Privacy Policy

1. Who We Are

PipSync ("we", "us", "our") operates the pipsync.io platform, a cloud-based trading signal automation service. This Privacy Policy explains how we collect, use, store, and protect your personal information when you use our website and services.

The identity and contact details of the company that operates PipSync (including registered address and identifiers once available) are published in our Imprint / Impressum. If you read this policy without visiting the Impressum, please use that page to confirm the current legal entity and postal address.

2. Data We Collect

We collect the following categories of data:

• Account data: Email address, name, and authentication credentials when you register.
• Broker credentials: For credential-based broker connections (e.g. MT4/MT5, Match-Trade) the login details, and for exchange connections (e.g. Binance, Bybit) the API keys, required to execute trades on your behalf. These are stored through app-managed credential encryption when storage is required and are not exposed via API responses or logs. For cTrader we do not collect or store your password: you authorize PipSync through the official cTrader Open API via OAuth 2.0 (cTrader ID), and we store only the resulting OAuth authorization tokens.
• Trading data: Signal history, trade execution logs, and performance metrics generated through your use of the platform.
• Usage data: Browser type, IP address, pages visited, and interaction patterns collected via standard web analytics.
• Payment data: Billing information processed by our payment provider (Stripe). We do not store full card numbers.

3. How We Use Your Data

• Provide and maintain the service (including executing trades and delivering analytics).
• Authenticate and secure your account.
• Process payments and subscriptions.
• Service-related notifications (e.g. trade alerts, drawdown warnings).
• Improve the platform (aggregated, anonymised usage).
• Comply with legal obligations.

A consolidated mapping of each purpose to the reason we process the data is in Section 10 below.

4. Data Storage & Security

All data is transmitted over TLS (HTTPS). Broker credentials are encrypted at rest with app-managed AES-GCM encryption and are not exposed via API responses or logs. PipSync is designed for EU-hosted deployment, strict access controls, and audit logging. Independent SOC 2/vendor evidence, external penetration-test records, and formal legal review are tracked as production-readiness items before any compliance claim is made.

5. Data Sharing

We do not sell your personal data. We share data only with:

• Your broker: Trade instructions and — for credential-based broker connections — the credentials necessary to execute orders; cTrader connections are authorized via OAuth tokens instead of a password.
• Payment processors: Stripe, for subscription billing.
• Infrastructure providers: Cloud hosting and monitoring services, engaged as service providers under strict written contracts.
• Legal authorities: When required by law or to protect our rights.

6. Service Providers & Data Locations

Our platform is designed for EU-hosted deployment (see Section 4). Some of our subprocessors are located in other countries — in particular the United States — or may access personal information from there. Vendors that handle personal information on our behalf are engaged as service providers under written contracts that limit their use of that information to performing services for us.

For the vendors that handle personal information on our behalf and the terms that apply to a specific one, contact support@pipsync.io.

7. Your Privacy Rights

Under applicable privacy laws, you have the right to:

• Access the personal information we hold about you.
• Request correction of inaccurate information.
• Request deletion of your data.
• Export your data in a portable format.
• Turn off optional data processing at any time.

California residents (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act, gives you the following rights:

• Right to know — the categories and specific pieces of personal information we have collected about you, the sources, the business purposes for collecting it, and the categories of third parties we disclose it to. Sections 2, 5 and 10 describe this.
• Right to delete — request deletion of personal information we collected from you, subject to the record-keeping periods in Section 11.
• Right to correct — inaccurate personal information we hold about you.
• Right to opt out of the sale or sharing of your personal information, including sharing for cross-context behavioural advertising.
• Right to limit the use and disclosure of sensitive personal information to what is necessary to provide the service you requested.
• Right to non-discrimination — we will not deny you service, charge you a different price, or provide a different level of quality because you exercised any of these rights.

To exercise any of these rights, contact us at support@pipsync.io.

8. Cookies

We use essential cookies for authentication and session management. Analytics cookies are optional and are only used if you choose to allow them. You can manage cookie preferences in your browser settings.

9. Automated Decision-Making & Profiling

PipSync uses machine-learning (ML) models to generate and execute trading signals on your behalf. This means decisions with a significant financial effect are made automatically, without a person reviewing each one before it is executed.

What systems are involved?

• MegaBot / ML Pipeline (v10–v15): LightGBM and XGBoost ensemble models trained on multi-timeframe OHLCV market data. Outputs a directional signal (long / short / flat) and a conviction score used to size positions.
• SNIPER (v13): Three-stage filter (primary gate → meta-labeler → execution quality). Clusters symbols into CORE / SATELLITE / VENTURE tiers. Applies drawdown-protection circuit breakers at both cluster and portfolio level.
• RL Trader: Reinforcement-learning agents (PPO / TD3) trained via walk-forward simulation. Produces a continuous action signal in [-1, 1] that is translated into a position size.

Which data does the system use?

• Historical and live market price data (OHLCV candles, tick data) — not personal data.
• Your connected broker account credentials or OAuth authorization tokens, used solely to submit, modify, or close orders.
• Your risk parameters (lot size, max drawdown, account balance) as configured by you in the platform.

Logic and safeguards (high-level)

Models generate a signal and a confidence score. Position sizing applies Kelly-fraction caps and per-cluster drawdown multipliers. Circuit breakers halt trading automatically when daily loss or consecutive-loss thresholds are reached. No model has access to your identity, health, race, religion, or any sensitive personal information. All training data is market data only.

Why execution is automated

Automated trading decisions are necessary to perform the agreement between you and PipSync. You subscribed to an automated signal-execution service; manual review of every signal by PipSync staff before execution would make the service technically impossible.

Your opt-out & human review

You can opt out of automated processing at any time. You may also request that a human at PipSync review any specific decision. To exercise this right, contact support@pipsync.io.

Practical effect of opt-out: Because automated signal execution is the core function of PipSync, opting out of all automated decision-making means the platform will no longer be able to execute trades on your behalf. Your account data will be retained in accordance with Section 11 below, and you may cancel your subscription at any time without penalty.

10. Purposes of Processing

The table below sets out why we process personal information for each purpose, and the business purpose category it falls under.

Where we process data to operate, secure, or improve the platform, we limit that processing to what is necessary for the stated purpose, given the limited nature of the data processed and the security measures applied.

11. Data Retention

We retain your account data for the duration of your account. Trading data is retained for up to 24 months after account closure for compliance purposes. You may request earlier deletion by contacting us.

12. Changes to This Policy

We may update this policy from time to time. Material changes will be communicated via email or an in-app notification. Continued use of PipSync after changes constitutes acceptance.

13. Contact

For privacy-related inquiries, contact us at support@pipsync.io. Operating entity and postal contact: Imprint / Impressum.