Privacy Policy

1. Who we are and what this covers

The data controller is Nicola Faieta, Viale Muzii 91, 65123 Pescara, Italy, VAT IT02333630685, trading as PlugTrade. Contact: support@plugtrade.io.

This policy covers the website plugtrade.io (product pages, account area, checkout), the PlugTest invite form, and the data the PlugTrade and PlugTest software send to our servers.

PlugTrade runs on your own VPS next to MetaTrader 5. PlugTest runs on your own computer. Your trading data stays there: see section 3.

2. What we collect and why

Each item lists the purpose and the legal basis under the GDPR (art. 6).

• Invite and early-access requests. Your email address, plus the programme and community boxes if you tick them. We use the address to send you the code or the notice you asked for; with the programme box we also send updates on the app and, now and then, a question on how it goes. You can leave at any time; leaving means giving up the place. Basis: consent.
• Account. Email address, password (stored only as a PBKDF2-SHA512 hash, never in clear), first and last name if you give them, your referral code and the code you signed up with, whether the email is verified, login times and failed-login counter. Basis: performance of the contract with you.
• Subscription and payments. Billing, tax and card handling are done by Paddle, our Merchant of Record and the seller of record for every transaction. Card or PayPal details go to Paddle, not to us. We receive Paddle customer, subscription and transaction identifiers, the plan, its status, amount, currency and the billing period. Basis: contract; accounting obligations.
• Devices running PlugTrade. When PlugTrade activates a licence it sends the licence key, an instance identifier and, if you set one, a device name. We record the IP address the request came from and the last time the device was seen, to enforce the number of devices your plan allows. Basis: contract; legitimate interest in preventing licence sharing.
• Emails we send. Service emails (email verification, password reset, device verification codes, licence delivery, trial and payment notices, subscription changes, referral notices) are part of the service. Newsletter emails only if you tick the box at signup; every one carries an unsubscribe link. Basis: contract for service emails; consent for the newsletter.
• Website analytics and advertising measurement. Where the cookie banner is shown, only after you press Accept: Google Analytics 4, Google Tag Manager, Google Ads conversion tracking and the Meta Pixel, plus our own event log (event name, page, browser user agent, IP address). With that consent we also report a completed registration or purchase to Google and Meta from our server, with a hashed email address, IP address, user agent and the Google or Meta browser identifiers. We show the banner to visitors from the EU and the EEA, the United Kingdom and Switzerland; from other countries these tags load without a banner and you can switch them off at any time, as the Cookie Policy explains. Basis: consent where the banner is shown; our legitimate interest in measuring how the site is used where local law asks for no prior consent. Where consent is required and you do not give it, none of this runs.
• Referral programme. Who referred whom (by account identifier), the status of each referral and any reward granted. Basis: contract.
• Technical logs. Our hosting provider keeps request logs (IP address, time, page requested) for security and to keep the service running, for a short fixed period. Basis: legitimate interest.
• Browser storage. Language preference, cookie choice and a few caches stay in your browser and are not sent to us. See the Cookie Policy.

No profiling for decisions with legal effect, no selling or renting of data.

3. What we never see

PlugTrade receives TradingView alerts on your VPS and places orders in your MetaTrader 5 terminal there. Nothing of that passes through our servers. We have no access to:

• your trading signals, webhook payloads or strategy parameters;
• your MetaTrader 5 credentials, account numbers or broker;
• your trade history, positions, balance or performance;
• the historical data and journal PlugTest keeps on your computer.

The only traffic from the software to us is licence validation (section 2, "Devices running PlugTrade").

4. Who processes the data for us

Only the providers we need to run the service, bound by data-processing agreements:

• Vercel Inc. (USA): hosting of the website, of the application and of the PlugTest invite service. Our server functions run in Frankfurt. It also works out your country from your IP address when you request a page, so we know whether to show you the cookie banner; the country is not stored.
• Neon Inc. (USA): the PostgreSQL database that holds accounts, subscriptions, licences and invite requests.
• Resend Inc. (USA): delivery of the emails we send you.
• Paddle: Merchant of Record for payments, subscriptions and invoices. Paddle processes your payment data under its own privacy policy.
• Google LLC (USA): analytics and advertising measurement, only with your consent. On the two product pages (home and /plugtest) Google Analytics 4 loads after consent and the typefaces come from Google Fonts, which receives your IP address for that request; the rest of the site serves fonts from our own domain.
• Meta Platforms (USA / Ireland): advertising measurement, only with your consent. The Meta Pixel loads after consent on every page, the two product pages included.

Transfers to the USA rely on the EU-US Data Privacy Framework where the provider is certified, and on Standard Contractual Clauses otherwise. We also disclose data when the law requires it or to defend our legal rights.

5. How long we keep it

• Invite and early-access requests: until fulfilled and for 12 months after, then deleted.
• Programme membership and newsletter: until you leave or unsubscribe.
• Account: while the account exists. When you delete it, we remove email, name and password immediately; the email address is kept in a block list for 30 days to stop the same address re-registering, then deleted.
• Payment records: 10 years, as Italian accounting law requires.
• Referral records: while the account exists; after deletion they stay linked to the anonymised account so rewards and payments already granted remain consistent.
• Licence and device records: while the licence is valid and for 30 days after.
• Analytics event log: at most 12 months.
• Hosting logs: a short fixed period set by the provider.

6. Your rights

You can ask for access, rectification, erasure, restriction of processing and portability of your data, object to processing based on legitimate interest, and withdraw consent at any time without affecting what was done before. Write to support@plugtrade.io; we answer within 30 days.

You can delete your account yourself from the dashboard once no subscription is active. You can leave the newsletter with the link in any email or at /unsubscribe.

You also have the right to lodge a complaint with the Italian supervisory authority, the Garante per la protezione dei dati personali (garanteprivacy.it), or with the authority of the EU country where you live.

7. Security

All traffic uses HTTPS. Passwords are stored as salted PBKDF2-SHA512 hashes. Sessions are revoked when you change your password. Accounts lock after repeated failed logins. New devices are confirmed with a code sent to your email. No method of transmission over the Internet is completely secure, and we cannot guarantee absolute security.

8. Age

The service is for people aged 18 or over. We do not knowingly collect data from minors; if we learn we have, we delete it.

9. Changes

If this policy changes, the date at the top changes with it. Substantial changes are announced by email to account holders and programme members.

10. Contact

Nicola Faieta, Viale Muzii 91, 65123 Pescara, Italy, VAT IT02333630685. Email: support@plugtrade.io.