Legal
Privacy Policy
GDPR + CCPA aligned
1. Who we are
Axon is the data controller for personal information collected through the Service. Reach us at support@axontrade.cloud.
One exception. When an enterprise customer (a broker, prop desk or signal provider) asks our staff to create accounts for its own clients, that customer is the controller of its clients' data and Axon is the processor, acting on the customer's instructions under the agreement between us.
2. What we collect
| Category | Examples | Source |
|---|
| Account data | Name, email, password hash | You, at signup |
| Staff-created accounts | Name, email, plan, staff notes about the account | The enterprise customer that asked for the account, entered by Axon staff |
| Billing data | Card last-4, billing address | Stripe (we never see full card) |
| Brokerage credentials | MT5 login, server, password | You, encrypted at rest |
| Telegram session | Phone number, session token | You, encrypted at rest |
| Trade data | Signals parsed, orders placed, fills | Service operation |
| Telemetry | IP, device, browser, page views | Standard web logs |
3. How we use it
- To provide the Service: route signals, execute orders, display dashboards.
- To bill you: process subscription payments via Stripe.
- To support you: respond to email, WhatsApp, and Telegram inquiries.
- To improve the Service: aggregate, anonymized analytics on parser accuracy and latency.
- To comply with law: respond to lawful requests from competent authorities.
We do not sell your data. We do not train AI models on your trade history. We do not share signal content with third parties. Staff-created accounts receive no marketing email from us; the messages they get are about the account and the service only.
4. Who we share it with
We share the minimum necessary data with these processors:
- Stripe, payment processing (Ireland / United States)
- Hetzner, server hosting (Helsinki, Finland) and encrypted off-site backups (a Hetzner Storage Box in Germany)
- OpenRouter, signal parsing and the in-product assistant (United States). The message text of the channels you follow is sent here to be interpreted, and OpenRouter passes it to the vendor of the model that answers, currently Google for signal parsing. Your account identifiers and broker credentials are not sent.
- Google Cloud (Vertex AI), backup signal parsing when OpenRouter does not answer (United States). The same message text only.
- Resend, email delivery: the account, security and billing messages we send you (European Union)
- Hostinger, our support mailbox
- Google and Telegram, sign-in, only if you choose to sign in with them. They confirm who you are to us; we never receive your password with them.
When you connect your own Telegram account or WhatsApp number as a signal source, messages from the channels and groups you pick reach us through Telegram or WhatsApp, under their terms.
Signal parsing happens in the United States. If that matters to you, tell us before you subscribe.
5. Security
Broker credentials and channel session tokens are encrypted at rest. Passwords are hashed with Argon2id. All transit is encrypted. Each customer's terminal runs in an environment dedicated to that customer, your terminal cannot see another customer's terminal, and their activity cannot reach yours.
If a breach occurs, we will notify affected users within 72 hours per GDPR Article 33.
6. Retention
- Account data: retained while your account is active, deleted within 30 days of termination. Backups are covered separately below.
- Trade history: retained for 24 months for tax/audit purposes, then anonymized.
- Billing records: retained 7 years as required by applicable tax law.
Backups
We keep encrypted backups so that a hardware failure does not lose your history. Closing your account has to reach those too.
- The day you close. The same step that deletes your live data also removes you from every backup we can still read. If that fails, it is recorded and a person finishes it by hand.
- What we cannot edit. Copies already shipped off the server are sealed with a key we deliberately keep offline. Nothing running in our systems can open them, so we cannot take you out of them. We never restore them to serve your account again.
- When every copy is gone. Backups are deleted on a fixed rotation, and closing your account also wipes your terminal. Six weeks after your live data is deleted, nothing we hold contains it, readable or sealed.
- The billing records listed above are the deliberate exception. They are kept outside this system for the period tax law requires.
7. Your rights
Under GDPR and CCPA, you have the right to:
- Access, get a copy of your data,
- Rectify, correct inaccurate data,
- Erase, delete your account and data,
- Port, receive your data in JSON format,
- Object, to processing for analytics or marketing,
- Withdraw consent, at any time.
Email support@axontrade.cloud to exercise any right. We respond within 30 days.
8. Cookies
We use only essential cookies (session, CSRF). No advertising or tracking cookies. No third-party analytics beyond aggregated server-side metrics.
Privacy questions: support@axontrade.cloud · WhatsApp +961 76 827 272