PipLoop Privacy Policy

1. Who is responsible

PipLoop (“PipLoop”, “we”) is responsible for the personal data described here. Contact: [email protected].

2. What we collect

Category	Examples	Source
Account	Email, name, password (stored only as a hash), language, Google account id if you sign in with Google	You
Billing	Plan, billing period, payment status, country, name and email used at checkout. We never receive your card details	You, the merchant of record
Trading account	Broker server and login number, account type, balance and equity, positions, orders, deals, symbol settings	PipLoop for MT5 on your terminal
Your content	Journals, Playbooks, Flows, notes, drawings, screenshots, backtest results	You
AI provider keys	Keys you add for Copilot AI, stored encrypted; prompts and context sent to the provider you chose	You
Usage	Pseudonymous product events (for example “backtest started”), no session recordings	The app
Technical	IP address, device and browser data, the bot check at sign-up (Cloudflare Turnstile), error reports	The app, our servers
Communications	Emails with us, feedback you send	You
Affiliates and referrals	Referral code, attribution, payout method and details (stored encrypted)	You, the site

We do not collect your broker password. We do not knowingly collect data from anyone under 18.

3. Why we use it, and on what basis

Purpose	Legal basis (EU/UK terms)
Provide the Service, connect your trading accounts, run what you start	Contract
Billing, plan limits, fraud and abuse prevention	Contract; legitimate interests; legal obligation
Security, error tracking, backups	Legitimate interests
Product analytics to improve the Service	Consent where required (the European Economic Area (EEA), United Kingdom, and Switzerland); legitimate interests elsewhere
Service emails (verification, receipts, plan changes)	Contract
Product update emails	Consent or legitimate interests; you can unsubscribe at any time
Affiliate and referral attribution	Consent where required; contract with affiliates
Tax and accounting records	Legal obligation

Where Vietnamese law applies (the Law on Personal Data Protection No. 91/2025/QH15, in force from 1 January 2026, and Decree 356/2025/NĐ-CP), we process your data with your consent given at sign-up and as the law otherwise allows.

Service providers who process data for us under contract: see Subprocessors.
The merchant of record for payments it processes as the seller.
Your AI provider, when you use Copilot AI with your key.
Authorities when the law requires it.

We do not sell your personal data.

5. International transfers

Our servers are in Singapore, and some providers are in the EU and the United States. Where data leaves your country, we rely on the safeguards the law requires (for example standard contractual clauses).

6. How long we keep it

Data	Kept
Account, content and trading-account data	Until you delete your account. You can cancel a deletion within 30 days; the data is then removed within 30 days
Backups	Rolled over within 30 days
Error reports and server logs	Up to 90 days
Product analytics events	Up to 12 months
Billing and tax records	As long as tax law requires

7. Your rights

Depending on where you live, you can:

access your data and export it (Settings → Profile & security → Export);
correct it;
delete your account and data (Settings);
object to processing or restrict it;
withdraw consent at any time (for example in the cookie settings or by unsubscribing);
complain to your data protection authority.

Write to [email protected] for anything else. We answer within 30 days.

8. Security

Passwords are hashed, keys and payout details are encrypted, connections use TLS, and access to production systems is restricted and logged. No system is perfectly secure; we tell you and the authorities about a breach as the law requires.

9. Changes

We will post changes here and tell you by email or in the app when a change is material.

10. Language

If a translation differs from the English version, the English version prevails.