under the GDPR and comparable laws.

• Providing the Service you signed up for (accounts, alerts, copier, hosting, journal): performance of a contract.
• Taking payment, issuing invoices and keeping tax records: performance of a contract and legal obligation.
• Keeping the Service secure, detecting abuse and rate limiting: legitimate interest.
• Keeping an audit log of security and billing events: legitimate interest and legal obligation.
• Answering support requests, feedback and Ask AI questions: performance of a contract and legitimate interest.
• Sending transactional emails such as receipts, trial reminders and security notices: performance of a contract.
• Sending marketing emails: consent only. You can withdraw it at any time.
• Keeping customer records in our CRM (who signed up, from which campaign, which plan, whether a trial ended unpaid) so we can follow up and understand which channels work: legitimate interest.
• Fixing errors with telemetry: legitimate interest.

4. Who we share it with (sub-processors)

We use the providers below to run the Service. Each processes data only on our instructions and under a contract. Where a name is in brackets we have not yet signed with a provider; the page is updated when we do.

5. International transfers

Some providers process data outside your country, including outside the European Economic Area and India. Where that happens we rely on the provider's standard contractual clauses or an equivalent lawful transfer mechanism, and we choose providers that encrypt data in transit and at rest.

6. How long we keep data

A job in our backend deletes data when its period ends; what the table says is what the code does. Deleting your account removes everything in the first group at once.

7. Your rights

Depending on where you live you have the right to access, correct, delete and export your data, to restrict or object to processing, to withdraw consent, and to complain to a supervisory authority.

Most of this you can do yourself: Settings lets you change your email and username, download a JSON export of your data, and delete your account. For anything else, email support@pipcue.com. We answer within one month, or sooner where the law requires.

8. Users in India

If you are in India, the Digital Personal Data Protection Act 2023 gives you the right to access a summary of your data, to correct and erase it, to nominate someone to exercise your rights if you cannot, and to raise a grievance. Our grievance officer is [GRIEVANCE OFFICER NAME], reachable at [GRIEVANCE OFFICER EMAIL]. We respond to grievances within the time the Act allows.

9. How we protect your data

TLS on every connection. Encryption at rest in the database. Hosted trading passwords encrypted with a server-side key and decrypted only at terminal launch, never shown again. Commands to EAs signed with your secret. Every database query is scoped to the signed-in account. Key-only SSH, firewalls and intrusion blocking on our servers. Rate limits on webhooks and sign-in. Error telemetry without personal data. An audit log of sensitive actions.

No system is perfectly secure. If a breach affects you we will tell you and the relevant authority as the law requires.

10. Cookies

On this dashboard we set a session cookie that keeps you signed in, and one first-party cookie, pc_src, only when you reach the sign-up or sign-in page from a link with campaign tags, an ad click id, a referral code or from another website. It holds those tags, the landing page and the referring site for up to 30 days so we can record how you found us when you sign up; it is never shared with advertisers. We do not set it if your browser sends a Global Privacy Control signal. Your light or dark theme choice is stored in your browser's local storage. We do not use third-party analytics or advertising cookies on the dashboard.

Our marketing website at pipcue.com may use analytics and our CRM's visitor tracking; it asks for your consent first where the law requires it.

11. No automated decisions about you

We do not profile you or make automated decisions with legal or similar effect. Trading rules and plan limits are applied automatically, but they are settings you chose and limits you agreed to when you picked a plan.

12. Marketing

We send emails needed to run your account: receipts, trial reminders, security notices, cancellation and renewal confirmations, hosted-terminal login problems and replies to your feedback. We send marketing email only if you opt in, and every such email has an unsubscribe link.

13. Children

The Service is for adults aged 18 and over. We do not knowingly collect data from anyone younger. If you believe a minor has an account, contact us and we will delete it.

14. Changes to this policy

We will post updates here with a new date and email you about material changes. The date at the top tells you when this version took effect.

15. Contact

Privacy questions and rights requests: support@pipcue.com. Postal address: [COMPANY LEGAL NAME], [ADDRESS].