Privacy Policy

Trading Lab 247 Effective date: 16 May 2026 Last updated: 16 May 2026

1. Introduction

Trading Lab 247 ("we", "us", or "our") operates a discipline-focused trading platform for retail and prop-firm traders at tradinglab247.com (the "Service"). We are a bootstrapped, sole-trader business.

This Privacy Policy explains what personal data we collect, why we collect it, how we use it, who we share it with, and your rights over it. We take these obligations seriously because our users trust us with sensitive financial and behavioural data — and we intend to honour that trust fully.

If you have any questions, contact us at: support@tradinglab247.com

2. Who this Policy Applies To

This Policy applies to:

Visitors to our marketing website
Free, Pro, and Team/Coach account holders
Traders whose data is shared by a coach or team administrator

If you are a trader on a coach-managed or team account, your coach or team administrator may have agreed to additional terms governing their use of the Service. Your rights under this Policy still apply in full.

3. Data We Collect and Why

3.1 Account and Identity Data

Data	Why we collect it
Email address	Account creation, login, transactional emails, and support
Password (hashed — never stored in plain text)	Authentication
Display name (if provided)	Personalisation
Account tier (Free, Pro, Team)	Determining feature access
Date and time of registration	Security, fraud prevention

Legal basis (GDPR): Contract performance; legitimate interests (security).

3.2 Trading and Broker Data

When you connect a broker account via MetaApi (MT4/MT5) or cTrader Open API:

Data	Why we collect it
Trade history (open/close time, instrument, lot size, direction, entry/exit price, P&L)	Calculating R-multiples, Process Score, and analytics
Account balance and equity snapshots	Displaying drawdown context
Broker account identifiers	Linking your broker connection to your account

What we do not collect: We request read-only API access. We cannot and do not place, modify, or cancel trades on your behalf. We do not store your broker login credentials.

Legal basis (GDPR): Contract performance.

3.3 Behavioural and Journal Data

This is the core data that makes the Service useful. It is created by you and stored in your account:

Data	Why we collect it
Pre-trade commitment ritual entries	Calculating your commitment score and gate adherence
Tilt-lockout trigger events	Identifying emotional escalation patterns
Process Score records	Tracking rule adherence over time
Post-loss reflection entries	Supporting your mental hand history
Rule book / named setups	Enabling per-setup analytics
Manual journal entries	Part of your trading record

This data is highly personal. We do not sell it, share it with brokers, or use it for marketing purposes. On Team/Coach plans, you explicitly authorise a named coach to view your data in read-only form (see Section 6).

Legal basis (GDPR): Contract performance.

3.4 Subscription and Payment Data

Payments are processed by Stripe, Inc. We never receive or store your full card number, CVV, or bank details. What we do store:

Data	Why we collect it
Stripe customer ID	Linking your account to your subscription
Subscription status and plan tier	Determining feature access
Billing email	Sending receipts and renewal notices
Last 4 digits of card and card brand (received from Stripe)	Displaying billing info in your account
Invoice history	Compliance and support

Legal basis (GDPR): Contract performance; legal obligation (tax records).

3.5 Usage and Analytics Data

We use Plausible Analytics — a privacy-first, cookieless analytics tool. Plausible does not use cookies, does not track users across sites, and does not build individual user profiles. The data it collects is aggregate only (page views, referral sources, country-level geography, device type).

We do not use Google Analytics or any other cookie-based analytics tool.

Legal basis (GDPR): Legitimate interests (product improvement). Because Plausible is cookieless and collects no personal data, no consent banner is required for analytics.

3.6 Communications Data

Data	Why we collect it
Email address (newsletter signup)	Sending the Discipline Edge newsletter
Email open/click events (via Resend/Postmark)	Measuring deliverability and engagement
Support correspondence	Resolving your request

You can unsubscribe from the newsletter at any time via the link in any email. Transactional emails (receipts, password resets) cannot be opted out of while your account is active.

Legal basis (GDPR): Consent (newsletter); contract performance (transactional emails).

3.7 Technical and Security Data

Data	Why we collect it
IP address (at login/signup)	Security and abuse prevention
Browser/device type (from HTTP headers)	Debugging and compatibility
Authentication tokens (JWT, short-lived)	Session management
Application error logs	Diagnosing and fixing bugs

Error logs do not contain your journal or trade content. We retain server logs for a maximum of 30 days.

Legal basis (GDPR): Legitimate interests (security and service reliability).

