Privacy Policy

Privacy Policy

This Privacy Policy explains how TotalTrade processes personal data when you visit totaltrade.ai, use app.totaltrade.ai, create an account, purchase a plan, contact support or use connected features.

The data controller is Daniel Totò, Località Comune 109, 52046 Lucignano (AR), Italy, VAT No. 02453620516, Italian Tax Code TTODNL00D20F592R. For privacy requests: support@totaltrade.ai; certified email blastrade@pec.it.

1. Scope and key principles

We process personal data lawfully, fairly and transparently, limit collection to what is relevant for stated purposes, apply proportionate security measures and retain data only for as long as necessary or legally required. This Policy applies to the website, application, support channels and related TotalTrade services.

2. Categories of personal data

• Identity and contact data, such as name, email address, account identifier, profile details and authentication information.
• Technical and usage data, including IP address, device, browser, operating system, session and security logs, visited pages, interactions and consent choices.
• Support and live-chat data, including messages, attachments, timestamps, delivery or read status, the email address provided for follow-up and information required to resolve a request.
• Learning data, such as viewed educational content, progress, saved items and profile-related learning information.
• Journal and Backtester data, including strategies, notes, configurations, simulations, results, statistics and user-provided files.
• MT5, cTrader and CSV data, which may include trades, account and broker identifiers, server, balance, equity, open, closed or pending positions, symbols, comments, magic number, sessions and derived statistics.
• Payment and subscription data, such as plan, status, transaction references, billing country and limited payment information supplied by the payment provider. TotalTrade does not normally receive complete card details.
• Affiliate Programme data, including application and profile details, codes or coupons, attributed referrals, commissions and payout details.
• Feedback Hub submissions, votes and technical identifiers used to moderate requests and limit duplicate votes.

3. Sources of data

We receive data directly from you, from your use of the Service, from accounts or files you choose to connect or import, and from service providers acting on our behalf. If you provide data concerning another person, you must have a lawful basis and authority to do so.

4. Purposes and legal bases

• Provide the Service, create and secure accounts, authenticate users, manage profiles, subscriptions and payments, and perform the contract or pre-contractual measures you request.
• Operate educational content, Journal, Backtester, imports, analytics and integrations requested by the user, on the basis of contract performance.
• Respond to support and live-chat requests, including automatically delivering replies that remain unread after you leave the website, prevent abuse, investigate incidents and protect the platform and users, based on contract performance and legitimate interests in service quality and security.
• Comply with accounting, tax, consumer, regulatory and legal obligations and establish, exercise or defend legal claims.
• Measure service performance, create aggregated internal statistics and improve usability, based on legitimate interests where permitted or on consent when tracking technologies require it.
• With your consent, send TotalTrade newsletters, news, offers, discounts and promotional messages, including account lifecycle sequences. Where specifically explained and consented to, tailor timing and content using relevant plan, account status and Service usage data. For Free users, promotional processing relies on consent, not contract performance or legitimate interests.
• Manage Affiliate Programme applications, attribution, commissions and payouts, and operate the Feedback Hub.

5. Authentication and connected accounts

Authentication may be provided by Clerk and, if selected, Google OAuth through Clerk. Data may include name, email, profile image, provider identifiers, authentication events, session tokens, IP address, device and browser information. Authentication is necessary to create and protect the account. Your use of an external sign-in provider is also subject to that provider’s privacy terms.

6. Service providers and recipients

We share personal data only where necessary with processors, independent controllers or partners that support the requested service, under appropriate contractual and security arrangements.

