Data controller: RobotCopier.com, 128 City Rd, London EC1V 2NX, UK. We're registered with the Information Commissioner's Office (ICO) and process personal data under the UK GDPR and the Data Protection Act 2018.
1. What we collect
- Account data: email address, hashed password (Argon2id), sign-up date, last sign-in time.
- Broker connection data: the MT5 login number, broker name, server name, and encrypted broker password for each account you add. Passwords are encrypted at rest with AES-256-GCM using a master key held in a separate secret store.
- Trading metadata: trade events copied through the platform — symbol, side, lot size, timestamp, risk verdict, latency. We do not capture price feeds or strategy logic.
- Billing data: Stripe customer ID, subscription tier, payment status. Card details are held by Stripe, not by us.
- How you found us: if you arrive through a campaign link we record the campaign parameters in it (source, medium, campaign name) and the address of the page that referred you. We keep no cookie for this and do not track you across other sites.
- Sign-in records: for each registration and each successful sign-in we record the date and time, the IP address the request came from, the country that address resolves to, and your browser's user-agent string. We do not record failed sign-in attempts against an address we cannot verify belongs to you.
- Operational telemetry: service logs (request paths, status codes, latency), aggregated metrics. We do not run web analytics, do not place advertising cookies, and do not set any third-party tracker on the marketing site.
2. Why we process it (lawful bases under UK GDPR Art. 6)
- Contract (Art. 6(1)(b)): account data, broker connections, trade journaling, billing — necessary to provide the service you signed up for.
- Legitimate interest (Art. 6(1)(f)): service logs, security telemetry, fraud prevention, and the sign-in records described above — we use them to detect unauthorised access to an account. UK GDPR Recital 47 recognises fraud prevention and network security as legitimate interests. You can object — we'll consider it on the facts.
- Legal obligation (Art. 6(1)(c)): retention of accounting and tax records.
- Consent (Art. 6(1)(a)): only for non-essential channels such as product-update emails. You can withdraw at any time from your account page.
3. Who we share it with
We share only what's needed to operate the service:
- Stripe Inc. (Stripe Payments Europe Ltd in the EU/UK): billing.
- Your chosen broker: we send your encrypted broker credentials to your broker's MT5 server to place orders on your behalf.
- Email delivery (Amazon SES, EU region): transactional emails (welcome, verification, alerts).
- Hosting: OVHcloud (London + New York) and Akamai/Linode (London witness node). All data is held in the United Kingdom and the United States.
We never sell personal data. We do not transfer your data outside the UK / EEA except to the US providers above, which is covered by UK adequacy decisions and Standard Contractual Clauses.
4. How long we keep it
- Active accounts: as long as you keep your account open.
- Closed (soft-deleted) accounts: profile + trade history retained for 6 years for tax/regulatory reasons. Your encrypted broker passwords are destroyed at deletion — overwritten in place, with no copy kept anywhere, so we cannot recover them.
- Service logs: 90 days, then aggregated.
- Sign-in records (IP address, country, user-agent): 180 days, then automatically deleted.
- Email verification tokens: 7 days; deleted after use.
5. Your rights under UK GDPR
You can:
- Request a copy of the personal data we hold about you (right of access).
- Correct anything that's inaccurate (right to rectification).
- Ask us to delete your data (right to erasure — subject to our retention obligations above).
- Object to processing based on legitimate interest.
- Receive your data in a portable format.
- Withdraw consent at any time for things we process on the basis of consent.
Email [email protected] with any of these requests. We'll respond within one calendar month.
6. Live chat
If you use the live chat on robotcopier.com or app.robotcopier.com, we store the conversation — your messages and our replies — to help us answer you and to review the quality of our support. Chat conversations are deleted 180 days after the last activity in them. If you leave an email address, or chat is not answered live and we hand it off, that hand-off creates a support ticket containing the chat transcript, which we use to follow up by email.
7. Cookies & trackers
We set one cookie: rc_session, an HTTP-only session cookie holding your access token. It's necessary for the service to function, lasts 8 hours, and is not used for analytics or advertising. We do not set any third-party cookies on the marketing site.
8. Security
Broker passwords are encrypted at rest with AES-256-GCM. Account passwords are hashed with Argon2id. TLS 1.2+ is enforced on every endpoint. Inter-node traffic on our infrastructure rides a WireGuard mesh. Our security posture is summarised on the Security page.
9. Complaints
If you're not happy with how we've handled your data, you can complain to the UK Information Commissioner's Office (ICO) at ico.org.uk or on 0303 123 1113. We'd appreciate the chance to put it right first — write to [email protected].
10. Changes
When this policy changes materially we'll email registered users and post the new version here with a fresh "last updated" date.