Privacy Policy

Privacy at Tracom

This Privacy Policy explains how Tobistech Ltd (Company No. 16037879), operating as Tracom Trading Journal ("we," "us," "our"), collects, uses, shares, and protects your personal information. We are committed to protecting your privacy and complying with global data protection laws including GDPR, UK GDPR, CCPA, and other applicable regulations.

🔒 We NEVER sell your personal data. Your trading information is yours alone.

1. Data Controller

Tobistech Ltd is the data controller responsible for your personal data processed through Tracom.

Registered Office: 82 King Street, Manchester, England, M2 4WQ

Company Number: 16037879

ICO Registration: Tobistech Ltd is confirming its ICO registration as a UK data controller under the Data Protection (Charges and Information) Regulations 2018. Our ICO registration number will be published here once confirmed. For enquiries about our data protection registration status, please contact dpo@tobistech.co.uk.

Contact: support@tobistech.co.uk

Data Protection Enquiries: dpo@tobistech.co.uk

2. Information We Collect

2.1 Account Information

Required Information:

Full name

Email address

Username

Password (encrypted)

Date of birth (age verification)

Country (for compliance)

Optional Information:

Phone number

Profile picture

Street address

City & Postal code

2.2 Trading Journal Data

Trade entries (symbols, prices, dates, notes)

Risk calculations and position sizes

Performance analytics and statistics

Custom tags and categories

Shared journal content (if you choose to share)

2.3 Payment & Subscription Data

Note: We use Stripe for payment processing. We do NOT store credit card numbers.

Stripe customer ID

Subscription status and dates

Payment history and amounts

Creator payout information (if applicable)

2.4 Technical & Usage Data

IP addresses (for security and fraud prevention)

Device information and identifiers

App usage statistics and crash reports

Login times and session data

Push notification tokens

Timezone, locale, and currency preferences

2.5 Social Login Data (If Used)

If you sign in using social providers, we receive:

Basic profile info (name, email, profile picture)

Provider user ID (Google ID or Apple ID)

3. How We Use Your Information

Purpose	Legal Basis (GDPR)
Provide trading journal services	Contract performance
AI feature generation (trade ideas, commentary and insights - data sent to third-party AI providers)	Contract performance (Premium subscribers); Legitimate interest (free users with limited AI access, subject to your right to object - see Section 5)
Process payments and subscriptions	Contract performance
Send service notifications	Contract performance
Customer support	Legitimate interest
Marketing communications	Consent
Improve app features	Legitimate interest
Security and fraud prevention	Legitimate interest
Comply with legal requirements	Legal obligation

Where we rely on legitimate interests, we have carried out documented balancing assessments and concluded our interests are not overridden by your rights. You have the right to object to such processing at any time - see Section 5.

Data collected for one of the purposes above will not be further processed for a different purpose that is incompatible with the original purpose without your prior notice or consent (UK GDPR Art. 5(1)(b)).

Important: We NEVER use your trading data for our own trading purposes or share it with third parties for trading purposes. Your strategies and trades remain confidential.

4. How We Share Your Information

🔒 We NEVER sell, rent, or trade your personal information.

We only share your data in these limited circumstances:

4.1 Service Providers

Stripe

Payment processing (PCI-DSS compliant)

AWS (Amazon Web Services)

Cloud hosting and data storage (Virginia, USA)

SendGrid/Email Provider

Transactional emails and notifications

Tracom In-App Analytics (First-Party)

Subscription and paywall interaction events (e.g., paywall viewed, plan selected) are recorded to Tracom's own backend servers. No trade data, journal content, or personally identifying information is included in these events. Processed on the basis of our legitimate interest in understanding how users interact with the subscription flow and improving the service. You may object to this processing at any time by contacting us.

Firebase / Analytics Providers

Aggregated usage statistics, app performance monitoring and crash reports, linked to pseudonymous device identifiers. Only enabled with your prior consent where required by applicable law.

AI Processing Providers

Third-party AI model providers used to generate trade ideas, market commentary and insights. Only the minimum data necessary to generate the requested output is shared (e.g., user prompts or trade context, which are minimised and pseudonymised or aggregated where practicable). Data shared is governed by applicable Data Processing Agreements.

4.2 Your Public Sharing

When you choose to share journals publicly or with subscribers, that content becomes visible to those users. You control what to share.

4.3 Legal Requirements

We may disclose data when required by law, such as:

Court orders or legal processes

Asserting, exercising or defending our legal rights in connection with actual or threatened legal proceedings or regulatory investigations

Prevention of fraud or security threats

Protection of public safety

5. Your Privacy Rights

Depending on your location, you have specific rights regarding your personal data:

🇪🇺 European Union & UK (GDPR/UK GDPR)

Access: Request a copy of your personal data

Rectification: Correct inaccurate information

Erasure: Request deletion ("right to be forgotten")

Portability: Receive data in machine-readable format

Restriction: Limit processing of your data

Object (Art. 21 GDPR): Object to processing based on our legitimate interests, including analytics and profiling. We must stop unless we have compelling legitimate grounds that override your interests. You may object to direct marketing at any time - this is an absolute right with no override.

Withdraw Consent: Any time for consent-based processing, without affecting the lawfulness of processing before withdrawal

Supervisory Authority: You may lodge a complaint with the UK ICO (ico.org.uk) or your local data protection authority.

Automated Decision-Making (Art. 22 UK GDPR / GDPR)

Tracom's AI features generate trade ideas, market commentary and educational outputs for your review. You retain full control over all trading decisions. We do not make solely automated decisions about you that produce legal or similarly significant effects within the meaning of Article 22 of the UK GDPR or GDPR.

If you believe any automated process has affected you in a significant way, or if you would like a human review of any AI-generated output applied to your account, please contact us at dpo@tobistech.co.uk.

