Privacy Policy
Last updated: 6 November 2026
We collect what is needed to run a trade copier: your account details, encrypted broker credentials, trade and account data from connected accounts, billing data handled by our payment processor (Whop), and basic usage analytics. We never sell personal data.
1. Controller
CopyTraderTool Ltd (“we”) is the data controller for personal data processed through copytradertool.com and the CopyTraderTool application. Contact: support@copytradertool.com.
2. Data we collect
| Category | Examples | Source |
|---|---|---|
| Account data | Email, name, password hash, 2FA secret, language, notification preferences | You |
| Broker connection data | Platform, broker, server, login, password (encrypted), account type, connection status | You |
| Trading data | Balance, equity, open positions, orders, trade history, copied-trade records with timestamps and latency | Your broker account via our connectivity provider |
| Copier configuration | Sources, targets, risk settings, EquityShield rules, events and logs | You / generated |
| Billing data | Plan, subscription status, invoices, last four card digits, card fingerprint (for trial abuse prevention), billing country | Whop |
| Support data | Tickets, chat messages, emails, provider applications | You |
| Technical data | IP address, browser, device, pages viewed, timestamps, error logs | Automatically |
We do not collect full card numbers (Whop does), and we never ask for your broker’s withdrawal or banking credentials.
3. Why we process it and on what basis
- To provide the Service (contract): connecting accounts, copying trades, showing history and statistics, sending alerts you enabled, billing.
- Security and fraud prevention (legitimate interest / legal obligation): login protection, one-trial-per-person enforcement, abuse detection.
- Support and communication (contract / legitimate interest): answering tickets, service announcements, trial-end and payment reminders required by our payment provider.
- Improvement and analytics (legitimate interest / consent where required): aggregated usage statistics, error monitoring.
- Marketing (consent): product news by email; you can unsubscribe at any time.
- Legal compliance (legal obligation): tax records, responding to lawful requests.
4. Broker credentials
Broker passwords are encrypted with AES-256-GCM using keys stored separately from the database and are decrypted only in memory by the connector that maintains your account session. Staff cannot view plaintext passwords. We recommend investor (read-only) passwords for source accounts. Credentials are deleted when you remove the account or close your CopyTraderTool account, and in any case within 30 days of termination.
5. Sharing and processors
We share personal data only with processors acting on our instructions under data-processing agreements:
- Trading-account connectivity provider (maintains the MetaTrader session on our behalf; receives broker login, server and password).
- Whop, Inc. (payments, subscriptions, receipts, card fraud checks).
- Cloud hosting and database providers (EU and/or US regions).
- Transactional email provider (alerts, reminders, receipts).
- Support chat and ticketing provider.
- Error monitoring and privacy-friendly analytics.
- A text-analysis service provider, only if you enable the Trade Journal add-on, which receives anonymised trade statistics (no credentials, no personal identifiers) to write the journal insights.
We may disclose data where required by law, to enforce our Terms, or in connection with a merger or acquisition (with notice to you). We do not sell personal data and we do not share it with providers in the catalog; providers see only aggregate follower counts.
6. International transfers
Processors may be located outside your country. Where data leaves the EEA/UK we rely on adequacy decisions or Standard Contractual Clauses and additional safeguards.
7. Retention
- Account and copier data: for the life of your account and 30 days after closure.
- Trade history: for the life of your account; aggregated, anonymised statistics may be kept longer.
- Billing records: 7 years or as required by tax law.
- Support conversations: 2 years after the last message.
- Server logs: up to 90 days.
8. Your rights
Depending on your location you may have the right to access, rectify, erase, restrict or object to processing, to data portability, and to withdraw consent at any time. You can export history as CSV and delete your account from Settings. For other requests email support@copytradertool.com; we respond within 30 days. You may lodge a complaint with your local data-protection authority.
9. Security
Measures include encryption in transit (TLS) and at rest, hashed passwords (bcrypt), optional TOTP two-factor authentication, role-based access, audit logging, network segregation for connectors and regular dependency updates. No system is perfectly secure; notify us immediately of any suspected breach.
10. Cookies
See our Cookie Policy.
11. Children
The Service is not directed at persons under 18 and we do not knowingly collect their data.
12. Changes
We will post updates here and, for material changes, notify you by email or in the app. The date above shows the latest revision.