Privacy Policy

As of November 2026

1. Data Controller

TRADIC Technologies UG (haftungsbeschränkt)
Vincent Geith
Tharandter Straße 108a, 01187 Dresden
Email: info@tradicapp.com

Contact for data protection inquiries:
Vincent Geith
Email: info@tradicapp.com

2. General Information on Data Processing

We process personal data exclusively in accordance with legal requirements, in particular the General Data Protection Regulation (GDPR) and the Federal Data Protection Act (BDSG). “Personal data” refers to any information relating to an identified or identifiable natural person—e.g., name, email address, or IP address.

3. Data Processing When Visiting the Website

When you visit our website, we automatically collect technical usage data (including IP address, browser information, and time of access) to ensure the website’s operation and security. The legal basis for this is our legitimate interest (Art. 6(1)(f) of the GDPR).

4. User Account and Registration

To enable you to use our services, we process your name, your email address, the alias you have chosen, and the data required for registration and account security. Passwords are stored as non-reversible hash values. The purposes of this processing are to maintain your user account, fulfill the contract, and provide you with your dashboard. The legal basis is Article 6(1)(b) of the GDPR. We process the necessary security and anti-abuse data based on our legitimate interest pursuant to Article 6(1)(f) of the GDPR.

Optional information in the profile: You have the option to voluntarily provide additional information in your account area:

  • Phone number: We use this information exclusively for security purposes to verify your identity during critical processes (e.g., if you want to change your email address or name). This helps protect your account from unauthorized access. The legal basis for this is our legitimate interest in the security of user accounts (Art. 6(1)(f) of the GDPR).
  • Nationality: If you voluntarily provide your nationality, we will use it for internal statistical analysis to improve our services based on your consent (Art. 6(1)(a) GDPR). Providing this information is not required to use the bot. You can remove it from your profile and withdraw your consent for the future.

We use your email address to send you necessary contractual, account, security, and billing messages in accordance with Article 6(1)(b) of the GDPR. The sending of informational emails containing advertisements, product information, tips, and feedback requests is enabled by default for new accounts. You can disable this at any time via the unsubscribe link or in your account settings. This default setting does not constitute explicit consent. For legally permissible marketing to existing customers, Article 6(1)(f) of the GDPR may apply; the additional requirements of Section 7(3) of the German Unfair Competition Act (UWG) must be met. If you expressly consent to receiving these communications, Article 6(1)(a) of the GDPR serves as the legal basis. You may revoke your consent at any time; you may object to processing for direct marketing purposes at any time. Necessary contractual and security-related messages remain unaffected by this.

Waiting List for the Launch of TRADIC

If you add yourself to our waiting list, we will process your email address and language to notify you once of the launch of TRADIC after your email address has been confirmed. No user account will be created. The legal basis is your consent pursuant to Art. 6(1)(a) of the GDPR. To confirm your subscription, we’ll send you a link that’s valid for 24 hours. As proof of your consent, we’ll store the confirmed text, the time, your IP address, and browser information. You can revoke your consent at any time by clicking the unsubscribe link in the confirmation email or by contacting support. After that, your email address will no longer be used for the launch notification. We retain records of your consent only to the extent necessary to substantiate and defend against legal claims.

4.1 Signing Up Through Third-Party Providers (Social Login)

We offer you the opportunity to learn more about the service Google Sign-In (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland).

  • Data Processed: When you use this service, Google provides us with your email address, your name, and your profile picture (if it's public).
  • Purpose: Identification and creation of your user account without requiring you to set a separate password with us.
  • Legal basis: Performance of a contract or the implementation of precontractual measures (Art. 6(1)(b) of the GDPR).

We do not store any passwords for your Google Account. You can unlink your account at any time in your Google Account under Security settings.

In addition, we offer Microsoft Login (Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Irland).

