Privacy Policy

1. Who we are

the operator of WhoIsTrading operates WhoIsTrading and is the controller of the personal data described here. Contact: support@whoistrading.com.

2. Data we collect

• Account data: name, email address and identifier from your sign-in provider (Google, via our identity service Auth0); account approval details, including any reason for joining you give us.
• Credentials: API keys and tokens you save for brokers, data providers, AI providers and alert channels, stored encrypted (AES-256-GCM); your trade PIN, stored only as a one-way hash; your administrator authenticator secret, if applicable, stored encrypted.
• Trading and usage data: watchlists, bots, strategy settings, risk limits, alerts, notes, backtests, research reports, and account, position and order information retrieved from your broker to operate the features you use.
• Technical data: IP address, browser type, session identifiers, security and audit events (such as sign-ins, PIN checks and setting changes) and server logs.

3. How we use it and why

• To provide the Service you asked for — sign-in, connecting your accounts, running research and automation you configure, sending alerts you set up (contract).
• To keep the Service and your account secure, prevent fraud and abuse, and keep audit records (legitimate interests; legal obligations).
• To support you and to fix and improve the Service (legitimate interests).
• To comply with law and respond to lawful requests (legal obligation).

We do not sell your personal data, do not share it for cross-context behavioural advertising, and do not use advertising trackers.

4. Who we share it with

• Service providers acting on our instructions: our hosting provider (servers and encrypted backups), Auth0 (identity and sign-in) and Google (when you sign in with Google).
• Providers you connect: your broker, any crypto-asset exchange you connect, and any data, AI or alert provider (such as Alpaca, Polygon, OpenAI, Anthropic, xAI, Telegram, Discord or Slack). We send them requests on your behalf with your credentials; their own privacy policies apply to what they receive.
• Authorities and others where required by law, to protect rights and safety, or in connection with a merger, acquisition or sale of the Service, subject to this Policy.

5. Cookies and local storage

We use one essential session cookie to keep you signed in and protect against misuse, and your browser's local storage for interface preferences such as theme and layout. We do not use analytics or advertising cookies, so no cookie consent is needed for the cookies we use.

6. International transfers

Our providers may process data in countries other than yours, including the United States. Where required, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses or equivalent mechanisms.

7. How long we keep it

We keep account data while your account is open. When you delete your account, we promptly delete your credentials, sign-in identities, watchlists, bots, notes, alerts and similar content, and anonymise your profile. We keep a minimal, pseudonymised set of order, execution and security records for as long as needed to meet legal obligations and to establish or defend legal claims, and then delete them. Encrypted backups are overwritten on a rolling schedule.

8. Your rights

Depending on where you live (for example under the GDPR, UK GDPR or California law), you may have the right to access, correct, delete, restrict or object to the processing of your personal data, to data portability, and to withdraw consent where processing is based on consent. You can download a copy of your data and delete your account yourself in Account settings, or contact us. We will not discriminate against you for exercising your rights. You may also complain to your data protection authority.

9. Security

We use encryption in transit and at rest for credentials, one-way hashing for PINs, multi-factor authentication for administrators, access controls, rate limiting, audit logs and isolated processes per customer. No system is completely secure; please protect your sign-in and tell us about any suspected issue.

10. Children

The Service is not intended for anyone under 18, and we do not knowingly collect their data.

11. Changes

We will post updates here with a new version date and, for material changes, ask you to review them in the Service.