Privacy Notice

Data we process

• Account and identity data — your email address, name, and authentication identifiers, handled through our auth provider (Clerk).
• Billing data — your subscription plan, status, and billing identifiers, handled through our payment processor (Stripe). Stripe processes your card details; we never see or store your full card number.
• Broker connection and trading data — when you connect a cTrader account through Spotware’s official OAuth screen we receive an access token, which we store encrypted at rest. We never see or store your cTrader password. To show your dashboard and enforce the risk rules you configure, we process your trading data (accounts, positions, equity, orders, and history) from the cTrader Open API.
• Usage and technical data — standard server logs (e.g. IP address, device/browser information, timestamps) kept by our hosting providers for security and reliability.
• Communications — messages you send us, and operational alerts about your account that we may route to our team via a messaging provider.

Why we process it and our legal basis

• To provide the service (show your accounts, place the orders you submit, enforce the risk thresholds you set, manage your subscription) — legal basis: performance of our contract with you (GDPR Art. 6(1)(b)).
• To keep the service secure and reliable (fraud and abuse prevention, debugging, capacity) — legal basis: our legitimate interests (Art. 6(1)(f)).
• To meet legal obligations (e.g. accounting and tax records for payments) — legal basis: legal obligation (Art. 6(1)(c)).
• Where we ask for it (e.g. optional communications) — legal basis: consent (Art. 6(1)(a)), which you can withdraw at any time.

We do not sell your data and we do not use it for advertising.

Who we share it with (sub-processors)

We share data with service providers who process it on our behalf, under data processing agreements and only as needed to run propcockpit:

• Clerk — authentication and identity
• Stripe — subscription payments
• Supabase — database hosting
• Upstash — cache and background queues
• Fly.io — application/API hosting
• Vercel — website hosting

You also authorize Spotware (cTrader Open API) directly when you connect your broker account. Some providers process data outside the EU/EEA; where they do, we rely on appropriate safeguards such as the EU Standard Contractual Clauses.

How long we keep it

We keep your account and trading data while your account is active and for as long as needed to provide the service. Broker access tokens are kept until you disconnect the account or delete your account. We retain billing records for as long as required by accounting and tax law. When you delete your account we remove your personal data, except where we must keep certain records to meet legal obligations.

Security

We store broker access tokens encrypted at rest, restrict access to personal data, and never store your cTrader password or full card number. No system is perfectly secure, but we take reasonable technical and organizational measures to protect your data.

Cookies

We use essential cookies needed to sign you in and keep your session secure (provided through Clerk). We do not use advertising or cross-site tracking cookies.

Your rights (GDPR)

You have the right to access, correct, export (portability), restrict, object to, or delete your personal data, and to withdraw consent where processing is based on consent. To exercise these rights email info@propcockpit.com; we respond within the timeframes required by law. You also have the right to lodge a complaint with the Swedish data-protection authority (IMY, Integritetsskyddsmyndigheten).

Changes to this notice

We may update this notice. If a change is material we will give reasonable notice (for example by email or in-app) before it takes effect.