Privacy Policy

Privacy Policy

This Privacy Policy explains how TotalTrade processes personal data when you visit totaltrade.ai, use app.totaltrade.ai, create an account, purchase a plan, contact support or use connected features.

The data controller is Daniel Totò, Località Comune 109, 52046 Lucignano (AR), Italy, VAT No. 02453620516, Italian Tax Code TTODNL00D20F592R. For privacy requests: support@totaltrade.ai; certified email blastrade@pec.it.

1. Scope and key principles

We process personal data lawfully, fairly and transparently, limit collection to what is relevant for stated purposes, apply proportionate security measures and retain data only for as long as necessary or legally required. This Policy applies to the website, application, support channels and related TotalTrade services.

2. Categories of personal data

• Identity and contact data, such as name, email address, account identifier, profile details and authentication information.
• Technical and usage data, including IP address, device, browser, operating system, session and security logs, visited pages, interactions and consent choices.
• Support and live-chat data, including messages, attachments, timestamps, delivery or read status and information required to resolve a request.
• Learning data, such as viewed educational content, progress, saved items and profile-related learning information.
• Journal and Backtester data, including strategies, notes, configurations, simulations, results, statistics and user-provided files.
• MT5, cTrader and CSV data, which may include trades, account and broker identifiers, server, balance, equity, open, closed or pending positions, symbols, comments, magic number, sessions and derived statistics.
• Payment and subscription data, such as plan, status, transaction references, billing country and limited payment information supplied by the payment provider. TotalTrade does not normally receive complete card details.
• Affiliate Programme data, including application and profile details, codes or coupons, attributed referrals, commissions and payout details.
• Feedback Hub submissions, votes and technical identifiers used to moderate requests and limit duplicate votes.

3. Sources of data

We receive data directly from you, from your use of the Service, from accounts or files you choose to connect or import, and from service providers acting on our behalf. If you provide data concerning another person, you must have a lawful basis and authority to do so.

4. Purposes and legal bases

• Provide the Service, create and secure accounts, authenticate users, manage profiles, subscriptions and payments, and perform the contract or pre-contractual measures you request.
• Operate educational content, Journal, Backtester, imports, analytics and integrations requested by the user, on the basis of contract performance.
• Respond to support and live-chat requests, prevent abuse, investigate incidents and protect the platform and users, based on contract performance and legitimate interests in service quality and security.
• Comply with accounting, tax, consumer, regulatory and legal obligations and establish, exercise or defend legal claims.
• Measure service performance, create aggregated internal statistics and improve usability, based on legitimate interests where permitted or on consent when tracking technologies require it.
• Send newsletters or promotional communications only where consent or another lawful basis applies. You can unsubscribe at any time.
• Manage Affiliate Programme applications, attribution, commissions and payouts, and operate the Feedback Hub.

5. Authentication and connected accounts

Authentication may be provided by Clerk and, if selected, Google OAuth through Clerk. Data may include name, email, profile image, provider identifiers, authentication events, session tokens, IP address, device and browser information. Authentication is necessary to create and protect the account. Your use of an external sign-in provider is also subject to that provider’s privacy terms.

6. Service providers and recipients

We share personal data only where necessary with processors, independent controllers or partners that support the requested service, under appropriate contractual and security arrangements.

• Clerk for identity, authentication and session management, and Google when you choose Google OAuth.
• Cloudflare, Vercel and other hosting, infrastructure, storage, content-delivery, monitoring and security providers used by the Service.
• Stripe or another disclosed payment provider for checkout, subscriptions, fraud prevention, refunds and financial compliance.
• Hostinger for newsletter delivery and related technical logs, insofar as it processes data on the Controller's instructions.
• Referly for the Affiliate Programme portal, codes or coupons and attribution connected to Stripe; PayPal may process affiliate payouts.
• Providers supporting educational content, support, email, analytics, connected trading accounts, imports and market or reference data.
• Google Analytics 4 only after Analytics consent, Google Ads only after Marketing consent, and external-content providers such as YouTube when the relevant content is activated.
• Authorities, advisers or counterparties where disclosure is legally required or necessary to protect rights, security and legitimate interests.

7. International transfers

Some providers may process data outside the European Economic Area. Where required, transfers rely on an adequacy decision, the EU–US Data Privacy Framework for eligible certified recipients, Standard Contractual Clauses supplemented where appropriate, or another safeguard or lawful derogation under Chapter V of the GDPR.

8. Retention periods

• Newsletter data: until consent is withdrawn or you unsubscribe, with limited evidence of consent or withdrawal retained where needed for compliance.
• Live-chat messages, attachments and the local device copy: normally no more than 60 days from the last update, unless longer retention is necessary for a dispute, security incident or legal obligation.
• Learning data: for the life of the account or until deletion or inactivity rules apply.
• MT5 and cTrader data: until you remove the relevant session or request deletion, subject to technical backups and legal needs.
• CSV, Journal and Backtester data: while needed to provide the requested function or until you delete it or the account.
• Payment, invoice and accounting data: for the period required by tax, accounting and anti-fraud law.
• Account data: until account deletion, followed by limited retention where required for legal obligations, security or claims.
• Security logs: for a proportionate period based on incident-prevention and investigation needs.
• Analytics and consent records: according to the Cookie Policy, tool configuration and applicable law.

9. Security

We use technical and organisational measures designed to protect personal data against unauthorised access, alteration, disclosure, loss and destruction. No online system is completely risk-free. You must keep credentials confidential, use secure devices and notify us promptly of suspected compromise.

10. Your rights

Subject to the conditions of the GDPR and applicable law, you may request access, rectification, erasure, restriction, portability and objection; withdraw consent at any time without affecting prior lawful processing; and object to direct marketing at any time. You also have the right to lodge a complaint with the Italian Data Protection Authority or the competent authority in your country.

• Send requests to support@totaltrade.ai and provide enough information to identify the account and request.
• We may request reasonable proof of identity and may refuse or charge for manifestly unfounded or excessive requests where the law permits.
• We will respond within the legally applicable period and explain any justified extension or refusal.

11. Automated decision-making

TotalTrade does not ordinarily make decisions based solely on automated processing that produce legal or similarly significant effects. Analytics, scores and classifications support the user and do not replace independent decision-making. If this changes, the required information and safeguards will be provided.

12. Cookies and similar technologies

The website and app use cookies and similar technologies as described in the Cookie Policy. Non-essential analytics and marketing tools are activated only after the applicable consent. You may change your choices through the cookie settings available in the footer.

13. Children

The Service is reserved for people aged 18 or over. If you believe a minor has provided personal data, contact us so that we can assess and remove it where appropriate.

14. Changes and contact

We may update this Policy to reflect changes in law, technology or processing activities. The latest revision date appears above, and material changes will be communicated through reasonable channels. For questions or to exercise your rights, contact support@totaltrade.ai.