Privacy Policy

1. Data controller

The controller of personal data is easyBterminal.

Privacy contact: easybterminal@gmail.com

2. Data collected and purposes

We collect the following categories of personal data:

• Registration data: email address, password (hashed), sign-up date. Purpose: creating and managing the account.
• Payment data: handled exclusively by Whop. We do not store credit card data.
• Broker credentials: API keys and tokens encrypted with AES-256. Purpose: connecting to the brokers authorized by the user.
• Usage data: workspace, custom indicators, terminal settings. Purpose: providing the service.
• Technical data: IP address (for security and rate limiting), user agent, error logs.
• Analytics data (consent only): pages visited and anonymous usage events via PostHog and Google Analytics 4.
• Marketing data (consent only): measurement of sign-ups, checkouts and subscriptions coming from our Google Ads campaigns.

3. Legal basis

• Performance of a contract (Art. 6(1)(b) GDPR): account data, broker credentials, workspace.
• Legitimate interest (Art. 6(1)(f) GDPR): platform security, fraud prevention, technical logs.
• Consent (Art. 6(1)(a) GDPR): analytics cookies (PostHog, Google Analytics) and marketing cookies (Google Ads). Consent can be withdrawn at any time with the “Change cookie preferences” button below.
• Legal obligation (Art. 6(1)(c) GDPR): retention of accounting and tax records.

4. Data retention

• Active account: for the whole duration of the contract.
• After the subscription is canceled: operational data (workspace, brokers, indicators, trading history) is deleted automatically within 30 days of the cancellation date.
• Accounting and transaction data: kept for 10 years under Italian tax law.
• Security logs: kept for 12 months.
• Support messages: kept indefinitely to ensure continuity of support.

5. Recipients of the data

Personal data may be shared with the following third parties acting as data processors:

• Supabase, Inc. (USA) — database and authentication. Transfer covered by Standard Contractual Clauses (SCC).
• Whop (Whop Inc. — USA) — payment platform. Transfer covered by Standard Contractual Clauses (SCC).
• PostHog, Inc. (EU — EU servers) — analytics. Only with the user's explicit consent.
• Google Ireland Ltd (EU, with possible transfers to Google LLC — USA) — Google Analytics 4 and Google Ads, for traffic and advertising conversion measurement. Cookies are set only with the user's explicit consent; without consent, Google's consent mode sends only anonymous signals without cookies or identifiers (e.g. that a page was visited), used to estimate conversions in aggregate. Transfer covered by SCC and the EU-US Data Privacy Framework.
• Sentry, Inc. (USA) — application error monitoring. Transfer covered by SCC.
• Cloudflare, Inc. (USA) — CDN and DNS security. Transfer covered by SCC.
• Vercel, Inc. (USA) — application hosting. Transfer covered by SCC.

We do not sell personal data or hand it over to third parties for their own marketing purposes.

6. International transfers

Some of the providers listed are based outside the EU. Transfers take place in accordance with Art. 46 GDPR through Standard Contractual Clauses approved by the European Commission or on the basis of an adequacy decision.

7. Your rights

Under Articles 15–22 GDPR, you have the right to:

• Access (Art. 15): obtain a copy of your personal data.
• Rectification (Art. 16): correct inaccurate data.
• Erasure (Art. 17): delete your account and all associated data with the “Delete account” function in the settings.
• Restriction (Art. 18): request that processing be suspended in certain cases.
• Portability (Art. 20): receive your data in a structured, machine-readable format.
• Objection (Art. 21): object to processing based on legitimate interest.
• Withdrawal of consent (Art. 7(3)): withdraw your consent to analytics and marketing cookies at any time with the “Change cookie preferences” button below.

To exercise your rights write to easybterminal@gmail.com. You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali) (garanteprivacy.it).

8. Cookie Policy

We use the following categories of cookies:

9. Security

We adopt appropriate technical and organisational measures to protect your data: AES-256 encryption for broker credentials, mandatory HTTPS (HSTS), login verification code, rate limiting on critical endpoints, data access limited to authorised personnel.

10. Changes to this Privacy Policy

We may update this policy. In case of substantial changes, registered users will be informed by email at least 15 days before they take effect. The updated version is always available at this address.