🇺🇸 California (CCPA/CPRA)

Know: What personal information we collect and how we use it

Delete: Request deletion of your personal information

Opt-Out: We don't sell data, but you can opt-out of sharing

Non-Discrimination: Equal service regardless of privacy choices

Correct: Update inaccurate personal information

Limit: Restrict use of sensitive personal information

How to Exercise Your Rights

📧 Email: privacy@tobistech.co.uk

⏱️ Response Time: Within 30 days

We may verify your identity for security purposes before processing requests.

6. How We Protect Your Data

We implement industry-standard security measures to protect your personal information:

Technical Measures

• 256-bit SSL/TLS encryption

• Encrypted database storage

• Secure AWS infrastructure

• Regular security audits

Operational Measures

• Access controls & authentication

• Regular backups

• Incident response procedures

• Staff training & NDAs

Note: While we use best practices, no internet transmission is 100% secure. Please use strong passwords and protect your account credentials.

Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will:

Notify the Information Commissioner's Office (ICO) within 72 hours of becoming aware of the breach, where required under UK GDPR Art. 33

Notify you personally without undue delay where the breach is likely to result in a high risk to your rights and freedoms (UK GDPR Art. 34)

Maintain an internal breach register for accountability purposes

Take immediate steps to contain the breach, assess its impact, and prevent recurrence

If you suspect your account has been compromised, please contact us immediately at support@tobistech.co.uk.

7. International Data Transfers

Your data may be transferred and processed internationally:

Primary Data Location:

🇺🇸 United States (AWS Virginia) - Main servers

🇬🇧 United Kingdom - Company headquarters

Safeguards for International Transfers:

Standard Contractual Clauses (SCCs) for EU-US transfers

UK International Data Transfer Agreement (IDTA)

Appropriate technical and organizational measures

Data Processing Agreements with all processors

Transfers to the United States are made under the UK International Data Transfer Agreement (IDTA) and/or Standard Contractual Clauses (SCCs) executed with our processors, as required by UK GDPR Art. 46. These are the applicable transfer mechanisms; no separate consent to the transfer is required or sought.

8. Cookies and Tracking

The Tracom mobile app and our marketing website use different technologies. Here is how each works:

📱 Tracom Mobile App (iOS & Android)

The Tracom mobile app does not use browser cookies. Instead, it uses:

Secure device storage

Stores authentication tokens and user preferences (theme, currency, notifications) locally on your device.

Analytics SDKs (e.g. Firebase)

Used for app performance monitoring and crash reporting. These are non-essential and are only enabled with your prior consent where required by applicable law.

🌐 Tracom Marketing Website

Our marketing website uses browser cookies. Non-essential website cookies (analytics and advertising) are only placed with your prior consent, obtained through our website consent mechanism. Essential cookies required for authentication and site security are used on the basis of our legitimate interest in providing a working service and cannot be disabled without affecting core functionality.

To review, manage, or withdraw your website cookie consent at any time, please see our Cookie Policy.

9. How Long We Keep Your Data

Data Type	Retention Period
Account information	Until account deletion + 30 days
Trading journals	Until you delete them
Payment records	7 years (legal requirement)
Support communications	2 years
Security logs	1 year
Marketing preferences	Until withdrawn

Account Deletion: You can request account deletion anytime. We'll delete your data within 30 days, except where legal retention is required.

10. Children's Privacy

Age Restriction: Tracom is NOT for users under 18 years old.

We do not knowingly collect data from minors. If we discover a user is under 18, we will immediately:

Terminate the account

Delete all associated data

Notify the user if possible

If you believe a minor is using Tracom, please contact us immediately at safety@tobistech.co.uk

11. California Privacy Rights (CCPA)

Categories of Information We Collect:

• Identifiers (name, email, IP address)

• Commercial information (subscription history)

• Internet activity (app usage)

• Geolocation data (country/region)

• Professional information (trading data)

Your California Rights:

✅ We DO NOT sell personal information

✅ We do not share personal information for cross-context behavioral advertising

✅ You can request data deletion anytime

✅ You can access your data via app settings

California - Right to Opt Out of Sharing (CPRA): If we begin sharing your personal information for cross-context behavioral advertising in the future, you will be able to opt out at any time by emailing privacy@tobistech.co.uk with the subject line "California - Do Not Share". We will process your opt-out request within 15 business days as required by the CPRA.

To exercise your other California privacy rights, email: privacy@tobistech.co.uk with "California Privacy Rights" in the subject.

12. Changes to This Policy

We may update this Privacy Policy to reflect changes in our practices or legal requirements.

When we make changes:

Update the "Last Updated" date

Notify you via email at least 30 days before material changes take effect

Post in-app notifications at least 30 days before material changes take effect

Request new consent if required

For material changes to the way we process your personal data, we will seek your active acknowledgement before those changes apply to your data. If you do not accept a material change, you may request deletion of your account. Continued use after non-material changes take effect constitutes acceptance of those changes.

13. Contact Us

For privacy questions, requests, or concerns:

Data Protection Enquiries

📧 dpo@tobistech.co.uk

For data subject rights requests, GDPR inquiries and formal data protection matters

General Privacy Inquiries

📧 privacy@tobistech.co.uk

For general privacy questions and account data requests

Postal Address

Tobistech Ltd, 82 King Street, Manchester, England, M2 4WQ, United Kingdom

Response Times

⏱️ General inquiries: 5 business days

⏱️ Data requests: 30 days (as required by law)

⏱️ Urgent security issues: 24 hours

Supervisory Authorities

If you're not satisfied with our response, you may contact:

🇬🇧 United Kingdom

Information Commissioner's Office (ICO)

ico.org.uk

🇪🇺 European Union

Your local data protection authority

edpb.europa.eu