This is a translation provided for convenience. The Spanish version of this document is the legally binding one; in case of any discrepancy, the Spanish version prevails.
Data controller
The controller of the personal data processed on Trade & Repeat is Alex Ledesma, domiciled in the Dominican Republic. For any privacy matter, write to us at tradeandrepeat@outlook.com.
What data we process
- Your account data: email, password (stored encrypted, never in plain text), display name and subscribed plan.
- What you create in the tool: backtesting sessions, simulated trades, strategies, chart settings and your trading journal entries, including the reflections and the emotion you record for each trade.
- Payment data: the email and the membership identifier that Whop sends us when a payment is confirmed. We do not receive or store your card details.
- Your review: if you choose to leave us your opinion of the tool, the rating and the comment.
- Technical data: the IP address, used to stop bots and limit abusive log-in attempts, and the application's technical error logs, which do not include your account data.
- Analytics: only if you accept it, aggregated browsing data (see the cookie policy).
What we use it for and on what basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Giving you access to the tool and saving your work | Performance of a contract (Art. 6(1)(b)) |
| Managing your subscription and account emails | Performance of a contract (Art. 6(1)(b)) |
| Protecting the service against bots and abuse, and fixing errors | Legitimate interest (Art. 6(1)(f)) |
| Measuring site usage with Google Analytics | Your consent (Art. 6(1)(a)) |
| Keeping payment records | Legal obligation (Art. 6(1)(c)) |
We do not sell your data, we do not use it for advertising and we do not make automated decisions that affect you.
Providers that process data
To provide the service we rely on these providers, which process the data only on our behalf and for the stated purpose:
| Provider | Purpose | What data |
|---|---|---|
| Supabase | Database and authentication | Email, encrypted password, profile and everything you save in the tool |
| Vercel | Website hosting | Technical data of each request (IP, browser) |
| Whop | Subscription billing | Email and payment data (the card is processed by Whop; it never reaches us) |
| Resend | Sending account emails | |
| Cloudflare Turnstile | Bot protection on sign-up and log-in | IP and technical browser data |
| Upstash | Attempt limits against abuse | IP |
| Sentry | Technical error logging | Technical error data, without cookies, headers or your account data |
| Google Analytics | Usage analytics, only if you accept it | Browser identifier and pages visited |
International transfers
The controller is in the Dominican Republic and several providers in the table above operate from the United States, so your data may be processed outside the European Economic Area. These transfers are covered by the European Commission's standard contractual clauses or by the EU-U.S. Data Privacy Framework to which each provider has subscribed.
How long we keep it
- Account and what you create in it: for as long as your account exists. If you delete it from the application, it is erased instantly together with all its data; if you ask us to delete it by email, we do so within a maximum of 30 days.
- Payment records: for as long as required by the applicable tax regulations.
- Technical errors: up to 90 days.
- Analytics: up to 14 months.
Your rights
You can ask us at any time to access your data, rectify it, erase it, restrict or object to its processing, or receive it in a portable format. You can also withdraw your consent to analytics whenever you want from "Cookie preferences" in the footer. To exercise any of these rights, write to us at tradeandrepeat@outlook.com from your account email; we respond within a maximum of one month.
You can also delete your account yourself from the application, in the side menu → Delete account ("Eliminar cuenta" in the app menu). If you have an active subscription, you first have to cancel it on Whop; once your plan ends, the option becomes available.
If you believe we have not handled your request properly, you can file a complaint with the data protection authority of your country — in Spain, the Spanish Data Protection Agency (aepd.es).
United States residents
We voluntarily extend to all United States residents the rights recognized by the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), and by comparable state laws (Virginia, Colorado, Connecticut, Utah and Texas, among others), on the terms set out in this section. These laws only bind businesses that exceed certain thresholds; we apply these rights regardless of whether they bind us or not.
The categories of personal information we collect are those described in "What data we process": your account data, what you create in the tool, payment data, your review, technical data (including the IP address) and, only if you accept it, analytics. We use them solely for the purposes stated in "What we use it for and on what basis", and we disclose them only to the providers in the "Providers that process data" table, which process them on our behalf.
As a United States resident, you have the right to:
- Know and access: find out what personal information about you we process and receive a copy.
- Delete: ask us to delete your personal information.
- Correct: ask us to correct inaccurate personal information.
- Opt out of sale or sharing: ask us not to sell or share your personal information.
- Non-discrimination: we will not deny you the service, charge you a different price or provide you a lower-quality service for exercising these rights.
We do not sell or share personal information, as those terms are defined by those laws (including sharing it for cross-context behavioral advertising). We honor Global Privacy Control (GPC) signals from your browser as a request to opt out of sale or sharing.
To exercise these rights, write to us at tradeandrepeat@outlook.com from your account email: we verify your request by checking that it comes from that email. You can also designate an authorized agent to submit it on your behalf; in that case we will ask them for proof of the authorization and may ask you to confirm the request from your account email. We respond within 45 days, which we may extend once by another 45 days after notifying you.
The service is not directed to children under 13 and we do not knowingly collect their data, in accordance with the U.S. Children's Online Privacy Protection Act (COPPA).
Minors
Trade & Repeat is intended for people aged 18 and over. We do not knowingly collect data from minors; if we detect an account belonging to a minor, we delete it.
Security
All communication with the site is encrypted (HTTPS), passwords are stored encrypted, and the database applies per-user rules so that each account can only read and modify its own data.
This page describes how we process personal data as of the date indicated above. If something relevant changes (for example, a new provider), we update it and that date changes. It complements the terms and conditions and the cookie policy.