Privacy Policy
Last updated: July 9, 2026
This Privacy Policy explains what personal data MyTradePilot ("we", "us") collects, why, and what rights you have.
1. Data We Collect
- Account data: email, hashed password, display name.
- Usage data: pages viewed, features used, error diagnostics, IP address, user-agent.
- Trading data you create: watchlists, paper orders, journal notes, risk settings, strategy configurations.
- Billing data: handled by Stripe. We store subscription status and customer ID; we do not store card numbers.
- Broker credentials: if you connect a broker (e.g. Alpaca), API keys are stored encrypted and used only to place orders you approve.
2. How We Use It
- Operate and improve the Service.
- Authenticate you and secure your account.
- Process payments and manage subscriptions.
- Send transactional email (receipts, security alerts, account changes).
- Send product email (only if you opted in — unsubscribe any time).
- Detect fraud and abuse.
- Comply with legal obligations.
3. Legal Bases (GDPR)
Contract performance (running the Service you signed up for), legitimate interests (security, product improvement), consent (marketing email, optional analytics), and legal obligations (tax, anti-fraud).
4. Subprocessors
- Supabase — database, authentication, storage.
- Cloudflare — hosting, CDN, DDoS protection.
- Stripe — payment processing.
- Alpaca / Finnhub — market data (only if you use those features).
- Google Gemini via Lovable AI Gateway — AI-generated content.
- Resend — transactional email delivery.
5. Cookies and Local Storage
We use strictly necessary cookies for authentication and session management. We do not use third-party advertising cookies.
6. Data Retention
Account and trading data are retained while your account is active. On account deletion we remove personal data within 30 days, except records we are legally required to keep (tax, fraud logs) for up to 7 years.
7. Your Rights
Depending on your jurisdiction (GDPR, UK GDPR, CCPA), you may have the right to access, correct, delete, port, or restrict processing of your data, and to object to processing. To exercise any right, email privacy@mytradepilot.us. We respond within 30 days.
8. Security
Data is encrypted in transit (TLS 1.2+) and at rest. Row-level security policies restrict database access to the record's owner. Broker API keys are stored encrypted. We do not sell personal data.
9. International Transfers
Data may be processed in the United States and the European Union. Where required, we rely on Standard Contractual Clauses.
10. Children
The Service is not intended for anyone under 18 and we do not knowingly collect data from minors.
11. Changes
We will notify you of material changes to this Policy by email or in-app notice at least 14 days before they take effect.
12. Contact
Privacy questions: privacy@mytradepilot.us