Privacy Policy

We collect: (a) data you provide - name, email address, password (stored only as a secure hash), language preference, uploaded chart images, journal entries and imported trade history, chat and support messages, and affiliate payout details; (b) data generated by your use of the Service - analysis history, settings, usage counters, and subscription and order records; (c) technical data - IP address, approximate location, device and browser information, cookies, and log and security data; and (d) attribution data - referral codes and advertising identifiers (such as Google click IDs) when you arrive via a partner link or an ad. We do not intentionally collect sensitive categories of data and ask that you not include them in uploads or messages.

We use personal data to: provide and operate the Service (performance of a contract); process payments, verify licences, and prevent fraud, abuse, and quota circumvention (performance of a contract and our legitimate interests); secure, debug, measure, and improve the Service (legitimate interests); send transactional messages such as receipts, security alerts, and subscription notices (performance of a contract); send marketing communications where permitted (your consent, or our legitimate interest in promoting our own similar services, with opt-out always available); and comply with legal obligations such as accounting, tax, and anti-money-laundering rules (legal obligation). Where we rely on legitimate interests we have assessed that our interest is not overridden by your rights and freedoms, and you may object at any time as described in section 8. Where we rely on consent you may withdraw it at any time with effect for the future, without affecting processing already carried out. We do not sell personal data, we do not use it to train our own or third-party AI models, and we do not use it for automated decisions producing legal or similarly significant effects.

When you request a chart analysis, auto-draw, chat reply, or similar AI feature, the relevant inputs - for example a chart image, numeric market snapshot, or your message - are transmitted to our AI infrastructure providers solely to generate the output you requested. Those providers act as our processors under their enterprise API terms, which prohibit using submitted content to train their models and prohibit using it for advertising. We do not use your content to train models either. Providers may retain content briefly for abuse monitoring under their own published policies. Outputs may be cached for a short period so that an identical request can be served efficiently. AI output is informational only; it is not used to make decisions that produce legal or similarly significant effects on you (see section 14).

Payments are processed by third-party providers (such as Lemon Squeezy - which may act as merchant of record - PayPal, PayOS, and NOWPayments). Your full card or wallet details are transmitted directly to those providers and are never stored on our servers; we receive only limited transaction data (such as order status, amount, and a payment reference) needed to activate and support your purchase. These providers handle your payment data under their own privacy policies and are PCI-DSS compliant where applicable.

We share personal data only with: payment providers (to process transactions); hosting, CDN, and infrastructure providers; media-storage providers for uploaded images; email-delivery providers for transactional and permitted marketing email; analytics and advertising platforms (in aggregated or pseudonymized form, for example to measure ad conversions); AI infrastructure providers (see section 3); error-monitoring services; and courts or authorities where disclosure is required by law or necessary to protect rights, safety, or the integrity of the Service. Our processors are bound by data-processing agreements. If we are involved in a merger, acquisition, or asset sale, data may be transferred as part of that transaction subject to this policy.

We deliberately keep this short and use no third-party tracking walls. STRICTLY NECESSARY: an httpOnly authentication cookie that keeps you signed in (expires after about 7 days or on logout), a session-integrity cookie, and security or anti-abuse cookies including those set by our CDN and bot-protection provider. These are required for the Service to work and are used on the legal basis of contract performance and our legitimate interest in security; they cannot be disabled from within the Service. PREFERENCES: cookies and browser localStorage that remember your language, theme, chart layouts, drawings, timeframes, and dismissed notices - stored on your own device, typically until you clear them. ATTRIBUTION AND MEASUREMENT: an affiliate referral cookie (about 60 days) so partners are credited correctly, and advertising click identifiers such as the Google click ID (about 90 days) so we can measure whether an advertisement led to a sign-up. Where consent is legally required for these, we rely on it and you may withdraw it by clearing cookies and using your browser or platform opt-out controls. YOUR CONTROLS: all browsers let you view, block, and delete cookies and offer a private-browsing mode; you can opt out of personalised advertising with the relevant advertising provider; and you can use global privacy signals where your jurisdiction recognises them, which we honour as an opt-out request. Blocking strictly necessary cookies prevents sign-in and core features from working. Full detail is in our Cookie Policy.

We keep personal data only as long as needed for the purpose it was collected for. In practice: account and profile data for as long as your account is active; analysis history, journals, and chart data until you delete them or your account; transaction, invoice, and tax records for the period required by accounting and tax law (typically 5 to 10 years, and in Vietnam at least 10 years for accounting documents); consent records for as long as the account exists and for the limitation period afterwards, because they are the evidence that you agreed to our Terms; security, fraud-prevention, and access logs for a limited period, typically up to 12 months; marketing preferences and unsubscribe records for as long as needed to honour your choice; and support correspondence for up to 24 months. When you delete your account, personal data is deleted or irreversibly anonymised within a reasonable period, except data we must or may lawfully retain longer, such as the records above or data subject to a legal hold. Anonymised, aggregated statistics that can no longer identify you may be kept indefinitely.

