1. About this policy
This privacy policy explains how TradeMind collects, uses and protects your personal data when you use our website and app. We follow the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) and the Belgian Act of 30 July 2018 on the protection of natural persons with regard to the processing of personal data.
The data controller is TradeMind. Our full identification and contact details are on the Legal notice page.
2. What data we collect
We only collect what is needed to run TradeMind:
- Account data: email, hashed password, first name or display name, language, timezone.
- Trade and journal data: trades, setups, notes, screenshots, tags, emotions, goals, risk plans, everything you enter in the app.
- Chat history with Max: your messages to our AI coach and the generated answers.
- Subscription and billing data: subscription status, invoice information. Card numbers are never stored by TradeMind, they stay with our payment provider.
- Technical data: IP address, browser, device, timestamps, error logs. Used for security and stability.
- Cookies and similar technologies: see our separate cookie policy.
3. Why we use your data and on which legal basis
Every processing has a clear legal basis under Article 6 GDPR:
- Creating your account and delivering the service, on the basis of performance of our contract with you.
- Processing payments and managing subscriptions, performance of contract and legal obligations (accounting).
- Improving the app, fixing bugs, preventing abuse, our legitimate interest in running a safe and usable service.
- Sending service emails (price changes, security, important updates), performance of contract.
- Sending marketing emails only with your explicit opt-in, on the basis of your consent, which you can withdraw at any time.
- Emails about using Trade Mind (help with your first trades, a nudge when your journal goes quiet, your first insights), sent by the founder. Basis: our legitimate interest in helping you use the service you signed up for. Every one has an unsubscribe link; unsubscribing stops these, account emails (like a password reset) keep coming.
- Public share pages (share cards): only when you share a day or a trade, we store a copy of those trades (instrument, direction, size, prices, times, result and, if you turn them on, your notes and charts) and show it on a public page to anyone with the link. Your balance, account numbers and login details are never shown. Basis: your consent, given when you share. You can delete a shared page any time in Settings > Shared pages, which also deletes the copy.
- Running the Max AI coach, to answer your question we send your prompt and relevant trade context to our AI provider. Basis: performance of contract.
- Complying with legal obligations (tax, lawful requests from competent authorities).
4. Who we share data with (processors)
We never sell your data. We do use carefully selected service providers that perform tasks on our behalf:
- Supabase, database, authentication infrastructure and delivery of transactional emails (signup confirmation, password reset). EU-hosted unless configured otherwise.
- Vercel, hosting and content delivery (global servers, including the US).
- Anthropic, AI model provider behind our Max coach. Your prompt and relevant trade context are sent with each interaction.
- Groq, AI model provider for two steps in the voice feature: Whisper transcribes your audio, and Llama cleans up the raw transcript (strips filler words, fixes grammar). Audio and transcript context are sent to Groq with each voice recording. Their handling is governed by Groq's data processing terms, which bind them under GDPR. We do not control their internal retention windows; if you want to avoid sending audio to Groq, do not use the voice feature.
- Paddle, payment and subscription processing (Merchant of Record).
- Apple (App Store), payment for subscriptions you buy in the iPhone app. Apple processes that payment itself, under its own privacy policy; we receive no payment details.
- RevenueCat, keeps track of App Store subscription status (which plan, when it renews or ends), linked to your account ID. No payment details.
- Expo and Apple Push Notification service, deliver the iPhone app's notifications (check-in reminders, synced trades). For this we store a push token for your device.
- Push notifications are sent directly from our servers via your browser's native Web Push API. We do not use a third-party push provider.
- Google (Workspace) and Resend, deliver our emails: account emails and the emails about using Trade Mind.
We have a data processing agreement with each of them requiring them to process your data only on our instructions and in line with GDPR.
5. International transfers
Some of our sub-processors (AI providers and the hosting CDN) are based in the United States. For those transfers we rely on:
- the EU-US Data Privacy Framework, where the provider is certified under it;
- Standard Contractual Clauses approved by the European Commission, supplemented with technical and organisational measures where needed.
You can request a copy of the relevant safeguards via the contact details on the Legal notice page.
6. How long we keep your data
We do not keep personal data longer than necessary:
- Account data and trade data: as long as your account is active.
- After account closure: all account and trade data is immediately made inaccessible and fully deleted from the production database within 30 days. Encrypted backups expire automatically within 12 months; they are not used for day-to-day access and exist only for incident recovery.
- Billing and accounting records: kept for 7 years as legally required in Belgium. These records are excluded from erasure requests and are only used to meet that legal obligation.
- Support emails: up to 3 years after last contact.
- Server logs: up to 90 days.
7. Your rights under GDPR
As a data subject you have the following rights:
- Right of access, know what data we hold about you.
- Right to rectification, have incorrect data corrected.
- Right to erasure ("right to be forgotten"), have your account and all related trade data deleted from the production database within 30 days. Encrypted backups expire automatically within 12 months. Accounting records that we are legally required to keep for 7 years are excluded from this right.
- Right to restriction of processing.
- Right to object to processing based on legitimate interest.
- Right to data portability, request your data in a readable format (JSON/CSV).
- Right to withdraw consent at any time, without affecting the lawfulness of processing before withdrawal.
To exercise your rights, contact us via the email on the Legal notice page. We respond within one month, except in exceptional cases where we may extend this by two months (we will notify you).
If you are not satisfied with our response, you have the right to lodge a complaint with the Belgian Data Protection Authority (Drukpersstraat 35, 1000 Brussels, www.dataprotectionauthority.be) or with the supervisory authority of your member state.
8. Security
We take reasonable technical and organisational measures to protect your data: TLS in transit, encryption at rest, access controls and logging, periodic backups, separation of production and test environments, and an internal least-privilege principle.
If a data breach with high risk to you nonetheless occurs, we will notify you within 72 hours of becoming aware, as required by GDPR.
9. Cookies
TradeMind only uses strictly necessary cookies for login and app functionality, and, only after your explicit consent, cookies for analytics. The full cookie policy, a list of all cookies and a button to change your preferences are on our cookies page: /cookies.
10. Children
TradeMind is not directed at minors. You must be at least 18 (or of legal age in your country) to create an account. If we become aware of accidentally processing a minor's data, we delete it immediately.
11. AI and your data
In interactions with Max, your messages and relevant trade context are sent to our AI provider, which processes them to generate a reply. We contractually require our AI providers not to use your data to train their models.
You can choose not to use Max. In that case no conversation data is sent to an AI provider.
12. Changes to this policy
We may update this policy as the service evolves or as regulation requires. For material changes we will notify you by email or via an in-app banner. The date at the top of this page indicates the last update.
13. Contact
Questions, requests or complaints about your data? Contact us via the details on the Legal notice page.
