Draft – pending legal review. This page describes how XcalpAI works so that a lawyer can finalise it. Items in [brackets] must be completed. Remove this notice only after legal sign-off.

Privacy Policy

Last updated: [DATE OF LEGAL SIGN-OFF]

1. Controller

[COMPANY LEGAL NAME], [REGISTERED ADDRESS], is responsible for your personal data. Contact: privacy@xcalpai.com [CONFIRM ADDRESS]. [DATA PROTECTION OFFICER / EU-UK REPRESENTATIVE IF REQUIRED].

2. What we collect and why

Data	Why	Legal basis [CONFIRM]
Name, email, password (stored only as a salted hash), optional phone and Telegram chat id	Your account, sign-in, notifications	Contract
Broker login number, server and account label	Connecting and copying to your trading account	Contract
Your broker password	Passed once to MetaApi to connect your account; we do not store it	Contract
Trades, balance, equity, deposits and withdrawals of connected accounts	Your dashboard, risk limits, performance-fee calculation	Contract
Subscription, invoices, payment status (card data is held by Paddle, not us)	Billing and tax records	Contract / legal obligation
Two-factor secret, Telegram bot token (stored encrypted)	Account security and alerts you configure	Contract
IP address, request logs, security audit logs	Security, fraud and abuse prevention, rate limiting	Legitimate interest
Partner/agency application details	Assessing partnership requests	Steps before a contract

3. Who we share it with

MetaApi / CopyFactory (agiliumtrade.ai) – connects to your broker account and copies trades.
Paddle – payments, taxes and invoices as merchant of record.
[EMAIL PROVIDER] – sends verification, password-reset and account emails.
Hosting provider [NAME, REGION] – runs our servers and backups.
Sentry [IF ENABLED] – error diagnostics (no passwords or card data).
Telegram – only if you connect a Telegram chat for alerts.
Google / Apple – only if you choose to sign in with them.

We do not sell personal data. [LIST INTERNATIONAL TRANSFER SAFEGUARDS, e.g. standard contractual clauses.]

4. Cookies

We use one essential, HttpOnly session cookie to keep you signed in, and your browser's local storage for display preferences. We do not use advertising or tracking cookies. [UPDATE IF ANALYTICS ARE ADDED.]

5. How long we keep it

Account and trading data: while your account is open.
Invoices and fee statements: [e.g. 7 years] for tax purposes, detached from your identity after account deletion.
Database backups: up to [14] days, then overwritten.
Security logs: [e.g. 12 months].

6. Your rights

You can download all of your data (Profile → "Download my data") and delete your account and personal data yourself (Profile → "Delete my account"). You may also ask us to correct, restrict or object to processing, and complain to your data-protection authority [NAME OF AUTHORITY].

7. Security

Passwords are hashed with Argon2, sessions use HttpOnly cookies, two-factor authentication is available, stored secrets are encrypted, and access to the admin console requires an authenticator code. No system is perfectly secure; we will notify you of a breach as the law requires.