• Clerk for identity, authentication and session management, and Google when you choose Google OAuth.
• Cloudflare, including Email Sending for transactional unread support replies, Vercel and other hosting, infrastructure, storage, content-delivery, monitoring and security providers used by the Service.
• Stripe or another disclosed payment provider for checkout, subscriptions, fraud prevention, refunds and financial compliance.
• Amazon Web Services (AWS): Amazon SES for email sending and SNS/SQS for delivery events and permitted engagement events. The verified SES/SNS/SQS configuration uses eu-north-1; this does not exclude transfers or other provider processing described in the international transfers section. Hostinger no longer sends newsletter campaigns.
• Cloudflare Workers/D1 for subscriptions, orchestration, preferences, suppression lists, unsubscribe and technical records. These providers may process email, internal identifier, name, message content, sending/delivery status, bounce, complaint, unsubscribe and consented engagement under their agreements and the controller’s instructions. Cloudflare Email Sending continues to deliver transactional withdrawal and unread support replies. Customer campaigns and automations operate only when relevant, verifiable consent is available.
• Referly for the Affiliate Programme portal, codes or coupons and attribution connected to Stripe; PayPal may process affiliate payouts.
• Providers supporting educational content, support, email, analytics, connected trading accounts, imports and market or reference data.
• Google Analytics 4 (totaltrade.ai) only after Analytics consent, Google Ads (totaltrade.ai) and Meta Pixel only after Marketing consent, and external-content providers such as YouTube when the relevant content is activated.
• Authorities, advisers or counterparties where disclosure is legally required or necessary to protect rights, security and legitimate interests.

7. International transfers

Some providers may process data outside the European Economic Area. Where required, transfers rely on an adequacy decision, the EU–US Data Privacy Framework for eligible certified recipients, Standard Contractual Clauses supplemented where appropriate, or another safeguard or lawful derogation under Chapter V of the GDPR.

8. Retention periods

• Direct marketing and promotional automation data is used while relevant consent remains valid and only as long as needed for the stated purpose. Withdrawal or unsubscribe stops future promotions and related marketing profiling. An email address may remain on a suppression list as necessary to honour the request. Minimal consent, withdrawal and compliance evidence may be retained for applicable obligations and rights protection, then deleted or anonymised. Subscription alone does not justify indefinite retention of activity or engagement data.
• Chat history and attachments are retained for the time needed to resolve the request and document support, taking into account the status of the case, security needs, disputes and legal obligations.
• The chat copy on your device is valid for 30 days from its last update and is removed on your next visit after expiry. You can delete it at any time through your browser settings.
• Learning data: for the life of the account or until deletion or inactivity rules apply.
• MT5 and cTrader data: until you remove the relevant session or request deletion, subject to technical backups and legal needs.
• CSV, Journal and Backtester data: while needed to provide the requested function or until you delete it or the account.
• Payment, invoice and accounting data: for the period required by tax, accounting and anti-fraud law.
• Account data: until account deletion, followed by limited retention where required for legal obligations, security or claims.
• Security logs: for a proportionate period based on incident-prevention and investigation needs.
• Analytics and consent records: according to the Cookie Policy, tool configuration and applicable law.

9. Security

We use technical and organisational measures designed to protect personal data against unauthorised access, alteration, disclosure, loss and destruction. No online system is completely risk-free. You must keep credentials confidential, use secure devices and notify us promptly of suspected compromise.

10. Your rights

Subject to the conditions of the GDPR and applicable law, you may request access, rectification, erasure, restriction, portability and objection; withdraw consent at any time without affecting prior lawful processing; and object to direct marketing at any time. You also have the right to lodge a complaint with the Italian Data Protection Authority or the competent authority in your country.

• Send requests to support@totaltrade.ai and provide enough information to identify the account and request.
• We may request reasonable proof of identity and may refuse or charge for manifestly unfounded or excessive requests where the law permits.
• We will respond within the legally applicable period and explain any justified extension or refusal.

11. Automated decision-making

TotalTrade does not ordinarily make decisions based solely on automated processing that produce legal or similarly significant effects. Analytics, scores and classifications support the user and do not replace independent decision-making. If this changes, the required information and safeguards will be provided.

12. Cookies and similar technologies

The website and app use cookies and similar technologies as described in the Cookie Policy. After Marketing consent, Meta Pixel may receive page URLs, funnel interactions, online identifiers, IP address and device or browser information for campaign measurement, conversion attribution and audience creation. TotalTrade does not send names, email addresses or phone numbers to Meta through the Pixel in the current configuration. You may change your choices through the cookie settings available in the footer.

13. Children

The Service is reserved for people aged 18 or over. If you believe a minor has provided personal data, contact us so that we can assess and remove it where appropriate.

14. Changes and contact

We may update this Policy to reflect changes in law, technology or processing activities. The latest revision date appears above, and material changes will be communicated through reasonable channels. For questions or to exercise your rights, contact support@totaltrade.ai.

