Privacy policy

01What this covers

This policy describes the information TradeLogX Nexus collects when you use the platform, why each piece is collected, how long it is kept and who else ever sees it. It applies to the web application, the API and the dashboard.

It does not cover the exchanges you connect. When you place an order, that order and the account it belongs to are governed by the venue's own terms and privacy policy, which we cannot alter on your behalf.

02What we collect

Three categories, and nothing outside them:

• Account data — the email address you sign up with, a password hash, and the two-factor secret if you enable it. We never store your password.
• Connection data — exchange API keys, encrypted before storage and decrypted only inside the execution service; the venue, the scopes the key carries, and the addresses it is allowlisted to.
• Operating data — the decisions the engine made for your account, the orders and fills that resulted, the journal entries and lessons attached to them, your configuration, and the audit log of changes you made.

We also record ordinary technical logs — request timestamps, source addresses, user agents and error traces — because an incident that cannot be reconstructed cannot be fixed.

03What we do not collect

We do not collect the contents of accounts you have not connected, and we do not read balances or positions on venues you have not authorised.

We do not sell data, and we do not share it with advertisers or data brokers. There is no advertising business here to fund with it.

We do not run third-party analytics that follow you across other sites. Usage measurement is first-party and aggregate.

04Exchange keys, specifically

An exchange key is the most sensitive thing you give us, so it is worth being exact. It is submitted directly to the key service over TLS and encrypted before the response returns. It is never held by the web application, never placed in a session, and never rendered again after you enter it.

Only the execution service can decrypt one, in memory, for the duration of a request. That service has no inbound public route and no interactive shell. Secrets are redacted at the serialiser rather than at each call site, so a new endpoint cannot leak one by omission.

A key carrying withdrawal permission is refused at the moment you try to connect it. This is a structural limit rather than a policy: the worst case of a compromise is unwanted trading, not a drained account.

05Why each piece is collected

Account data exists so you can sign in and so we can reach you about your account. Connection data exists because an order cannot be placed without it. Operating data exists because the product's entire proposition is that decisions are explainable and outcomes are remembered — a journal you cannot keep is not a journal.

Technical logs exist for security and debugging, and are the basis of the audit trail you can inspect yourself.

06How long we keep it

• Account data — for as long as the account exists, then deleted within 30 days of closure.
• Exchange keys — until you revoke them, or immediately on account closure. Revocation is immediate and irreversible.
• Operating data — for the life of the account, because its value is cumulative. You can export or delete it at any time.
• Technical logs — 90 days, then discarded. Audit-log entries are retained for the life of the account because their purpose is to be consultable after the fact.

Backups are encrypted with the same envelope scheme and expire on their own schedule; deleted data disappears from backups as those rotate rather than instantly.

07Who else sees it

Infrastructure providers who host the platform and process payments see what they must in order to do that, under contract, and nothing further. They cannot decrypt exchange keys.

We will disclose data if compelled by valid legal process. Where we are permitted to tell you that this has happened, we will.

Nobody else. There is no partner programme, no data-sharing arrangement and no analytics vendor with a copy.

08Your rights over it

• Export — take your full operating history in a machine-readable format, at any time, without asking.
• Correction — change anything about your account from the settings pages.
• Deletion — close the account and have its data removed on the schedule above.
• Objection — decline non-essential processing without losing access to the product.

These are available in the product rather than by request. A right you have to email someone to exercise is a right with friction attached.

09How it is protected

Envelope encryption with per-tenant data keys, TLS 1.3 in transit, zero-trust service identity between internal components, and an append-only, hash-chained audit log that no product code path can amend. The security page describes the architecture in detail, including what each boundary actually re-checks.

10Changes to this policy

Material changes are announced in the product and by email before they take effect, with the change described in plain language rather than only as a new version of the document. The date at the top of this page always reflects the current version.