Privacy Policy

1. Controller

The controller responsible for data processing on this platform is:

As of this version, the company has not yet been entered in the German commercial register (the "i. G." / "in formation" suffix — see the Impressum, which offers its own English toggle). This does not affect its responsibility as the provider within the meaning of the GDPR. A data protection officer is currently not required to be appointed under Art. 37 GDPR; should this change as the company grows, this policy will be updated accordingly.

2. Your Rights as a Data Subject

You have the following rights with respect to your personal data processed by us:

• access to the data we process about you (Art. 15 GDPR);
• rectification of inaccurate or completion of incomplete data (Art. 16 GDPR);
• erasure of data we hold about you (Art. 17 GDPR), unless statutory retention obligations apply;
• restriction of processing (Art. 18 GDPR);
• data portability, where processing is based on consent or on a contract and is carried out by automated means (Art. 20 GDPR);
• objection to processing based on Art. 6(1)(f) GDPR, on grounds relating to your particular situation (Art. 21 GDPR);
• withdrawal of any consent given, with effect for the future (Art. 7(3) GDPR), e.g. your waitlist sign-up;
• complaint to a data protection supervisory authority (Art. 77 GDPR), in particular the authority responsible for [federal state] or the authority of your habitual residence.

To exercise these rights, an informal message to info@tradestaq.com is sufficient. We generally respond within one month (Art. 12(3) GDPR).

3. Registration and User Account

Using okostrader requires an account. During registration we collect your email address, a password of your choosing (stored by us only as a hash, never in plain text), and optionally your first/last name and company. This processing serves the performance of the usage contract (Art. 6(1)(b) GDPR). Email verification and password reset rely on time-limited, single-use tokens; this serves account security (Art. 6(1)(f) GDPR).

4. Login Sessions and Cookies

After login, we set a single, technically necessary session cookie that identifies your session against a hashed session token on our server (not your password itself). The cookie is transmitted only over an encrypted connection (Secure flag) and is restricted to the same site (SameSite=Lax). For each session we log the IP address, user agent, and the start, last activity, and end of the session — to detect misuse and secure your account (Art. 6(1)(f) GDPR). Beyond this technically necessary cookie, we do not use tracking, marketing, or third-party cookies, and no analytics tools such as Google Analytics; a cookie consent banner is therefore not currently required (§ 25 TTDSG/DDG applies only to cookies that are not strictly necessary). Should this change in the future, this policy will be updated beforehand and consent obtained where required.

5. Consent to the Terms and Privacy Policy

Both when creating your account and again — immediately before the paid order — during checkout, you must confirm that you have read the Terms and Conditions and this Privacy Policy. The Terms include the statutory withdrawal notice as their Section 13; there is no separate checkbox for it, since its content is already part of the confirmed Terms. For each such confirmation we store the timestamp, IP address, and the version identifier of the underlying Terms/Privacy Policy version. This serves to document that and when you took note of these documents — including the withdrawal notice — a statutory documentation duty in connection with contract formation and the withdrawal notice (Art. 6(1)(c) GDPR in conjunction with § 312j(2), §§ 355 et seq. BGB) and our legitimate interest in preserving evidence (Art. 6(1)(f) GDPR).

6. Payment Processing

Paid plans are processed through the payment provider Stripe (Stripe Payments Europe, Limited, based in Ireland, and Stripe, Inc., USA, as parent company). You enter card and bank details exclusively directly with Stripe; they do not pass through our servers and are not stored by us. We only receive and store the Stripe customer and subscription reference, the selected plan, the billing period, and status information (e.g. paid/cancelled), in order to unlock your entitlement in your account. The legal basis is performance of the contract (Art. 6(1)(b) GDPR). To the extent data is thereby transferred to the US, this is based on the EU Standard Contractual Clauses offered by Stripe as part of its data processing agreement; see Stripe's Privacy Policy for details.

7. AI-Assisted Formalization of Your Trading Idea

The Strategy Builder converts a natural-language description of your trading idea, which you write yourself, into an executable rule. To do so, the text you enter is transmitted to and processed by our AI model provider; we currently use services from OpenAI, L.L.C. (USA) for this. Transfer to the US is based on the EU Standard Contractual Clauses in our data processing agreement with OpenAI. The legal basis is performance of the contract (Art. 6(1)(b) GDPR), since formalizing your idea is the core, contractually owed function of the Platform. OpenAI states that it does not use text submitted via its API to train its own models; OpenAI's current published terms govern. We only count how many requests were made per billing period (to check your plan's quota); the content of your input is otherwise stored by us only to the extent the result — the rule generated from it — becomes part of your saved strategy (see Section 8).