  • Data Processed: When you use this service, we receive your email address and name from Microsoft (and possibly additional profile information, depending on what you've shared).
  • Purpose: Identification and creation of your user account without a separate password.
  • Legal basis: Performance of a contract or the implementation of precontractual measures (Art. 6(1)(b) of the GDPR).

We do not store any third-party passwords here either. You can unlink your account in your Microsoft account.

For more information on data processing by Google and Microsoft, please refer to the privacy policies of the respective providers. Data processing in third countries, particularly in the United States, cannot be ruled out.

4.2 Support Requests and AI-Generated Draft Responses

In the case of a public termination, we process the information you provide, the time of receipt, and the necessary security data to assign, process, and confirm your declaration. The legal basis for this is Article 6(1)(b) and (c) of the GDPR, as well as Article 6(1)(f) of the GDPR for protection against misuse. If automatic assignment is not possible, we send a standard follow-up inquiry without including the names or contract details you entered. For this, we use the stored email address if account assignment is possible; otherwise, we use the address you entered. Cases where assignment is uncertain are reviewed as support cases. Entries that cannot be assigned at all are stored for proof of receipt without being processed as a support case and are automatically deleted after 90 days. Pending assignment checks are retained until resolved. Failure to respond does not automatically result in the deletion of proof of receipt in cases where a termination may be valid.

When you contact our support team, we process your contact information, the content of your inquiry, the message history, and the account, bot, broker, and billing data necessary to resolve the issue. The purpose is to handle your inquiry and fulfill our contractual support obligations. The legal basis is Article 6(1)(b) of the GDPR; for quality assurance, protection against misuse, and efficient processing, we also rely on our legitimate interest pursuant to Article 6(1)(f) of the GDPR.

To assist our support team, we use the OpenAI API to generate a draft response internally. The draft is not sent automatically; instead, it is reviewed by an administrator before being sent and may be modified or rejected. No decisions with legal or similarly significant consequences are made solely by automated means.

Only the information necessary for the specific support case is transmitted to OpenAI. Stored passwords, two-factor authentication secrets, and encrypted broker API keys and secrets are not transmitted; identifiable login credentials and email addresses in the transmitted context are also technically removed. The API request is executed without OpenAI permanently storing the response (“store=false”).

OpenAI is engaged as a data processor for this processing. According to OpenAI, API content is not used to train the models without explicit authorization; by default, content may be processed in abuse detection logs for up to 30 days. Processing by OpenAI and its subprocessors outside the European Economic Area cannot be ruled out. Transfers to third countries take place only on the basis of the legal requirements set forth in Articles 44 et seq. of the GDPR and the contractually agreed transfer mechanisms.

4.3 TRADIC Bot Setup Wizard

When you submit a free-text question in the TRADIC Assistant, we send your question—and, if necessary, the previous question along with the Assistant’s most recent response, the most recently discussed help topic, and relevant form values—to OpenAI. OpenAI helps formulate and verify the response based on TRADIC’s product information. Account details, broker login credentials, account balances, and orders are not retrieved from your account for this purpose. Please do not enter any personal information or login credentials in the chat. You can open predefined help questions without sending them to OpenAI.

The processing is necessary to provide the product assistance you requested, in accordance with Article 6(1)(b) of the GDPR. To protect against very rapid and simultaneous free-text questions, we process your account ID and technical query identifiers for a maximum of 60 seconds. This serves to prevent abuse and ensure the availability of the feature in accordance with Article 6(1)(f) of the GDPR. TRADIC does not store the chat history on its server. We log the selected topic, the catalog version, and technical usage figures without the query text or account ID. Monthly usage totals per model are stored for up to 90 days after the last update.

OpenAI processes the submitted content as a data processor. API requests are made with response caching disabled. By default, content may be processed for up to 30 days for abuse detection and will not be used for model training without explicit authorization. For transfers outside the European Economic Area, the legal requirements and the contractual mechanisms described in Section 4.2 apply.