4. How We Use Your Data

We use your data only for the purposes stated in Section 3. In summary:

To provide and improve the Service — calculating scores, syncing broker data, running analytics
To manage your account and subscription — billing, authentication, support
To communicate with you — transactional emails, newsletter (if subscribed), product updates
To ensure security — detecting fraud, preventing unauthorised access
To comply with legal obligations — tax records, responding to lawful requests

We do not:

Sell your personal data to any third party
Share your trading or journal data with brokers, prop firms, or financial institutions
Use your data to train AI models for third parties
Use your data for behavioural advertising

5. Third-Party Services (Data Processors)

We use the following sub-processors. Each is engaged under a data processing agreement (DPA) or equivalent contractual protection:

Service	Purpose	Data shared	Location
Stripe, Inc.	Payment processing	Billing email, payment details	USA (EU SCCs)
MetaApi	MT4/MT5 broker integration	Broker trade data (read-only)	Varies (EU/US)
cTrader Open API	cTrader broker integration	Broker trade data (read-only)	EU
Resend / Postmark	Transactional & newsletter email	Email address, email content	USA (EU SCCs)
Plausible Analytics	Privacy-first website analytics	Aggregate, non-personal data	EU (Estonia)
Railway / Render	Application and database hosting	All account and application data	USA (EU SCCs)

If we add or change sub-processors, we will update this table and, where required by law, notify you in advance.

6. Coach and Team Accounts

If you subscribe to a Team/Coach plan or are added to a team by a coach:

Your coach can view your commitment entries, gate adherence, Process Score, and tilt-lockout events in read-only form
Your coach cannot modify your journal, add trades on your behalf, or access your broker credentials
By joining a team, you consent to this read-only access for the named coach account holder
If you leave a team, your data is immediately removed from the coach's view
The coach account holder is responsible for handling your data lawfully if they are subject to their own regulatory obligations (e.g., as an authorised coach or educator)

7. Data Retention

Data type	Retention period
Active account data (journal, trades, scores)	For the life of your account
Subscription and billing records	7 years (tax/legal requirement)
Server and authentication logs	30 days
Newsletter opt-in records	Until you unsubscribe + 2 years
Deleted account data	Purged within 30 days of deletion request

When you delete your account, we delete all journal, trade, and behavioural data within 30 days. Billing records are retained for the legally required period (typically 7 years) even after account deletion.

8. Data Security

We take reasonable technical and organisational measures to protect your data:

Passwords are hashed using a modern, one-way algorithm (bcrypt or equivalent) — never stored in plain text
All data in transit is encrypted via TLS/HTTPS
Per-user data isolation: each account's data is logically separated at the database level
Broker integration is strictly read-only — we cannot execute trades
JWT authentication tokens are short-lived and invalidated on logout
Access to production systems is restricted to authorised personnel only

No system is 100% secure. If we become aware of a breach that affects your personal data, we will notify you and the relevant supervisory authority as required by applicable law.

9. International Data Transfers

Trading Lab 247 is available globally. Our infrastructure is primarily hosted in the United States. If you are located in the UK, EU, or other jurisdictions with data transfer restrictions, your data may be transferred to countries that do not have an equivalent level of data protection law.

Where this occurs, we ensure protection via:

EU Standard Contractual Clauses (SCCs) with our US-based sub-processors
Sub-processors' participation in recognised transfer mechanisms (e.g., EU-US Data Privacy Framework where applicable)

10. Your Rights

Regardless of where you are located, you have the right to:

Access the personal data we hold about you
Correct inaccurate data
Delete your data (subject to legal retention requirements)
Export your data in a machine-readable format (data portability)
Restrict processing in certain circumstances
Object to processing based on legitimate interests

EU and UK Users (GDPR / UK GDPR)

You have the additional right to lodge a complaint with your national supervisory authority. In the UK, this is the Information Commissioner's Office (ICO): ico.org.uk. In the EU, contact the supervisory authority in your country of residence.

California Users (CCPA / CPRA)

California residents have the right to:

Know what personal information is collected and how it is used
Delete personal information (subject to exceptions)
Opt out of the sale of personal information — we do not sell personal information
Non-discrimination for exercising these rights

To exercise any right, contact us at support@tradinglab247.com. We will respond within 30 days (or 45 days where permitted).

Australian Users (Privacy Act 1988)

You have the right to access and correct personal information we hold about you, and to lodge a complaint with the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au if you believe we have breached the Australian Privacy Principles.

11. Cookies

We use no tracking or advertising cookies. Plausible Analytics (our analytics tool) is cookieless and requires no consent banner.

The only cookies we set are:

Cookie	Purpose	Expires
Session / authentication token	Keeping you logged in	Session or rolling 30 days
Stripe cookies (on checkout pages)	Payment fraud prevention	Per Stripe's policy

You can block cookies in your browser settings. Blocking session cookies will prevent you from staying logged in.

12. Children's Privacy

The Service is intended for adults (18+) engaged in financial trading. We do not knowingly collect personal data from anyone under 18. If we become aware that a user is under 18, we will promptly delete their account and data.

13. Changes to This Policy

We may update this Policy from time to time. If we make material changes, we will notify you by email (to the address on your account) at least 14 days before the changes take effect. Continued use of the Service after the effective date constitutes acceptance of the updated Policy.

The "Last updated" date at the top of this document always reflects the most recent revision.

14. Contact

For any privacy-related questions, requests, or complaints:

Email: support@tradinglab247.com
Postal address: [INSERT IF APPLICABLE]

We aim to respond to all privacy requests within 30 days.

Trading Lab 247 is not a financial advisor and does not provide investment advice. Nothing in this Privacy Policy or the Service constitutes financial advice. All trading involves risk.