Privacy Policy
Last updated: 12 October 2026
This is an English translation provided for convenience. The Spanish version (Política de Privacidad) is the legally binding one and prevails in case of any discrepancy.
At Tradatix we take our users' privacy very seriously. This Privacy Policy describes what personal data we collect, the purposes for which we process it, how we protect it and what your rights are. This policy applies to the Tradatix website and platform and complies with Regulation (EU) 2016/679 (the General Data Protection Regulation, GDPR) and Spanish data protection legislation (Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights, LOPDGDD).
1. Data Controller
The controller responsible for processing your personal data is:
- Name: Tradatix
- Contact email: admin@tradatix.com
For any matter relating to the processing of your personal data or the exercise of your rights, you can write to the email address above.
2. Personal Data We Collect
We collect the following personal data depending on how you interact with the platform:
| Category | Data collected | Source |
|---|---|---|
| Account data | Username, email address, password (stored with an irreversible bcrypt hash) | Provided by the user on registration |
| Trading data | Imported trades (MT5, NinjaTrader, etc.), journal notes, backtesting strategies, simulation results, tags and comments | Entered or imported by the user |
| Third-party platform credentials | If you connect a platform (Tradovate, TopstepX, Volumetrica / DeepCharts…): your username on that platform and its API key, access token or, if the platform offers no other way to grant access (Volumetrica), the password, stored encrypted. They are only used to import your trades and, on the accounts you add to a Copier group, to copy trades. They are deleted when you disconnect the platform | Provided by the user when connecting the platform |
| Subscription data | Active plan, subscription status, billing history (amounts, dates). Card data is handled exclusively by Stripe | Generated when subscribing to the service |
| Technical data | IP address, browser type, operating system, session data (authentication tokens), access logs | Collected automatically when using the platform |
We do not collect special categories of data (health, political opinions, etc.) or data from persons under 18 years of age.
3. Purposes and Legal Basis for Processing
We process your personal data for the following purposes, on the legal bases indicated:
| Purpose | Legal basis (GDPR) |
|---|---|
| Account management and provision of the Service (backtesting, journal, simulator, collaboration) | Performance of a contract — Art. 6(1)(b) |
| Payment processing and subscription management | Performance of a contract — Art. 6(1)(b) |
| Sending communications related to the Service (account notices, changes to the terms, invoices) | Performance of a contract / Legitimate interest — Art. 6(1)(b) and 6(1)(f) |
| Security, fraud prevention and protection of the platform | Legitimate interest — Art. 6(1)(f) |
| Compliance with legal obligations (retention of tax and accounting records) | Legal obligation — Art. 6(1)(c) |
| Improving the Service using anonymized or aggregated data | Legitimate interest — Art. 6(1)(f) (non-identifiable data) |
We do not use your personal data for third-party advertising or to build profiles for commercial purposes.
4. Third Parties that Receive Your Data
Tradatix does not sell your personal data to third parties. Data may only be shared with the following service providers, acting as data processors:
- Stripe, Inc. — Secure payment processing and subscription management. Stripe acts as an independent controller for its own processes. We recommend reading Stripe's Privacy Policy. Stripe may process your data in the United States (see section 7).
- Cloud infrastructure provider — Hosting and storage of platform data, under a data processing agreement and with appropriate security measures.
We may disclose personal data when required by applicable law, a court order or a competent authority, or when necessary to protect the rights and legitimate interests of Tradatix.
5. Data Retention
We retain your personal data for the following periods:
- Account data and trading data: for as long as your account remains active and for 30 days after you request deletion of the account, during which you can recover your data. After that period, the data will be permanently deleted or anonymized.
- Payment and billing records: retained for 5 years from the issue of the corresponding accounting document, in compliance with Spanish tax and commercial legislation.
- Technical data (logs, IP addresses): retained for a maximum of 12 months for security and troubleshooting purposes.
6. Your Rights as a Data Subject (GDPR)
Under the GDPR, you have the following rights regarding the processing of your personal data:
- Right of access (Art. 15 GDPR): to obtain confirmation of whether we process your data and a copy of it.
- Right to rectification (Art. 16 GDPR): to have inaccurate or incomplete data corrected.
- Right to erasure, or "right to be forgotten" (Art. 17 GDPR): to have your data deleted when it is no longer necessary for the purposes for which it was collected, among other cases.
- Right to data portability (Art. 20 GDPR): to receive your data in a structured, commonly used and machine-readable format and to transmit it to another controller.
- Right to restriction of processing (Art. 18 GDPR): to request the temporary suspension of processing in certain circumstances.
- Right to object (Art. 21 GDPR): to object to the processing of your data where it is based on Tradatix's legitimate interest.
- Right not to be subject to automated decision-making (Art. 22 GDPR): not to be subject to decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you.
To exercise any of these rights, send your request to admin@tradatix.com, stating your identity and the right you wish to exercise. We will respond within a maximum of one month from receipt of your request.
If you believe that the processing of your data infringes applicable legislation, you have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) at www.aepd.es.
7. International Data Transfers
As a general rule, your data is stored and processed within the European Economic Area (EEA). However, Stripe, Inc. may process some payment data on servers located in the United States.
This international transfer is covered by the standard contractual clauses approved by the European Commission (Implementing Decision (EU) 2021/914), which ensure a level of protection equivalent to that required by the GDPR. For more information on the safeguards applied by Stripe, see its Privacy Policy.
8. Cookies and Tracking Technologies
Tradatix uses a small, strictly necessary set of cookies:
- Session (authentication) cookies: technical cookies required to keep the authenticated user's session active on the platform. The Service cannot work without them. They are deleted when you close the browser or log out.
Tradatix does not use advertising cookies, behavioural tracking, third-party analytics (e.g. Google Analytics) or persistent profiling cookies.
You can configure your browser to block or delete cookies, but please note that disabling session cookies will prevent you from using the platform.
9. Data Security
Tradatix applies appropriate technical and organisational measures to protect your personal data against unauthorized access, loss, alteration or disclosure. The measures adopted include:
- Password storage using bcrypt hashing with a unique salt per user.
- Communications encrypted with HTTPS/TLS.
- Access to production data restricted to authorized personnel.
- HTTP security headers (CSP, X-Frame-Options, HSTS, etc.).
- Rate limiting of login attempts to prevent brute-force attacks.
In the event of a security breach affecting your personal data that poses a risk to your rights and freedoms, Tradatix will notify the AEPD and, where appropriate, the affected user, within the time limits set by the GDPR.
10. Minors
The Service is intended exclusively for persons over 18 years of age. Tradatix does not knowingly collect personal data from anyone under that age. If you become aware that a minor has provided data to Tradatix without the consent of their parents or guardians, please let us know at admin@tradatix.com so that we can delete it.
11. Changes to this Privacy Policy
Tradatix reserves the right to update this Privacy Policy to reflect legislative, case-law or business changes. Relevant changes will be communicated to the user by email and/or a notice on the platform, with reasonable advance notice. We recommend that you review this page periodically.
12. Contact and Exercise of Rights
For any privacy question, request to exercise your rights or complaint, please contact us:
You can also visit our contact page. We will handle your request within a maximum of one month, which may be extended by a further two months in particularly complex cases.