Privacy Policy

This Privacy Policy describes how ZalorTrade LLC, a Colorado limited liability company ("Company," "we," "us," or "our"), collects, uses, stores, and shares personal information when you use ZalorTrade (the "Service").

This policy is aligned with the Colorado Privacy Act (CPA) (C.R.S. § 24-73-101 et seq., effective July 1, 2023), the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) (Cal. Civ. Code § 1798.100 et seq.), and includes GDPR-readiness provisions for users in the European Economic Area (EEA) and United Kingdom. By using the Service, you acknowledge the collection and use of information as described in this policy.

1. Data Controller Identity

The data controller of your personal data is ZalorTrade LLC, a limited liability company organized under the laws of the State of Colorado, United States. Our Data Protection contact is support@zalortrade.com. We do not have a designated EU/UK representative at this time; for GDPR matters, please contact us directly.

2. Categories of Personal Data We Collect

We collect the following categories of personal information:

a. Account and Identity Data

• Email address (required for account creation and login)
• First name and last name
• Display name (optional)
• Phone number (optional)
• Date of birth (optional)

b. Profile and Preference Data

• Timezone, language, and currency preference
• Biography (optional)
• Profile avatar image (optional, stored in Supabase Storage)
• Notification preferences (email and in-app per category)

c. Address Data (Optional)

• Street address, city, state/province, postal code, country
• Address type (home, business, billing, or shipping)

d. Trading Profile Data

• Trading experience level (beginner through expert)
• Risk tolerance (conservative through very aggressive)
• Preferred markets and instruments
• Investment goals and trading style
• Account size range and primary broker
• Typical trading hours

e. Financial and Trade Data

• Trading instrument names and types (stock, forex, futures, options, crypto, commodity)
• Trade direction (long or short)
• Trade quantity, entry price, exit price
• Stop-loss and take-profit levels
• Entry and exit dates and times
• Profit/loss (PnL) amounts
• Commission and swap costs
• Strategy tags, setup type, market condition labels, and notes (entered by you)
• Trade screenshot images (uploaded by you; max 5MB per file, stored in Supabase Storage)

f. Trading Account Data

• Account name, associated broker, account number, and account type (demo, live, or paper)
• Base currency
• Initial and current account balances

g. Payment and Billing Data

• Last four digits and brand (e.g., Visa) of your payment card (stored by Stripe on our behalf)
• Card expiry month and year
• Subscription plan, status, start/end dates
• Invoice amounts, currency, tax amounts, and payment dates
• Stripe customer ID and subscription ID (internal references)

We do not store your full card number, CVV, or full bank account details. All payment card data is handled directly by Stripe, Inc. in accordance with PCI-DSS Level 1 standards.

h. Broker OAuth Tokens

• OAuth access tokens and refresh tokens for connected broker platforms (Tradovate, Alpaca)
• Token type, scope, and expiry date

Broker tokens are stored exclusively on our server-side infrastructure (Supabase Edge Functions environment). They are never transmitted to or stored in your browser.

i. Activity and Audit Log Data

• IP address (IPv4 and IPv6)
• Browser user agent string
• Login timestamps and events
• Account actions (e.g., password changes, payment method updates, subscription changes)

j. Automatically Collected Data

• Session authentication cookies (managed by Supabase Auth; see our Cookie Policy)
• Broker connection preferences stored in browser localStorage (non-sensitive: selected broker, sync preferences; no PII)

3. How We Use Your Personal Data

We use the data we collect for the following purposes:

• Providing the Service: Authenticating your account, storing and displaying your trades and analytics, syncing trades from connected brokers, and enabling all Service features.
• Processing payments: Creating your Stripe customer record, processing subscription charges, managing renewals, and sending billing confirmations.
• Transactional communications: Sending security alerts (e.g., new login notifications), billing alerts (e.g., failed payment, upcoming renewal), broker connection status updates, and performance milestone notifications. These are sent only to the extent you have opted in per your notification preferences.
• Security and fraud prevention: Monitoring for unauthorized access, rate-limiting login attempts, and maintaining audit logs.
• Legal compliance: Retaining records as required by applicable law (e.g., accounting records, tax records, legal holds).
• Improving the Service: Analyzing aggregate, anonymized usage patterns to identify bugs and improve features. We do not profile individual users for advertising purposes.