8. Strategy, Backtest and Execution Data

Your saved strategies (name and rule definition), your backtest results, and metrics on paper and live executions (including symbol, time, quantity, price, profit/loss) are stored in your account so you can access them, keep working on them, and review their history. The legal basis is performance of the contract (Art. 6(1)(b) GDPR). This data relates exclusively to your own use of the Platform; we do not analyze its content for our own purposes and do not disclose it to third parties.

9. The Local Gateway and Your Broker Credentials

The Gateway agent runs on your own computer and connects from there directly to your local TWS/IB Gateway installation. Your access credentials for your broker account (Interactive Brokers), as well as your account number and balance, remain within that local connection and are not transmitted to or stored on our servers. Only the following travels over the connection between the Gateway and our server: the strategy configuration required for execution, control commands (e.g. start/stop), license/quota checks, and the execution results needed for display and logging (Section 8). This data separation is a deliberate design choice and part of the Platform's security architecture.

10. Email Communication

For registration confirmation, password reset, and waitlist communication, we send emails via our email provider (Strato AG, Germany). This processes your email address, name (if provided), and the respective message content. The legal basis is performance of the contract or the taking of pre-contractual steps (Art. 6(1)(b) GDPR).

11. Waitlist

For the waitlist we collect your email address, optionally your name, and details about your broker and desired plan. Sign-up uses a double opt-in process: we only store your details after you confirm via the link sent to you. We log the time and IP address of your confirmation as evidence of consent (Art. 6(1)(a) in conjunction with Art. 7(1) GDPR). You may unsubscribe at any time via the unsubscribe link in any email or by informal email; this withdraws your consent with effect for the future.

12. Recipients, Processors and Third-Country Transfers

We disclose your data to third parties only to the extent necessary to provide our service or where we are legally required to do so. We have data processing agreements under Art. 28 GDPR with all providers listed below that process personal data on our behalf:

• Stripe (payment processing, Ireland/USA) — Section 6;
• OpenAI (AI-assisted strategy formalization, USA) — Section 7;
• Strato AG (email delivery, Germany) — Section 10;
• [Hosting/server provider — to be added before go-live, see Section 14].

For providers based outside the EU/EEA (Stripe in part, OpenAI), transfer is based on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) in the respective data processing agreement. We do not otherwise disclose your data, and in particular do not sell it.

13. Retention Periods

We retain personal data only for as long as necessary for the relevant purpose or as required by statutory retention obligations:

• account data: until you delete your account or request deletion, unless one of the following periods applies;
• invoicing and billing data: [6 or 10 years under § 147 AO, § 257 HGB — to be finalized with tax advice before go-live];
• records of consent to the Terms/Privacy Policy/withdrawal notice: for the duration of the contractual relationship plus the statutory limitation periods (up to 3 or 10 years, §§ 195, 199 BGB), as evidence of proper disclosure;
• session/login logs: [90 days — placeholder, to be finalized], after which they are deleted automatically;
• waitlist data: until withdrawal/unsubscribe or product launch, after which it is deleted or — with separate consent — converted into a regular customer account.

14. Hosting and Server Location

[To be finalized before go-live: name and registered seat of the hosting provider, server location (goal: EU/Germany), and whether and to what extent server access log files are generated. If the provider is based outside the EU/EEA, this section will be supplemented with the corresponding transfer mechanism.]

15. Security of Processing

We employ technical and organizational measures under Art. 32 GDPR, including: encryption of transmissions (TLS/HTTPS), storing passwords only as a hash (never in plain text), storing session tokens only as a hash, and a strict separation between the data we store and the broker credentials that remain exclusively on your own computer (Section 9). These measures are continuously adapted to reflect the state of the art.

16. Minors

This offering is directed exclusively at adults with full legal capacity and at businesses within the meaning of § 14 BGB. We do not knowingly collect data from minors.

17. Changes to This Privacy Policy

We update this policy whenever data processing or the legal situation changes. In the case of material changes — in particular where they concern new processing activities or recipients — we will inform you appropriately and, where required, obtain your confirmation again (see Section 5).

18. Contact

For questions about data protection, please contact info@tradestaq.com.