Privacy & Cookie Policy

1. Data Controller

This Privacy & Cookie Policy explains how Trarity ApS processes personal data under GDPR Article 13 and applies cookie rules under the Danish Executive Order on Cookies (cookiebekendtgørelsen).

Controller: Trarity ApS, CVR 45834670, Øurgade 37, 4th, 2100 Copenhagen, Denmark. Email: info@trarity.com.

2. What Data We Collect, Why, and Legal Basis (GDPR Art. 6)

We only process personal data when we have a valid legal basis.

• Account data (email, name, password hash) to create and maintain your account. Legal basis: performance of a contract, GDPR Art. 6(1)(b).
• Billing profile (name, company, address, country, VAT/tax ID) and payment handling via Stripe for subscriptions and invoicing. Legal basis: contract, GDPR Art. 6(1)(b), and legal obligation, GDPR Art. 6(1)(c), including bookkeeping retention requirements under the Danish Bookkeeping Act.
• Trading data you import or sync (including MT5, NinjaTrader, ATAS, Tradovate, TradingView, Rithmic CSV, live sync), plus trade notes, labels, and screenshots, to provide core analytics features. Legal basis: contract, GDPR Art. 6(1)(b).
• AI Coach data (chat prompts and relevant trade history) sent to OpenAI to generate responses. Legal basis: contract, GDPR Art. 6(1)(b).
• Support communications when you contact us by email. Legal basis: contract, GDPR Art. 6(1)(b), and legitimate interest, GDPR Art. 6(1)(f), in operating support.
• Marketing emails only when you have given consent. You can withdraw consent at any time. Legal basis: consent, GDPR Art. 6(1)(a).
• Website and app analytics data on www.trarity.com and app.trarity.com, and on white-label partner domains running the platform, through Google Analytics via Google Tag Manager only after consent. These analytics are used for statistics only; advertising features and ad signals are not enabled. Legal basis: consent, GDPR Art. 6(1)(a).
• Affiliate referral attribution cookies when a visitor arrives via a ?ref= link: trarity_ref and trarity_vid (30 days) are set only after consent. Legal basis: consent, GDPR Art. 6(1)(a), where required under cookie rules.
• Affiliate referral click logs (hashed IP, user agent, landing URL, optional referral code metadata) to verify referral events and prevent abuse. No non-essential device storage is required for this server-side logging. Legal basis: legitimate interest, GDPR Art. 6(1)(f).
• Affiliate partner data (country, phone, Telegram handle, signed contract via Dropbox Sign) to manage partner relationships. Legal basis: contract, GDPR Art. 6(1)(b).
• Mentor/team data sharing within enabled features: mentors can view linked students' trading data; rule alerts may be sent via Telegram/Discord if configured by the mentor. Legal basis: contract, GDPR Art. 6(1)(b).
• Leaderboard and Discord display data only if you opt in to display. Legal basis: consent, GDPR Art. 6(1)(a).
• Trustpilot review invitations (email, name, user ID) shared with Trustpilot to send invitation emails. Legal basis: legitimate interest, GDPR Art. 6(1)(f). You have the right to object.

3. Aggregated Data and No Sale of Personal Data

We may use aggregated or anonymized statistics to improve service quality, product decisions, and system performance.

We do not sell personal data.

4. Recipients and Processors

We use processors and service providers that help us deliver the service:

• Hetzner Online GmbH (hosting and object storage, Germany/EU)
• Stripe (payments)
• Amazon Web Services SES (transactional email, EU region)
• Zoho Mail (email hosting for info@trarity.com, EU data center)
• OpenAI (AI Coach, AI market briefings, and AI-assisted trade analysis)
• Google (Analytics/Tag Manager on www.trarity.com, app.trarity.com, and white-label partner domains, with consent, for statistics only)
• YouTube (Google, privacy-enhanced mode) and Vimeo (embedded tutorial and course videos; loaded when those pages and players are used)
• Sentry (error monitoring)
• Trustpilot (review invitations)
• Dropbox Sign (affiliate contracts)
• Telegram and Discord (only when users or mentors enable those integrations)
• ATAS (only when the user connects trade sync)
• White-label partners (if you sign up via a partner-branded platform, that partner may access your data)

5. Artificial Intelligence (AI) and Transparency

Where we use AI features, we follow GDPR and the transparency obligations in Article 50 of the EU AI Act (Regulation (EU) 2024/1689), applicable from 2 August 2026.

