Privacy Policy

1. Data Controller

The data controller responsible for your personal data is:

2. What Data We Collect

We collect only the personal data that is necessary to provide our services. Depending on how you interact with our website, this may include:

Account & Authentication Data

• Email address — required to create an account and send authentication magic links;
• Name — optional, collected during payment if provided to the payment processor.

Payment Data

Payment information (card numbers, billing details) is processed entirely by PayPal. We do not store, log, or have access to your card or banking credentials at any point. We retain only the transaction reference, amount, and status returned by PayPal.

Download & Order Data

• Order records (product purchased, amount paid, date);
• Secure download access tokens linked to your order.

Usage & Technical Logs

• Server logs (IP address, browser type, pages visited, timestamps) — retained for security and fraud prevention;
• Session identifiers stored in secure HTTP-only cookies for authentication.

3. Why We Collect It and Legal Basis (GDPR)

Under the EU General Data Protection Regulation (GDPR), we process your personal data on the following legal bases:

• Contract performance (Art. 6(1)(b) GDPR) — We process your email address and order data to fulfil your purchase, deliver your product, and manage your account.
• Legal obligation (Art. 6(1)(c) GDPR) — We retain order and transaction records as required by EU and Portuguese tax and accounting law.
• Legitimate interests (Art. 6(1)(f) GDPR) — We process server/usage logs for security monitoring, fraud prevention, and service improvement.
• Consent (Art. 6(1)(a) GDPR) — Where you have opted in to receive our newsletter or marketing communications, we process your email address on the basis of your consent. You may withdraw consent at any time.

4. Third-Party Service Providers

We use the following third-party services, each of which may process personal data on our behalf or independently:

• PayPal— Payment processing. PayPal independently acts as a data controller for information you provide during checkout. See PayPal's Privacy Policy for details.
• Cloudflare— CDN (content delivery network) and R2 object storage for secure product file hosting. Traffic passes through Cloudflare's network; download files are stored in Cloudflare R2.
• Google — Optional Google OAuth sign-in. If you choose to sign in with Google, Google will share your email address and profile name with us. We do not receive any additional Google account data.

We do not sell, rent, or share your personal data with any other third party for marketing or commercial purposes.

5. Cookies

We use cookies strictly to operate the website and maintain your authenticated session. Specifically:

• Session cookies — Secure, HTTP-only cookies used by Auth.js to keep you signed in. These are deleted when you sign out or your session expires.
• Locale preference cookie — A small cookie that remembers your preferred language. No personal data is stored.

We do not use third-party advertising cookies or behavioural profiling cookies. Privacy-friendly Umami analytics may run on production domains, honors Do Not Track, and does not receive personal data.

6. Data Retention

• Account data — Retained for as long as your account remains active, plus an additional 2 years after the account is closed or inactive, to allow for dispute resolution.
• Order and transaction records — Retained for 7 years from the date of purchase to comply with EU and Portuguese tax and accounting legal requirements.
• Server logs — Retained for up to 90 days for security and fraud prevention purposes, then deleted or anonymised.
• Newsletter consent records — Retained until you withdraw your consent, plus a reasonable period thereafter to demonstrate compliance.

7. Your Rights Under GDPR

If you are located in the European Union or European Economic Area, you have the following rights regarding your personal data:

• Right of access — Request a copy of the personal data we hold about you.
• Right to rectification — Request correction of inaccurate or incomplete data.
• Right to erasure — Request deletion of your personal data, subject to legal retention requirements.
• Right to data portability — Request your data in a structured, machine-readable format.
• Right to object — Object to processing based on legitimate interests or for direct marketing.
• Right to restriction — Request that we restrict processing of your data in certain circumstances.
• Right to withdraw consent — Where processing is based on consent, withdraw it at any time without affecting prior processing.

To exercise any of these rights, contact us at legal@forextradingtools.eu. We will respond within 30 days. You also have the right to lodge a complaint with your national data protection authority.

8. Children's Privacy

Our website and products are not intended for, and we do not knowingly collect personal data from, individuals under 18 years of age. If you are under 18, please do not use our services or provide any personal information. If we become aware that we have inadvertently collected data from a person under 18, we will promptly delete it.

9. Changes to This Policy

We may update this Privacy Policy from time to time. The “Last Updated” date at the top of this page indicates when the most recent revision was made. We encourage you to review this page periodically. For significant changes, we will make reasonable efforts to notify registered users.

10. Contact Us

For any privacy-related questions, data access requests, or complaints, please contact the data controller at:

legal@forextradingtools.eu