We do not use your trade data or personal information to provide investment advice, sell advertising, or build profiles for resale to third parties.

4. Legal Basis for Processing (GDPR — EEA/UK Users)

For users in the EEA/UK, we process your personal data under the following legal bases:

• Contract performance (Art. 6(1)(b)): Processing necessary to provide the Service you signed up for (account management, trade storage, billing).
• Legal obligation (Art. 6(1)(c)): Retaining billing records, responding to lawful government requests.
• Legitimate interests (Art. 6(1)(f)): Security monitoring, fraud prevention, audit logging, and improving the Service — subject to your rights to object.
• Consent (Art. 6(1)(a)): Where you have specifically opted in to optional email notifications. You may withdraw consent at any time in your notification settings.

5. Data Processors and Sub-Processors

We share your personal data with the following third-party processors to operate the Service. All sub-processors are contractually required to protect your data in accordance with applicable law:

We may add, remove, or change sub-processors. We will update this policy and, where required by law, notify affected users before making such changes.

6. Data Sharing and No Sale of Personal Data

We do not sell, rent, or share your personal data with third parties for their own marketing, advertising, or commercial purposes. We do not engage in targeted behavioral advertising using your personal data.

We may share your data only in the following limited circumstances:

• Sub-processors: As described in Section 5, solely to operate the Service.
• Legal requirements: If required by law, court order, or lawful government request, we will disclose only what is legally required and will attempt to notify you where permitted.
• Business transfer: In connection with a merger, acquisition, or sale of substantially all assets, your data may be transferred to the successor entity, subject to the same privacy protections. We will notify you via email and post a notice on the Service before any such transfer occurs.
• Aggregate/anonymized data: We may share aggregate, de-identified statistics (e.g., "X% of users trade futures") that cannot reasonably be used to identify any individual.

7. Data Retention

• Active accounts: We retain all personal data and trade data for as long as your account is active.
• After account deletion: Upon your request to delete your account, we will delete or anonymize all personal data and trade records within 30 days, except where retention is required by law.
• Billing and invoice records: Retained for 7 years after your last transaction to comply with IRS recordkeeping requirements (26 U.S.C. § 6001) and applicable tax law.
• Audit logs: Retained for 2 years after the logged event to support security investigation and legal compliance needs.
• Broker tokens: Deleted immediately upon you disconnecting the broker integration or deleting your account.

8. Security

We implement the following technical and organizational measures to protect your data:

• All data is encrypted at rest (AES-256) and in transit (TLS 1.2+) via Supabase's infrastructure.
• Row Level Security (RLS) is enforced on all database tables: your data is only accessible to your authenticated account.
• Passwords are hashed using bcrypt by Supabase Auth and are never stored in plaintext.
• Broker OAuth tokens are accessible only via server-side Supabase Edge Functions and are never exposed to the browser.
• Sensitive actions (login, password change, payment method updates, subscription changes) are logged in our audit table.
• Login attempts are rate-limited; accounts are temporarily locked after repeated failed attempts.

No security measure is 100% effective. If you believe your account has been compromised, contact us immediately at support@zalortrade.com.

9. Cookies and Local Storage

See our full Cookie Policy for detail. In summary:

• We use strictly necessary authentication cookies set by Supabase Auth (sb-*-auth-token). These are required for login and cannot be disabled without breaking the Service.
• We use browser localStorage only to store non-sensitive broker connection preferences (e.g., selected broker name, sync interval). No PII or tokens are stored in localStorage.
• We do not use analytics cookies, advertising cookies, or third-party tracking pixels.

