Privacy Policy
Updated
In short: We keep as little about you as we can. To run your account we hold your email address, a scrambled form of your password (never the password itself), the computer you use the app on, and your subscription and payment records. We do not hold your broker passwords or API keys, and your trades do not pass through us: both stay on your own computer. Crash reports are off unless you turn them on. We use Cloudflare to host our website and servers, Stripe and its company Link to take payments, Resend to send account emails and Zoho to run our support mailbox. We do not sell your data and we do not use it for advertising. You can see, correct, download or delete your data, and you can complain to the Swedish data protection authority (IMY).
1. Who is responsible
The controller of your personal data is Ai-Driven, owned by Anas Al Qatanani, Lodjurstråket 1, 417 51 Göteborg, Sweden. Email: [email protected]. Phone: +46 73 521 32 22.
We do not have a data protection officer, because the law does not require one for a business of our kind and size. Send every privacy question to [email protected].
2. What we hold, and why
| What | Example | Why we need it | Legal basis (GDPR art. 6) |
|---|---|---|---|
| Account | email address, when you signed up, when you confirmed your email | Login, receipts, notices about your account | Contract (6.1.b) |
| Password hash | a one-way scrambled form of your password | To check your password at login. We cannot read your password. | Contract (6.1.b) |
| Login sessions | a scrambled form of your login token, the times you logged in and were last seen | To keep you logged in and let you log out | Contract (6.1.b) |
| Computers | a random id the app makes, your computer's name (as set in its system settings), the operating system, first and last seen, last licence check | The computer limit, the licence, "remove this computer" | Contract (6.1.b) |
| Email links | a scrambled form of each confirm-email or reset-password link, and when it expires | To confirm your email and reset your password | Contract (6.1.b) |
| Subscription | plan, status, trial end, period end, whether a card is saved, whether a payment failed, the Stripe customer and subscription ids | To know what your account may do | Contract (6.1.b) |
| Payment records | invoice id, amount, currency, plan, date paid, date refunded | Bookkeeping, and the 14-day withdrawal window | Legal obligation (6.1.c) and contract (6.1.b) |
| Order details from Link | the name, email, billing address, country, tax id (if you give one) and type of payment method you give at checkout | Our records of the sale, tax, and support | Contract (6.1.b) and legal obligation (6.1.c) |
| Withdrawal notices | the name, account email, contract and receipt email you give, and the time we received the notice | Proof of your withdrawal and of our refund | Legal obligation (6.1.c) |
| Security records | IP address or email address in short counters that limit login and sign-up tries; server request logs (IP address, time, request, result) | To protect the service and stop abuse and fraud | Legitimate interest (6.1.f) |
| Downloads and update checks | IP address, the file asked for, app version | To deliver the app and tell you about new versions | Contract (6.1.b) |
| Support messages | what you write to us, and our replies | To help you | Contract (6.1.b) / legitimate interest (6.1.f) |
| Crash reports (off by default) | app version, operating system, error message, technical trace; never orders, account numbers or passwords | To find and fix bugs | Consent (6.1.a) |
Today the app sends no crash reports, even with the switch on. If we start using them, we update this policy first.
Our legitimate interest for security records is to keep the service and your account safe. You can object to it (see section 7).
You must give the data marked "Contract" to use TwinCopier. Without it we cannot run your account.
3. What stays on your computer
- Your broker logins. Broker passwords and API keys stay on your computer, encrypted with your operating system's keychain, and are sent only to your broker. A Tradovate session stays in the app's memory only.
- Your trades and positions. The copier runs on your computer. Your orders go from your computer to your broker, not through our servers.
- Your settings and copy log. Groups, limits and a daily copy log are saved in the app's folder on your computer. We do not receive them. You can delete them at any time.
- Telegram alerts. If you turn on alerts through your own Telegram bot, the app sends the alert text from your computer to Telegram. We are not part of that.
One exception: if you sign in to a broker on the broker's own login page (for example Tradovate) and our server helps with the hand-off, the server holds the broker's access token, encrypted, for at most 15 minutes, only until your app picks it up. Then it deletes it.
