Privacy Policy

The controller of personal data in the TraderAI Assistant service (the traderaiassistant.com website and the app.traderaiassistant.com app) is:

For anything about personal data, write to: contact@traderaiassistant.com. We have not appointed a data protection officer.

• Account data — email address, first name or display name, and password (stored only in protected form — we never know it). You can also sign in with an account from an external provider (currently Google) — the provider passes us your email address, name and account ID. Plus your language and account settings.
• Subscription and payment data — plan, billing period, currency, payment status, Stripe customer ID, invoice details. We never see your card number — you give it directly to Stripe.
• Your content in the app — journal and trades (instrument, direction, prices, size, result), notes, screenshots, analyses, methodology, session plan, conversations with Milo, and what you write about your mood, emotions and stress while trading.
• Data from integrations you connect — from TopstepX: trades, positions and account status; from TradingView: market data fetched when you ask for it in a conversation (we don't store it in our database). Access keys and tokens for these services, and your own AI key (if you add one), are stored encrypted.
• Technical data — IP address, browser and device type, server logs, AI usage counters (daily limits) and basic in-app events, stored in our own database. We do not use third-party analytics or advertising tools.
• Contact form and newsletter — full name, email, subject and message; for the newsletter — your email. In both cases also your IP address and browser details (abuse protection).

Providing data is voluntary, but you can't create an account without an email address or buy a plan without payment details.

• Providing the service (Art. 6(1)(b) GDPR) — your account, journal, Milo's analyses and conversations, integrations, subscription, support. Also answering an access request sent through the form (steps before entering into a contract).
• Legal obligations (Art. 6(1)(c) GDPR) — invoices, accounting, tax, handling complaints.
• Our legitimate interests (Art. 6(1)(f) GDPR) — security and abuse prevention, usage limits, monitoring the quality of AI answers, replying to messages outside a contract, establishing or defending legal claims.
• Consent (Art. 6(1)(a) GDPR) — the newsletter and sharing your progress with a mentor or group. You can withdraw consent at any time; this doesn't affect what we did before.

We treat entries about your mood and emotions as especially sensitive: we use them only so Milo can help you work on trading discipline and psychology, and we share them with no one beyond the recipients described below. You don't have to enter them.

Milo is an AI assistant — you are talking to software, not a person. To give you feedback, the AI model analyses your trades, notes and habits. Under the GDPR this is profiling. Its output is commentary and suggestions for you — we make no decisions based on it that have legal or similarly significant effects on you (Art. 22 GDPR).

We don't use your data to train general-purpose AI models. The default model provider (Google) processes it on our behalf, under a paid business service.

We share your data only with those we need to run the service, and only as much as is needed:

• Server, database and hosting provider — data centre in the EU. This is where the app, sign-in and the traderaiassistant.com website run, where the database and the files you add (e.g. screenshots) are stored, and where server logs record IP addresses and browser details.
• Cloud backup provider — data centre in the EU. Stores encrypted copies of the database.
• Google Ireland Ltd (and Google group companies) — in three roles:
  • the Gemini AI model that Milo runs on — it receives your conversations with Milo, trade descriptions, notes and screenshots sent for analysis; Google also provides text-to-speech for voice notes;
  • our business email — your correspondence with us (e.g. to contact@);
  • sign-in with a Google account, if you choose it — Google passes us your email address, name and account ID.
  Google does not host the app or the database.
• Provider for sending emails from the app — delivers automatic messages: email address confirmation, the password reset link and messages about using your account. It receives your email address, name and the content of that message.
• Stripe Payments Europe Ltd — payment and subscription processing. You give your card details directly to Stripe — we never see them. For fraud prevention and its own legal obligations, Stripe acts as a separate controller.
• Technical tooling providers for AI features — monitoring the quality and correctness of AI answers, and auxiliary scoring models. They receive only what is needed for that purpose.
• Accounting office — invoice and payment data, to the extent required by tax and accounting law.

Separately — only if you switch it on yourself:

• TopstepX — when you connect your account, we read data from it (trades, account status), and if you turn on the daily lockout, we send the lockout request. The platform never places orders.
• TradingView — when you connect your account, Milo reads the market data you ask for. An alert in TradingView is created only after you click.
• Other brokers or exchanges — if you connect an account, read-only.
• An AI provider with your own key (Anthropic or OpenAI) — the key is optional. If you connect one, the content needed for the analysis goes to the provider you chose, on your account and under its terms.
• Your mentor or group — if you join a mentor's group and agree to share your progress.

External services have their own terms and privacy policies, which also apply to you.

We may also disclose data to public authorities where the law requires it. We do not sell data or share it with advertisers.

We will provide the current list of entities processing data on request sent to contact@traderaiassistant.com.

Our servers, database, files and backups are in the EU. Some recipients, however, belong to corporate groups based in the USA — above all Google and Stripe — and data may reach companies in those groups outside the European Economic Area. This also applies to the email sending provider, some technical tooling providers and services you connect yourself.

Such transfers rely on a European Commission adequacy decision (the EU-U.S. Data Privacy Framework — for entities certified under it) or on standard contractual clauses approved by the Commission. You can get a copy of these safeguards by writing to us.

• Account and your content — for as long as you have an account. You delete your account yourself in Settings; you can undo it for 7 days, after which the data is deleted. It disappears from backups when those backups expire in their normal cycle.
• Billing data — for as long as tax and accounting law requires (as a rule, 5 years from the end of the year in which the tax obligation arose).
• Contact form messages — for as long as the matter and any follow-up correspondence last, and if you become a user — until your account is deleted.
• Newsletter — until you unsubscribe.
• Logs and technical data — for as long as needed to keep the service secure and investigate possible abuse.

• Every connection to the service is encrypted (HTTPS/TLS).
• Integration keys and tokens and your own AI key are encrypted in the database (AES-256).
• The database separates users' data: each account sees only its own data.
• Backups are encrypted and stored in the EU.

We do not use end-to-end encryption. The server has to read your entries so that Milo can analyse them.

You have the right to:

• access your data and get a copy of it (Art. 15 GDPR),
• have your data corrected (Art. 16),
• have your data erased (Art. 17),
• restrict processing (Art. 18),
• data portability (Art. 20),
• object to processing based on our legitimate interests, including profiling (Art. 21),
• withdraw consent at any time,
• lodge a complaint with the Polish supervisory authority (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl) or with the data protection authority in your country.

You'll find data export and account deletion in the app's Settings. For anything else, write to contact@traderaiassistant.com. We'll reply without undue delay, and within one month at the latest.

Live in the USA? We do not sell personal information or share it for targeted advertising. To request access, correction or deletion, write to the same address.

We don't use analytics or advertising cookies. Details: Cookie Policy.

If we change how we process data, we'll update this page and the date at the top. We'll announce significant changes in the app.