Privacy Policy
Last updated 5 October 2026 · version 2026-10-05
This notice explains what personal data PatternX ("we") processes, why, on what legal basis, how long we keep it, and how you exercise your rights. It is written to satisfy Articles 13 and 14 of the EU General Data Protection Regulation (GDPR), the UK GDPR, and the notice-at-collection duties of the California Consumer Privacy Act as amended by the CPRA and the comparable Virginia, Colorado, Connecticut, Utah, Texas and Oregon statutes.
1. Who is responsible for your data
The controller of your personal data is the operator of PatternX. Full corporate identification is published on the Imprint page.
Privacy contact: privacy@patternx.io.
2. What we collect, why, and for how long
| Data | Purpose | Legal basis (GDPR Art. 6) | Retention |
|---|---|---|---|
| Email, password hash, optional name | Create and secure your account, authenticate you, send service messages | 6(1)(b) contract | Life of the account, then 30 days |
| Two-factor secret (encrypted), session tokens | Protect the account against takeover | 6(1)(f) legitimate interest in security | Until 2FA is disabled or the account is deleted |
| Exchange and broker API credentials (AES-256-GCM encrypted) | Connect to the venue you chose, read balances, place the orders you configure | 6(1)(b) contract | Until you delete the connection |
| Signals, trades, positions, risk and scanner settings | Run the scanner and trading engine, show your history, enforce your risk limits | 6(1)(b) contract | Life of the account; financial records up to 7 years where law requires |
| Subscription and payment records (amount, invoice and transaction IDs). Card details are entered on Stripe’s checkout and never reach PatternX | Bill you, prove payment, meet tax and accounting duties | 6(1)(b) contract; 6(1)(c) legal obligation | Up to 10 years under applicable tax law |
| Audit log: action, resource, IP address, user agent, timestamp | Detect abuse, investigate incidents, prove what happened to an account | 6(1)(f) legitimate interest in security and fraud prevention | 24 months |
| Support messages and assistant conversations | Answer your questions and improve support quality | 6(1)(b) contract; 6(1)(f) legitimate interest | 24 months after the last message |
| Telegram chat ID, push subscription endpoint | Deliver the alerts you switched on | 6(1)(a) consent — withdraw by unlinking or disabling the channel | Until you unlink the channel |
| Marketing email delivery, open and click events | Send the newsletters you opted into and measure whether they work | 6(1)(a) consent — withdraw at any time | 24 months, or until you unsubscribe |
| Page views of public pages, and the website you arrived from (its domain only — never the full address) | Count, as daily totals per page and per website, how our public pages are used and which sites and AI assistants send visitors. No cookie, IP address or identifier is recorded with it | 6(1)(f) legitimate interest in understanding how our public pages are found and used | Daily totals only; nothing that identifies you |
| That same domain, stored with your account if you sign up during such a visit | Measure which websites send us customers | 6(1)(f) legitimate interest — object at any time and we delete it | Life of the account |
| A review you choose to write: rating, text, the name you choose to show, optional country, and the product, market and experience level you select | Publish your review after a check for spam and personal data, marked as from a verified customer if you have paid for a plan | 6(1)(a) consent — delete your review at any time from Settings | Until you delete the review or your account |
| Signal and trade context sent to our AI provider | Generate the explanation, analysis or assistant answer you ask for, and the automatic daily, weekly and monthly trading reports for accounts that traded in the last 30 days | 6(1)(b) contract — the reports are part of the service | Not retained for model training by us or our provider |
We do not collect special-category data, we do not profile you in a way that produces legal effects, and no decision about you is made by automated means. The trading engine acts on your own instructions and settings, not on an assessment of you as a person.
3. Where your data goes
We use a small set of processors to run the service — hosting, database, email, payments and AI. Each one is listed, with its purpose and region, on the Sub-processors page. Every processor is bound by a data-processing agreement under GDPR Art. 28.
Some processors are in the United States. Those transfers rely on the European Commission's Standard Contractual Clauses (Decision 2021/914) together with supplementary technical measures — in particular, credentials are encrypted before they ever leave our database, so a processor never sees a usable key.
We also transmit data to the exchange or broker you connect, because that is the point of the service. That venue is an independent controller under its own privacy policy; read it before connecting.
4. Your rights
Under the GDPR and UK GDPR you can, at any time:
- Access your data (Art. 15) and port it in a machine-readable form (Art. 20) — one click in Settings → Privacy & your data, no request needed.
- Erase your account and data (Art. 17) — also self-service in Settings. Records we must keep for tax or anti-fraud law are retained in minimised form and nothing else.
- Rectify inaccurate data (Art. 16), restrict processing (Art. 18), and object to processing based on legitimate interest (Art. 21).
- Withdraw consent (Art. 7(3)) for marketing email, Telegram or push at any time, without affecting what was lawful before.
- Complain to your national supervisory authority (Art. 77). You do not have to contact us first, though we would like the chance to fix it.
US residents have equivalent rights to know, delete, correct and port, plus the right to opt out of sale or sharing and of profiling. Because we do none of those things, the opt-out is satisfied by default; the access and deletion tools above serve the rest. We will not discriminate against you for exercising a right.
We answer rights requests within one month (GDPR) or 45 days (US state law). Use the self-service tools, or write to privacy@patternx.io. An authorised agent may act for you with written proof.
5. Security
Passwords are hashed, never stored in readable form. Exchange credentials and two-factor secrets are encrypted with AES-256-GCM before they reach the database and are never displayed again after saving. Sessions use signed, httpOnly, secure cookies. Security-relevant actions are logged. Access to production data is limited to the people who operate the service.
No system is perfectly secure. If a breach is likely to result in a risk to your rights, we notify our supervisory authority within 72 hours (Art. 33) and tell you directly when the risk is high (Art. 34) and under the applicable US state breach-notification statutes.
6. Children
PatternX is not offered to anyone under 18. We do not knowingly collect data from minors. If you believe a minor has an account, write to privacy@patternx.io and we will delete it.
7. Cookies and local storage
We set one strictly necessary session cookie and store a few preferences, such as your theme, locally in your browser. There are no advertising, analytics or third-party tracking cookies, which is why you are not asked to dismiss a consent banner. The detail is on the Cookies & Storage page.
8. Changes
When this notice changes materially we raise its version, publish the new text here, and tell you by email before it takes effect. The current version is 2026-10-05. Questions go to privacy@patternx.io or support@patternx.io.