1. Controller
The controller of your personal data is StarTrading Ltd, Republic of Cyprus, at the registered office stated in the imprint. Privacy questions: [email protected]. No data protection officer is required for our activity; the company answers privacy requests itself at that address.
2. Data we collect
| Data | When | Examples |
|---|---|---|
| Account data | Sign-up, login | Email address, name, country, language, login method (magic link or Google), session identifiers |
| Order data | Purchase | Product, price, currency, tax country, promo code, payment provider reference, order status, acceptance timestamps of the terms and the risk disclosure |
| Trading data | Evaluation and funded accounts | Orders, fills, positions, balance, rule breaches, payout requests, platform login |
| Verification data | Before the first funded account or payout | Result and date of the identity check; the documents themselves stay with the provider |
| Payout data | Payout request | Payment method details, encrypted at rest |
| Technical data | Every visit | IP address, user agent, request logs, security events |
| Support data | When you write to us | Your messages and the data you include |
We do not collect payment card numbers: the payment provider collects them on its own pages. We do not collect special categories of data.
3. Why we process it, and on which basis
- Deliver the service you bought: account, credentials, evaluation, funded account, payouts. Basis: performance of the contract.
- Verify identity and prevent fraud: identity check before a payout, detection of prohibited practices, device and IP consistency checks. Basis: legal obligations (anti-money-laundering where applicable) and our legitimate interest in preventing fraud.
- Keep accounts and invoices: orders, invoices, payouts. Basis: legal obligation (accounting and tax law).
- Secure the site: logs, rate limiting, blocking abusive traffic. Basis: legitimate interest.
- Send you service emails: credentials, payout status, rule changes, security alerts. Basis: performance of the contract.
- Send you marketing emails: promotions and content, only if you opted in; every email has an unsubscribe link. Basis: consent.
- Measure the audience: anonymous, cookieless statistics (see the cookie policy). Basis: legitimate interest.
We do not take automated decisions with legal effects on you without human review: a payout declined by our rule engine is reviewed by a person on request.
4. Who receives it
Processors act on our instructions under a data processing agreement:
- Hosting and infrastructure: Contabo GmbH (Germany) for servers, Cloudflare, Inc. for DNS, proxy and security.
- Email delivery: Resend, Inc.
- Payment: our card payment provider and our cryptocurrency payment provider, both named at checkout, which are independent controllers for the payment itself.
- Identity verification: our identity verification provider, named when the check starts, which processes your documents under its own policy and returns a result to us.
- Trading platforms: Rithmic, LLC or Tradovate, LLC receive your platform login and your orders under their own terms.
- Error monitoring: our error monitoring tool, with personal data scrubbed before storage.
Authorities and courts receive data when the law requires it. We do not sell personal data and we do not share it with advertisers.
5. International transfers
Our servers are in the European Union. Some processors are in the United States. Transfers rely on the standard contractual clauses adopted by the European Commission and, where the provider is certified, on the EU-US Data Privacy Framework.
6. How long we keep it
| Data | Retention |
|---|---|
| Login tokens | Deleted 7 days after expiry |
| Sessions | Deleted 30 days after revocation or expiry |
| Technical logs | 12 months |
| Account and trading data | While the account exists, then 12 months |
| Orders, invoices, payouts | 6 years after the year of the transaction, as required by Cypriot accounting law |
| Verification results | 5 years after the end of the relationship, as required by anti-money-laundering law |
| Marketing consent | Until withdrawn, then 3 years as proof |
7. Your rights
You can access, correct, export and delete your data, restrict or object to a processing, and withdraw a consent at any time. Export and deletion are self-service in the account settings; deletion is delayed for the data we must keep under section 6. For anything else, write to [email protected]. We answer within one month. You can also complain to the supervisory authority, the Office of the Commissioner for Personal Data Protection of the Republic of Cyprus, or to the authority of your own country.
8. Security
Connections are encrypted, sessions are stored hashed, sensitive fields are encrypted at rest, access is limited to the people who need it, and backups are encrypted and kept off the server. Our systems are behind a web application firewall and are reviewed by an external security test before real payments open. If a breach affects you, we notify you and the authority as the law requires.
9. Children
The service is for adults. We do not knowingly collect data of anyone under 18; an account found to belong to a minor is closed and its data deleted.
10. Changes
The version and date at the top of this page identify the current text. Material changes are announced by email.