We do not see your full card number. Stripe handles it.
We do not sell or rent your data, and we do not use advertising trackers.
4. Who we share it with
Service providers (processors). They act only on our instructions, under a data processing agreement:
- Cloudflare — hosts our website, account server and database, stores the app downloads, and protects against attacks.
- Resend — sends account emails (confirm email, reset password, order and withdrawal receipts), from its EU region in Ireland.
- Zoho Mail — runs our support mailbox, in its EU data centres.
Stripe and Link. Payments are handled by Stripe through its Managed Payments service. At checkout, Link (Sold through Link, LLC, a Stripe company) is the merchant of record for the payment: it charges you, handles tax, sends receipts and invoices, and gives payment support. For this, Stripe and Link decide how to use your payment data themselves, as separate controllers, under their own privacy policies (Stripe Privacy Policy, Link Privacy Policy). Link shares the order details in section 2 with us. Stripe also processes data for us as our processor (for example our subscription records). You can also ask Link directly to delete your payment data.
The full, current list, with countries, is on the Subprocessors page.
We may also share data when the law requires it (for example with the Swedish Tax Agency or a court), to protect our rights in a dispute, or with a buyer if the business is sold (we tell you first).
5. Transfers outside the EU and EEA
Cloudflare, Stripe (with Link) and Resend are companies based in the United States and may process data there, even when the main service runs in the EU. All three are certified under the EU-U.S. Data Privacy Framework, which the European Commission has found gives adequate protection (decision 2023/1795). They also sign the EU Standard Contractual Clauses with us. Zoho keeps our mailbox in the EU; any access from outside the EU is covered by the Standard Contractual Clauses in its data processing agreement. Ask us at [email protected] for a copy of the safeguards.
6. How long we keep it
| What | How long |
|---|---|
| Account, computers, sessions, subscription | While your account exists. Deleted within 30 days after you ask us to delete your account. A login session ends after 60 days without use in the app, 14 days on the website. |
| Email links | Until used or expired (24 hours to confirm an email, 1 hour to reset a password), then deleted with the account. |
| Payment records and order details | 7 years after the end of the year they belong to, as Swedish bookkeeping law requires. |
| Withdrawal notices | 10 years after the notice, the time a claim can be made under Swedish law. |
| Security records | Counters: deleted within 30 days. Server request logs: up to 30 days. Longer only for a specific security incident or dispute. |
| Download and update-check logs | Up to 30 days. |
| Support messages | 2 years after the case is closed. |
Backups are overwritten in a rolling cycle of no more than 30 days.
7. Your rights
You have the right to:
- see the data we hold about you and get a copy (access);
- correct data that is wrong;
- delete your data, except what the law makes us keep;
- restrict how we use your data in some cases;
- take your data with you in a common machine-readable format (portability);
- object to use based on our legitimate interest;
- withdraw consent at any time (for example crash reports). This does not affect use before you withdrew.
You can see your plan and computers, and remove a computer, on your account page. For anything else, including deleting your account, write to [email protected] from your account email. We answer within one month. If a request is complex, we may need two more months; we tell you if so. We may ask you to prove who you are.
We do not make decisions about you based only on automatic processing that have legal or similar serious effects.
8. Complaints
If you think we handle your data wrongly, please tell us first at [email protected]. You also have the right to complain to a data protection authority. In Sweden this is:
Integritetsskyddsmyndigheten (IMY), Box 8114, 104 20 Stockholm, Sweden · www.imy.se · [email protected]
You can also complain in the EU country where you live or work.
9. Security
We protect your data with encryption in transit (HTTPS), password hashing, login tokens and email links stored only in scrambled form, short-lived signed licences, access limited to what is needed, and providers with strong security records. No system is perfectly safe. If a breach puts your rights at high risk, we tell you without undue delay. Report a security problem to [email protected].
10. Children
TwinCopier is not for people under 18. We do not knowingly hold data about children.
11. Changes
We update this policy when our use of data changes. The date at the top shows the latest version. If a change is important, we tell you by email before it applies.