5. Local Broker Connection and Supplementary Web Services

Your bots run on your trading device. The local software connects to your broker account via the API. It generates orders based on the trading rules you’ve confirmed and sends them directly from your device to your broker. The broker executes the orders according to its terms and conditions. Your assets remain in your brokerage account. The broker’s privacy policy applies to the processing of your data by the broker.

Data Processed: For the broker connection you have set up, we process the API key, secret, and any API passphrase that may be required. For the agreed-upon functions, we also process the broker name and account balances, open orders, position and transaction data, your confirmed bot rules, device ID and connection status, bot status, trading and results data, as well as fee and confirmation records. API credentials are stored in encrypted form and are used only to the extent necessary by authorized technical services for the established connection. Withdrawal and non-essential transfer authorizations must not be activated.

Purpose of processing: This processing is used to authenticate, verify, and establish your broker connection; to operate your bots according to your confirmed rules; and to display your broker and bot data. Our web services process device, bot, and order data to verify the assignment of the trading device and authorization for bot operation. This data also helps us track operations and identify and resolve technical issues. Other purposes include account management, displaying synchronized activities, software fees, contract and confirmation documentation, as well as support and security.

Important Safety Notice: The API credentials enable the queries and trading actions you have authorized. Enable only the necessary permissions and do not grant withdrawal or unnecessary transfer permissions. Even without withdrawal permissions, trading can affect your assets and result in losses. Never share keys or secrets with our support team or external AI services. If you suspect a security breach, revoke the access credentials with your broker.

Legal basis: The processing required for the agreed-upon software and web services is carried out in accordance with Article 6(1)(b) of the GDPR. We comply with statutory billing and retention requirements in accordance with Article 6(1)(c) of the GDPR. Article 6(1)(f) of the GDPR applies to necessary security and protection against misuse, as well as to the verification and defense against claims; our legitimate interest lies in the protection of accounts and services and in ensuring transparent billing.

5.1 Recipients and Technical Service Providers

We use IONOS for hosting, server operations, and email services. We engage other infrastructure and IT service providers only to the extent necessary. To the extent that these providers process personal data on our behalf, they do so based on a contract pursuant to Article 28 of the GDPR. Internally, only those responsible for operations, support, security, and billing are granted the necessary access. Brokers, payment providers, and the login services you select process data in accordance with their respective roles; you can find more information about these services in the relevant sections.

The hosting and infrastructure service providers used for storage and operation may process the data necessary for their tasks—including encrypted API access credentials—on our behalf. Personal data is disclosed only to the extent necessary and on a legal basis. For transfers outside the European Economic Area, the requirements of Articles 44 et seq. of the GDPR must also be met, in particular a relevant adequacy decision or appropriate safeguards. Encryption alone does not satisfy these requirements.

6. Cookies

Our website uses technically necessary cookies, stores your cookie preferences in your browser's local storage, and also logs your preferences on the server side so that we can verify your consent.

  • Technically necessary cookies and data storage: These are necessary for the functions you have requested, in particular login, security, and the storage of your consent settings. Access to your device is granted, provided no consent is required for this, in accordance with Section 25(2) of the TDDDG. Depending on the purpose, the subsequent processing of personal data is governed by Article 6(1)(b) or (f) of the GDPR.
  • Analytics Cookies: We use analytics cookies and similar storage technologies only with your express consent in accordance with Section 25(1) of the TDDDG. This includes Google Analytics. The legal basis for the subsequent processing of personal data is Article 6(1)(a) of the GDPR.

We also collect technical performance metrics such as Web Vitals only if you have accepted analytics cookies.

You can withdraw your consent at any time here via the Change cookie settings and revoke your consent via the cookie banner for the future.

