Usage Analytics
We use anonymous usage statistics (Umami) to improve our product. No cookies, no personal data. You can change this anytime in Settings.
The following information provides a simple overview of what happens to your personal data when you use the TradingControl platform. Personal data is any data with which you can be personally identified. For detailed information on data protection, please refer to the full privacy policy below.
Who is responsible for data collection?
Data processing on this platform is carried out by the platform operator. You can find their contact details in the "Data Controller" section of this privacy policy.
How do we collect your data?
Some of your data is collected when you provide it to us, e.g. by entering it in a registration form, recording trades, or uploading chart screenshots. Other data is collected automatically or with your consent when you visit the platform by our IT systems. This is primarily technical data (e.g. internet browser, operating system, or time of page access).
What do we use your data for?
Some of the data is collected to ensure error-free provision of the platform. Other data may be used to analyse your user behaviour — but only with your explicit consent (opt-in).
What rights do you have regarding your data?
You have the right at any time to receive information free of charge about the origin, recipient, and purpose of your stored personal data. You also have the right to request the correction or deletion of this data. If you have given consent to data processing, you can revoke this consent at any time for the future. You also have the right, under certain circumstances, to request the restriction of the processing of your personal data. Furthermore, you have the right to lodge a complaint with the competent supervisory authority.
TradingControl UG (haftungsbeschränkt)
Fährstrasse 217
40221 Düsseldorf
Germany
Represented by the managing director: Thorsten Polte
Email: datenschutz@tradingcontrol.de
The data controller is the natural or legal person who alone or jointly with others determines the purposes and means of the processing of personal data.
We process your personal data on the following legal bases:
We process the following categories of personal data:
| Category | Data | Legal Basis |
|---|---|---|
| Master Data | Name, email address, password (bcrypt-hashed) | Performance of contract |
| Profile Data | Avatar, display name, language, timezone | Performance of contract |
| Financial Data | Trade data, portfolio holdings, exchange API keys (AES-256-GCM encrypted), cold wallet addresses | Performance of contract |
| Usage Data | Login timestamps, audit logs, page views (pseudonymised) | Legitimate interest / Consent |
| Technical Data | IP address, browser type, operating system, referrer URL | Legitimate interest |
| Payment Data | Invoices, subscription status, payment history (payment processing by Stripe/BTCPay) | Performance of contract |
| Communication Data | Mentoring chat messages, video call metadata (duration, status — no content) | Performance of contract |
| Security Data | 2FA secret (encrypted), session tokens, password reset tokens | Performance of contract / Legitimate interest |
We store your personal data only as long as necessary for the respective processing purposes or as required by statutory retention periods:
| Data Type | Retention | Basis |
|---|---|---|
| Account data | Until account deletion | Performance of contract |
| System logs | 90 days | Legitimate interest |
| Position change log | 180 days | Legitimate interest |
| Audit logs | 365 days (active), then archived | Legal obligation |
| Invoices / accounting records | 10 years | German HGB § 257 / AO § 147 |
| Notifications | Until expiration date | Performance of contract |
| Redis tokens (JWT, 2FA, reset) | Token lifetime (5 min – 24 hrs) | Performance of contract |
After the retention periods expire, data is automatically deleted or anonymised. Upon account deletion, all personal data is immediately deleted or anonymised (email → deleted_uuid@deleted.local, name → "Deleted User").
We use the following service providers as data processors (Art. 28 GDPR):
| Provider | Purpose | Location | Safeguard |
|---|---|---|---|
| Stripe, Inc. | Payment processing (credit card, SEPA) | USA | EU-US Data Privacy Framework |
| BTCPay Server | Cryptocurrency payments | Self-hosted (EU) | Own infrastructure |
| SMTP Provider | Transactional emails (verification, password reset, reports) | EU | DPA / GDPR-compliant |
| Telegram Bot API | Optional notifications | International | User opt-in |
| Google STUN Server | NAT traversal for WebRTC video calls (no media data) | USA | Connection setup only, no content data |
When using Stripe and Google STUN servers, data may be transferred to the USA. Stripe is certified under the EU-US Data Privacy Framework. Google STUN servers only transmit technical connection data (IP addresses) for connection establishment — no audio/video content or personal data.
Video calls use our own WebRTC implementation (peer-to-peer). Audio and video streams flow directly between the participants, without being routed through our servers.
You have the following rights under the GDPR:
You can request a complete export of your personal data at any time. Use the export function in your account settings or send an email to the data controller. The export includes: profile data, trades, holdings, snapshots, notifications, API key metadata, and subscription data.
You can correct inaccurate personal data at any time through your profile settings or by contacting us via email.
You can delete your account completely at any time. The deletion covers all 17 related data tables. Email and name are anonymised, all sessions are immediately invalidated. Use the "Delete Account" function in your account settings.
Under certain conditions, you can request the restriction of the processing of your personal data. Please contact the data controller for this purpose.
You have the right to receive your data in a structured, commonly used, and machine-readable format. The export is available in JSON format.
You can object at any time to the processing of your personal data based on legitimate interest. For analytics tracking, you can revoke your consent at any time in your account settings.
You can withdraw any consent given at any time. This particularly applies to analytics consent (toggle in settings) and mentoring data sharing (individually revocable). The withdrawal applies for the future.
You have the right to lodge a complaint with a data protection supervisory authority about our processing of personal data. The supervisory authority responsible for us is:
Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen
Postfach 20 04 44
40102 Düsseldorf, Germany
Phone: +49 211 38424-0
Email: poststelle@ldi.nrw.de
Website: www.ldi.nrw.de
No automated decision-making including profiling pursuant to Art. 22 GDPR takes place. The platform's risk management system generates analyses and warnings based on your defined rules but does not make independent decisions. No automated trades are executed.
We do not use cookies in the traditional sense. Instead, we use the following browser-side storage technologies (localStorage):
tc-auth — Authentication token (JWT) for your sessiontc-analytics-optout — Your analytics preferencesi18nextLng — Language settingThese storage entries are technically necessary and fall under § 25(2)(2) TTDSG (German Telecommunications-Digital Services Data Protection Act — strictly necessary). No consent is required for these.
We use Umami (self-hosted) for pseudonymised usage analysis. Umami sets no cookies and stores no personal data. User IDs are hashed with SHA-256 (with a project pepper). Tracking is performed only after your explicit consent (opt-in). You can revoke your consent at any time in your account settings. The Do-Not-Track setting is respected.
We implement comprehensive technical and organisational measures to protect your data:
We reserve the right to update this privacy policy to ensure it always complies with current legal requirements or to reflect changes in our services. Any future visits will be subject to the updated privacy policy. We recommend that you read this privacy policy regularly to stay informed about the protection of the personal data we collect.
The German version of this privacy policy (Datenschutzerklärung) is the legally binding version. This English translation is provided for convenience only.
This privacy policy has been prepared with the utmost care. For a legally binding review, we recommend consulting a specialised data protection lawyer.
Last updated: 14 March 2026