Depending on where you live, you have the right to access your personal data and obtain a copy; to have inaccurate data corrected; to have data deleted; to restrict or object to processing, including objecting to direct marketing at any time; to data portability; to withdraw consent; and not to be discriminated against for exercising your rights. To exercise any of these, email [email protected] with the subject "Privacy". We may ask for information to verify your identity - this protects you against someone else making a request in your name. We respond free of charge within the period required by law (one month under the GDPR, extendable by two further months for complex requests, and 45 days under California law, extendable once); we may charge a reasonable fee or refuse only where a request is manifestly unfounded or excessive, and we will tell you why. You may use an authorised agent where the law allows. If you are unhappy with our response you may complain to us first and then to your supervisory or data-protection authority - in the EEA or UK, the authority where you live, work, or where the issue arose; in Vietnam, the competent authority under Decree 13/2023/ND-CP.

We apply industry-standard safeguards, including TLS encryption in transit, bcrypt password hashing, httpOnly authentication cookies, access controls, rate limiting, and security monitoring. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If a personal-data breach occurs that is likely to result in a risk to you, we will notify you and the competent authorities as required by applicable law.

We operate globally and your data may be processed in countries other than your own, including Vietnam, the European Union, the United Kingdom, Singapore, and the United States. Where we transfer personal data out of the EEA, the UK, or another jurisdiction that restricts transfers, we rely on an appropriate safeguard: an adequacy decision where one applies, the European Commission's Standard Contractual Clauses (with the UK Addendum or IDTA for UK transfers), or our providers' approved transfer mechanisms, together with supplementary technical measures such as encryption in transit and at rest. We follow Vietnam's requirements for cross-border transfer of personal data, including preparing and filing the required transfer impact dossier where applicable. You may request a copy of the safeguard we rely on by contacting us.

The Service is intended for adults and is not directed at anyone under 18. We do not knowingly collect personal data from minors. If you believe a minor has provided us personal data, contact us and we will delete it promptly.

With your permission, or where otherwise lawful, we may send product news, tips, and offers by email or in-product messages. Every marketing email contains an unsubscribe link, and you can also opt out in your profile settings. Transactional messages - receipts, security notices, and subscription reminders - are sent regardless of marketing preferences because they are part of operating the Service.

We may update this Privacy Policy as the Service or the law evolves. Material changes will be announced by email or an in-product notice before they take effect, and the "last updated" date above will change. Your continued use of the Service after the effective date constitutes acknowledgment of the updated policy.

We do not make decisions producing legal effects concerning you, or similarly significantly affecting you, based solely on automated processing. AI chart analyses, setup scores, volatility forecasts, pattern statistics, and trade ideas are informational output about markets, not decisions about you, and you always choose whether to act on them. We use limited automated checks to enforce usage quotas and to detect fraud and abuse - for example spotting multiple accounts created to obtain extra free usage. Where such a check restricts your account you may contact us to obtain human review, express your point of view, and contest the outcome.

If you are a resident of California or another US state with a comprehensive privacy law, you have the rights described in section 8, including the right to know, delete, correct, and obtain a portable copy of your personal information, and to appeal a refusal where your state provides an appeal right. We do not "sell" personal information and we do not "share" it for cross-context behavioural advertising as those terms are defined by the CCPA and CPRA, and we have not done so in the preceding twelve months. We do not knowingly collect or sell the personal information of anyone under 16. We do not collect sensitive personal information for the purpose of inferring characteristics about you, and we do not use or disclose it beyond the purposes permitted without an additional right to limit. We honour recognised opt-out preference signals sent by your browser. We retain each category of personal information for the periods set out in section 7. You will not receive different pricing or a lower quality of service for exercising your rights.

TraderAI, the operator of traderai.cloud, established in the Socialist Republic of Vietnam, is the controller of the personal data described in this policy and decides why and how it is processed. For all privacy matters - including access, deletion, objection, and complaints - contact [email protected] with the subject "Privacy"; this is our designated privacy contact point and requests are handled by the people responsible for data protection. We are not currently required to appoint a statutory data protection officer, and we will publish the details here if that changes. Where we act as a processor on your behalf - for example for content you upload - we process it only on your instructions as set out in the Terms of Service.

We share personal data only with the categories of recipients needed to run the Service: cloud hosting, content-delivery, and bot-protection providers; media and object storage providers for uploaded chart images; AI infrastructure providers for the features described in section 3; market-data providers (which receive only the symbol requested, never your identity); payment providers and merchants of record; email-delivery providers for transactional and permitted marketing messages; messaging platforms where you have connected them, such as Telegram; advertising and measurement platforms, in aggregated, hashed, or pseudonymised form only; error-monitoring and logging services; and professional advisers, insurers, courts, or public authorities where disclosure is required by law or necessary to establish, exercise, or defend legal claims. Every processor is bound by a written data-processing agreement, may act only on our instructions, and is required to apply appropriate security measures. If we are involved in a merger, acquisition, or sale of assets, data may transfer as part of that transaction and will remain subject to this policy or an equally protective one; we will notify you of any change of controller.

You can change your name, language, and notification preferences at any time in your profile; unsubscribe from marketing email using the link in any such message or the switch in your profile, without affecting transactional messages; disconnect the Telegram bot with its unlink command; clear locally stored chart layouts and drawings from your browser; delete individual analyses, journal entries, and uploaded images; and delete your entire account, which removes or irreversibly anonymises your personal data subject to the retention rules in section 7. If you would like an export of your data before deleting, ask us first - once deletion completes we cannot restore the data.