6.1 External Content (CDN)

We use external content delivery networks (CDNs) and data providers (e.g., cdn.jsdelivr.net, CoinCap, and CoinGecko) to deliver technical content and media, particularly JavaScript libraries and crypto logo files. In doing so, your IP address may be transmitted to the respective providers. Additionally, we may retrieve crypto symbols from CoinGecko on the server side to display the appropriate logo files in the dashboard. The legal basis for this is our legitimate interest in providing a stable, high-performing, and user-friendly platform (Art. 6(1)(f) GDPR).

6.2 Google Analytics 4 (GA4) and Conversion Tracking

If you have given your consent in the cookie banner, we use Google Analytics 4 (“GA4”), a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland.

GA4 helps us understand how our website is used and whether key events (conversions) occur, such as registration and successful verification of user accounts. In particular, usage data such as pages viewed, interactions, device/browser information, truncated IP addresses, referrers, and timestamps are processed.

Data processing is based solely on your consent in accordance with Article 6(1)(a) of the GDPR. You may withdraw your consent at any time with future effect by accessing the cookie settings and disabling analytics.

The recipient of the data is Google. A transfer of personal data to the United States cannot be ruled out. Google LLC is certified under the EU-U.S. Data Privacy Framework (DPF). To the extent that data is transferred to the United States, such transfer is based on the EU Commission’s adequacy decision pursuant to Article 45 of the GDPR (DPF).

You can also disable data collection by Google Analytics using a browser add-on: https://tools.google.com/dlpage/gaoptout?hl=de

6.3 Sales Notifications (Web Push)

If you explicitly enable sales notifications, we will store the push address generated by your browser, the associated public device keys, browser information, and the date, time, and version of your consent. After a sale is successfully completed, we process the sale result and your specified display currency to generate the notification. The legal basis is your consent pursuant to Article 6(1)(a) of the GDPR.

For technical delivery, your browser uses the push service provided by its vendor, specifically Apple, Google, Mozilla, or Microsoft. In doing so, these vendors receive the push address required for delivery, technical connection data, and the encrypted message. Processing outside the European Economic Area cannot be ruled out.

You can disable sales notifications at any time in your user account. When you do so, we will delete your saved device registrations; you can also revoke permission in your browser or system settings. When you delete your user account, the device registrations and associated shipping data will be deleted. Please note that the amount and message may be visible on the lock screen, depending on your device settings.

7. Friends and Sharing

You can share TRADIC and connect with other users through friend requests. We store the user accounts involved and the status of the request.

8. Invoices and Payment Processing

To set up a payment method, make manual invoice payments, and set up automatic debits after explicit payment authorization, we use Stripe Payments Europe, Ltd. (1 Grand Canal Street Lower, Dublin 2, Ireland). Payment data is processed directly by Stripe. TRADIC does not store any complete card or bank details. The legal basis is Article 6(1)(b) of the GDPR.

We store Stripe references for the customer, checkout, SetupIntent, PaymentIntent, payment method, billing status, amounts, billing address, as well as technical error and dunning statuses. When auto-debit is enabled, we also store the activation and deactivation times, as well as the corresponding proof of consent.

To verify eligibility for offers and determine the applicable sales tax, we check the provided residential address and the country of origin of the payment method as reported by Stripe. If the information provided is insufficient or contradictory, we will ask for clarification. We document the source, date, and result of the verification, as well as any additional supporting documentation, if applicable. Data processing is carried out for the purposes of entering into and fulfilling a contract, as well as to comply with statutory record-keeping obligations pursuant to Article 6(1)(b) and (c) of the GDPR. For OSS transactions, we retain the required records for ten years from the end of the fiscal year.

If the country information is unclear, we can map the IP address from the payment provider or your confirmation using a local country file. We do not transmit your IP address to a geolocation service in this process. A different or unassignable IP address alone does not result in a definitive rejection. You can confirm or correct your residential address using a secure form. We store the information, the confirmation text, the time, the IP address, the browser identifier, and the associated verification sources. If the assignment remains unresolved, a support ticket is created for individual review. A tax ID and document upload are not required for this form.