15. Support with TotalAI

When TotalAI is active, OpenAI processes your message text and the conversation context needed for a reply. Cloudflare provides infrastructure and searches official content; this search may use your question and a short context. We do not add contact fields, login credentials or attachments to the data sent to OpenAI. Personal information you write in a message may be processed as part of that text: avoid sending passwords, API keys, payment details or unnecessary sensitive information.

We use this data to provide the support you request, on the basis of contract performance or pre-contractual measures requested by you (Article 6(1)(b) GDPR). Security and quality checks rely on the controller’s legitimate interest in protecting the service and checking answer accuracy (Article 6(1)(f) GDPR). Chat replies do not make decisions about your account with legal or similarly significant effects.

Answer ratings and comments are optional. The team may review them with the relevant messages to correct errors and improve support information. A rating or comment does not trigger automatic model training and is not published in the assistant’s knowledge base. You may object to processing based on legitimate interests under the conditions set out in the GDPR.

OpenAI processes data on our behalf under its API service terms and data processing agreement. API data is not used to train OpenAI models by default. API response storage is disabled; OpenAI may still retain abuse prevention logs, normally for up to 30 days, subject to legal obligations or other provider exceptions.

Working copies of AI support records, translations and feedback are normally retained for 90 days from their last update. Material needed for an open request remains available until it is resolved. Chat history and attachments follow the retention criteria in this Policy; minimal technical records needed to document support, costs and security may be retained for their respective purposes.

These providers may process data outside the European Economic Area, including in the United States. OpenAI’s data processing agreement provides for standard contractual clauses or adequacy decisions for applicable transfers; safeguards for other providers are described in the international transfers section. For information about safeguards, to exercise your rights or to request human support, contact support@totaltrade.ai.

16. Email marketing, newsletters and promotional automations

Users who provide the relevant consent may be segmented by plan, account status, registration, trial, purchase, renewal, cancellation and activity or inactivity to select relevant promotions. Withdrawal also stops promotional use of the profile. Technical and functional Service analytics remain separate. This processing does not produce solely automated decisions with legal or similarly significant effects under Article 22 GDPR.

With prior, optional and unticked consent, TotalTrade may email newsletters, news, offers, discounts and promotions through sequences linked to registration, plan, trial, purchase, renewal, subscription end or, where applicable, app activity or inactivity. Refusing marketing does not prevent registration, the Free plan or otherwise available functions. Acknowledging the Privacy Policy is not marketing consent. Sending and related segmentation rely on Article 6(1)(a) GDPR and applicable electronic communications rules, including Article 130 of the Italian Privacy Code.

Emails may contain open pixels and tracked links with optional, informed, unticked consent covering promotional email and individual open/click measurement. These record when a recipient opens a message or follows a link, to measure effectiveness and, where explained, personalise subsequent messages. One choice may cover both purposes when its wording explains both clearly. You can later turn off measurement alone while continuing to receive untracked email, or unsubscribe from all promotions. Having an account or granting cookie Marketing consent does not authorise email tracking.

Every promotional email offers a simple, free unsubscribe. It stops all future TotalTrade promotions, marketing automations and related profiling. Withdrawing tracking consent alone stops measurement; untracked email may continue if sending consent remains valid. Sending, delivery, bounce, complaint and unsubscribe logs are separate from engagement tracking and are processed for delivery, security, respecting preferences and compliance on the legal bases applicable to those purposes.

Strictly necessary account, payment, security, support and contractual messages remain separate and continue after a marketing optout; this does not authorise adding promotional content without consent. Later app or Stripe imports do not cancel an unsubscribe. Resubscription requires a new, verifiable positive user action, and old consent records are never rewritten retroactively. Contact support@totaltrade.ai to exercise your rights or withdraw a specific consent.

• Marketing and email tracking preferences and evidence: status, date and time, text and policy version, source, language and withdrawal. IP addresses are not collected specifically to prove these consents; separate security processing remains as described in this Policy.
• Relevant lifecycle data: registration date, plan, Free/trial/subscription status, purchase, renewal, cancellation and app activity or inactivity. Trading operation data is not used for this purpose.
• Technical email logs: sending, delivery, bounce, spam complaint and unsubscribe; individual opens and clicks only with the specific required consent.