10. Your Rights — Colorado Privacy Act (CPA)

Under the Colorado Privacy Act (C.R.S. § 24-73-101 et seq.), Colorado residents have the following rights:

• Right to Access: You may request to know what personal data we hold about you.
• Right to Correction: You may request correction of inaccurate personal data.
• Right to Deletion: You may request deletion of your personal data, subject to certain exceptions (e.g., legal retention obligations).
• Right to Portability: You may request your data in a portable format. ZalorTrade offers a data export feature in your account settings.
• Right to Opt Out of Targeted Advertising and Sale: We do not sell personal data or engage in targeted advertising, so this right is not applicable. You may still contact us to confirm this.

To exercise any of these rights, email support@zalortrade.com with the subject line "Colorado Privacy Request." We will respond within 45 days as required by the CPA (extendable by 45 additional days with notice).

If you believe we have not honored your rights under the Colorado Privacy Act, you may lodge a complaint with the Colorado Attorney General's Office.

11. Your Rights — California (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) grant you additional rights:

• Right to Know: The categories and specific pieces of personal information we collect, the sources, the business purposes, and the categories of third parties with whom we share it (see Sections 2, 3, and 5 above).
• Right to Delete: Request deletion of your personal information, subject to exceptions.
• Right to Correct: Request correction of inaccurate personal information.
• Right to Opt Out of Sale or Sharing: We do not sell or share personal information for cross-context behavioral advertising. No opt-out is necessary, but you may confirm this at any time by contacting us.
• Right to Limit Use of Sensitive Personal Information: We do not use sensitive personal information (as defined by CPRA) beyond what is necessary to provide the Service.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA/CPRA rights.

California residents may submit requests via email to support@zalortrade.com. We will respond within 45 days.

12. Your Rights — GDPR (EEA and UK Users)

If you are located in the European Economic Area or United Kingdom, you have the following rights under the General Data Protection Regulation (GDPR) or UK GDPR:

• Right of access (Art. 15): Request a copy of your personal data and information about how we process it.
• Right to rectification (Art. 16): Request correction of inaccurate data.
• Right to erasure / right to be forgotten (Art. 17): Request deletion of your data where there is no overriding legal basis for retention.
• Right to restriction of processing (Art. 18): Request that we limit how we use your data in certain circumstances.
• Right to data portability (Art. 20): Receive your data in a structured, machine-readable format.
• Right to object (Art. 21): Object to processing based on legitimate interests.
• Right to withdraw consent: Where processing is based on consent (e.g., optional email notifications), you may withdraw at any time in your notification settings without affecting the lawfulness of prior processing.
• Right to lodge a complaint: You may lodge a complaint with your local supervisory authority (e.g., the UK Information Commissioner's Office for UK users).

International Data Transfers

If you are in the EEA or UK, your data is transferred to and processed in the United States. We rely on the following transfer mechanisms where required: Standard Contractual Clauses (SCCs) adopted by the European Commission for transfers to Supabase, Stripe, and Resend. By using the Service, you acknowledge this transfer. If you have questions about data transfer mechanisms, contact us at support@zalortrade.com.

13. Children's Privacy

The Service is not directed at children under 18 years of age. We do not knowingly collect personal information from persons under 18. If you are under 18, do not use the Service. If we learn that we have collected personal information from a person under 18, we will delete it promptly. If you believe we have inadvertently collected data from a minor, contact us at support@zalortrade.com.

The Children's Online Privacy Protection Act (COPPA) applies to websites directed at children under 13. The Service is not directed at that age group.

14. Do Not Track

We do not currently respond to "Do Not Track" signals from browsers because we do not engage in cross-site tracking. We do not track users across third-party websites.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. For material changes, we will provide at least 30 days' advance notice by email to your registered address. The "Last updated" date at the top of this page reflects when the policy was last revised. Your continued use of the Service after the effective date of an updated policy constitutes your acceptance of the changes.

16. Contact and Data Protection Inquiries

For any privacy questions, access requests, or data deletion requests:

• Email: support@zalortrade.com
• Company: ZalorTrade LLC, a Colorado limited liability company (United States)

We will acknowledge your request within 5 business days and respond substantively within the timeframes required by applicable law.