Your home address is required for billing and paid use. Without a confirmed country assignment, we cannot authorize this use. The tax record-keeping requirements are based in particular on Section 22 of the German Value-Added Tax Act (UStG) and Article 63c of Implementing Regulation (EU) No. 282/2011. You can correct your information and request an individual review of the country assignment through our support team.

If you cancel your account without deleting it, your account, invoices, and the stored Stripe payment reference will remain intact. We log the statement, contract reference, time of receipt, and confirmation of contract processing. Automatic billing will be deactivated after any outstanding balances have been settled. Reactivation with renewed automatic billing will only occur after you have provided your express consent again; we will retain the relevant documentation for this purpose.

We log confirmations regarding the immediate start of the bot, payment authorization, postpaid billing, and automatic debit, including the text version, timestamp, IP address, user agent, and the corresponding transaction reference, to the extent necessary for the fulfillment of the contract and compliance with legal documentation requirements.

9. Duration of Storage

We store your data only as long as is necessary to provide our services or to comply with legal retention requirements.

  • User account: Once your account has been deleted, your TRADIC user agreement will also be terminated. We will delete your profile data, provided that there are no legal retention requirements or pending claims that would prevent us from doing so.
  • Support Requests: We generally delete completed support requests after 90 days. If a request is necessary to comply with legal obligations or to assert, exercise, or defend legal claims, we retain it for the applicable retention period.
  • API credentials: We store API credentials until the connection is removed from TRADIC or until your user account is completely deleted. A connection stored with TRADIC can be removed if no bots are assigned to it or if only bots that have already been deleted are assigned to it. Regardless of this, you can block or delete the API key directly with the broker at any time and restrict its permissions, provided the broker offers this option. Once the broker has fully implemented a revocation, access via that key ends. Removing a connection from TRADIC does not automatically revoke the key with the broker.
  • Bot & Transaction Data: We store bot and transaction data to the extent that it is necessary for the agreed-upon functions, verifiable software fees, or specific legal claims. There is no blanket ten-year retention requirement for purely technical bot logs. Once the respective purpose no longer applies, we delete or anonymize data that is no longer required. We retain billing documents and the supporting evidence required for their verification in accordance with their legal classification; this applies even after the contract ends. You can delete locally stored data from your device; you must also revoke keys with the broker if their authorization is to end.
  • Sales Announcements: We delete device registrations when you deactivate your account or when you delete your user account. Completed technical shipping data is regularly deleted after 30 days; records of consent are retained to the extent necessary.
  • Tax-related documents: We generally retain invoices and their structured e-invoice data for eight years. If related accounting, commercial, or supporting data are subject to a longer statutory retention period or are required for legal proceedings, those longer retention periods apply.

10. Your Rights as a Data Subject

You have the right at any time to:

  • Information about the data we have stored about you (Art. 15 of the GDPR).
  • Correction incorrect data (Art. 16 of the GDPR).
  • Deletion your data (“right to be forgotten”), provided that there are no retention requirements to the contrary (Art. 17 of the GDPR).
  • Restriction of Processing your data (Art. 18 of the GDPR).
  • Data Portability (Art. 20 GDPR).
  • Objection to object to the processing of your data based on a legitimate interest (Art. 21 of the GDPR).
  • Withdrawal of Your Consent (e.g., for cookies) going forward (Art. 7(3) of the GDPR).

To exercise your rights, simply send us an email at the address listed above. You also have the right to file a complaint with a data protection supervisory authority.

11. External ChatGPT Links

Our platform includes links to OpenAI's ChatGPT in certain places to help you set up your account. When you click on one of these links, you'll leave our website.

Simply by opening the app, TRADIC does not transmit any personal data or API keys to OpenAI. You decide for yourself what information you subsequently enter into ChatGPT; OpenAI’s privacy policy applies to this. The separate use of the OpenAI API for internal support drafts is described in Section 4.2: