Privacy Policy

1. Who we are

ViTrade is a software, analytics and education product for traders. We provide tracking of publicly posted trades, verified analytics, an AI assistant (Vi), and optional copy-trading tooling. We are the data controller for the personal data you give us and that we generate about your use of the product. We are not a broker and we never hold or move your funds.

2. Data we collect

We collect only what the product needs to work:

• Account data: your email address, display name, password (stored only as a salted hash, never in plain text), and your account settings and preferences.
• Trading connection data: the exchange or broker you connect and its API credentials or trading (master) password. These are always encrypted at rest with AES-256-GCM and are used only to read your account and, if you opt in, to place trades. The keys we accept cannot withdraw funds.
• Payment data: your plan, credit balance, transaction history, and the customer and subscription identifiers returned by our payment providers. We never see or store your full card number; card details are handled entirely by Stripe. Cryptocurrency payments are handled by NOWPayments.
• Linked accounts: if you link Telegram or Discord, we store the identifiers needed to reach you there (for example your Telegram ID and language) and, for providers, the group or server you connect so we can read its posted trades.
• AI conversations: the messages you send to Vi and the posted-trade text or images we parse, so the assistant and the analytics can respond.
• Usage and technical data: pages and features you use, actions you take, approximate device and browser information, and IP address (used for security, rate limiting and fraud prevention).
• Communications: messages you send to support and your email and notification preferences.

3. How we use your data and our legal bases

We use your data to provide the service (performance of our contract with you): to run your account, verify and display analytics, operate copy-trading you configure, process payments and credits, and send service messages. We rely on our legitimate interests to keep the product secure, prevent fraud and abuse, and improve how it works. We rely on your consent for optional marketing emails and for any feature you separately opt into, such as automatic trade execution. We rely on legal obligation for accounting and tax records. You can withdraw consent at any time without affecting processing already carried out.

4. AI processing

Vi and our trade-parsing run on large language and vision models operated by AI providers (currently Anthropic, OpenAI and Google). To answer you or analyse a posted trade, the relevant message text or image is sent to one of these providers for processing and returned to us. We do not authorise these providers to train their models on your content for this product. Do not paste secrets, passwords or private keys into Vi; it does not need them and they are not required to use any feature.

5. How we protect trading credentials

Exchange keys and broker passwords are the most sensitive data we hold, so they get the strongest handling. They are encrypted with AES-256-GCM before they are written to the database, are decrypted only in memory at the moment a connection or a copied trade needs them, and are never shown back to you in full or included in logs, exports or support tickets. We ask for trade-only exchange keys (no withdrawal permission); for MetaTrader we collect the trading password only, and the platform has no withdrawal capability. You can disconnect an account at any time, which removes its stored credentials.

6. Payments

Card payments are processed by Stripe and cryptocurrency payments by NOWPayments. When you pay, you interact with the provider's secure checkout; your card number never reaches our servers. We receive and store only what we need to run your account: the provider's customer, subscription and transaction identifiers, the amount, the plan or credit pack, and the payment status. Each provider processes your payment data under its own privacy policy.

7. Cookies and similar technologies

We use a small number of strictly necessary cookies to keep you signed in and to secure your session. We do not use advertising cookies or sell your data to advertisers. Any analytics we run is limited to understanding product usage and is kept to what is necessary.

8. Who we share data with

We do not sell your personal data. We share it only with service providers (sub-processors) that help us run ViTrade, each bound to protect it and to use it only on our instructions:

• Stripe and NOWPayments, for card and cryptocurrency payments.
• Anthropic, OpenAI and Google, for AI assistant and trade parsing.
• Resend, for transactional and (if you opt in) marketing email.
• Telegram and Discord, when you link an account or connect a group or server so we can read its posted trades.
• MetaApi and the exchanges you connect, only to the extent needed to read your account or place trades you have configured.
• Our hosting and infrastructure providers (currently Hetzner, in Germany), which store the data that runs the service.

9. International transfers

Some of our providers, including the AI, payment and email providers listed above, process data outside the European Economic Area, mainly in the United States. Where that happens we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses, so your data keeps an equivalent level of protection.

10. How long we keep your data

We keep your account data for as long as your account is active. When you delete your account we remove or anonymise your personal data within a reasonable period, except where we must keep certain records longer, for example payment and tax records required by law, or limited security logs needed to prevent fraud. Encrypted trading credentials are removed when you disconnect the account or delete your account.

11. Your rights

Under the GDPR and similar laws you can:

• Access the personal data we hold about you and get a copy.
• Correct data that is inaccurate or incomplete.
• Delete your data (right to be forgotten), subject to records we must keep by law.
• Restrict or object to certain processing, including direct marketing.
• Receive your data in a portable, machine-readable format.
• Withdraw any consent you gave, at any time.
• Lodge a complaint with your local data protection authority.

12. Marketing and notifications

We send service messages you cannot opt out of while you have an account, such as security, billing and account notices. Marketing email is optional; you can unsubscribe from any marketing message or turn it off in your settings. In the app and on Telegram or Discord you control which alerts and notifications you receive.

13. Security

We apply technical and organisational measures appropriate to the sensitivity of the data, including encryption of secrets at rest, encrypted connections, access controls, rate limiting, audit logging of administrative actions, and webhook signature verification. No system is perfectly secure, so we cannot guarantee absolute security, but we work to protect your data and to respond quickly if something goes wrong.

14. Children

ViTrade is not intended for anyone under 18, and we do not knowingly collect data from children. If you believe a minor has given us data, contact us and we will remove it.

15. Changes to this policy

We may update this policy as the product changes. When we make a material change we will surface it in the app and update the date at the top. Continued use after an update means you accept the revised policy.

16. Contact us

For any privacy question, or to exercise a right above, contact us at privacy@vitrade.app or through the support channel inside the app. We respond to rights requests within the time the law requires.