• AI features and transparency: We use AI in AI Coach chat, AI market briefings, and AI-assisted trade analysis. Users are clearly informed when interacting with an AI system (AI Coach), and AI responses are marked as AI-generated.
• Data sent to AI provider: Depending on your request, this can include your question, conversation context, and relevant trade history or statistics. We send this data to provide the requested AI feature under GDPR Art. 6(1)(b) (performance of contract). Our AI provider acts as a processor. Data is sent via API and, according to the provider's API data usage terms, is not used to train their models. Processing may involve the United States and is protected by the safeguards described in Section 6 (DPF and/or SCCs, as applicable).
• No automated decisions with legal effects: We do not use AI for decisions with legal or similarly significant effects under GDPR Art. 22. AI output is informational only, not investment advice, may be inaccurate, and should be verified by you. No AI system used by Trarity is a high-risk system under the AI Act.
• AI content on our website: Blog articles are created with AI assistance, reviewed by our team, and labeled accordingly. Some images may be AI-generated. Team profile photos show real team members, and photos marked "AI" were enhanced with AI tools.

Questions about our AI use: info@trarity.com.

6. Transfers Outside the EU/EEA

Some providers are located in, or may process data from, the United States (including OpenAI, Google services such as Analytics/Tag Manager and YouTube, Vimeo, Stripe, Trustpilot, Sentry, Dropbox Sign, and AWS infrastructure components). When data is transferred outside the EU/EEA, we rely on appropriate safeguards such as the EU-U.S. Data Privacy Framework and/or the European Commission's Standard Contractual Clauses (SCCs), as applicable.

7. Retention

• Account data is stored while your account is active.
• After account deletion, personal data is deleted within 30 days, except where longer retention is required.
• Backups are retained on a rolling basis and normally overwritten within 6 months.
• Bookkeeping records are retained for 5 years as required by law.
• Affiliate cookies trarity_ref and trarity_vid, when consent is given, are stored for 30 days.
• Affiliate click logs are retained for 30 days for referral verification and fraud prevention.

8. Your Rights

Under GDPR, you may request access, rectification, erasure, restriction of processing, data portability, and you may object to processing based on legitimate interests.

You can withdraw consent at any time for consent-based processing (for example analytics cookies or marketing emails).

Practical controls: account deletion is available in-app under Settings (“Delete account”), and trade history can be exported as CSV for portability.

You also have the right to lodge a complaint with Datatilsynet (the Danish Data Protection Authority), and under GDPR Art. 77 you may also lodge a complaint with the supervisory authority in your EU country of habitual residence, place of work, or place of the alleged infringement.

Datatilsynet, Carl Jacobsens Vej 35, 2500 Valby, Denmark, dt@datatilsynet.dk, www.datatilsynet.dk.

9. Automated Decision-Making

We do not use automated decision-making that produces legal effects or similarly significant effects on individuals. AI Coach outputs are informational only and do not constitute financial, legal, or investment advice.

10. Security

We apply appropriate technical and organizational measures, including access controls, encryption in transit, infrastructure hardening, logging, and least-privilege operational practices, to protect personal data against unauthorized access, loss, or misuse.

11. Cookies and Similar Technologies

We use cookies and local storage to operate the website and app, measure traffic (with consent), and support affiliate attribution. Under Danish cookie rules, non-essential cookies require prior consent.

Google Analytics statistics cookies (_ga, _ga_*) may be used on www.trarity.com, app.trarity.com, and on white-label partner domains running the platform, only after consent. Google Tag Manager loads before consent to apply Consent Mode v2 defaults with all consent signals denied. Without consent, no analytics cookies are set; Google may still receive cookieless, aggregated Consent Mode signals, with no identifiers stored on your device. We do not use Google Analytics for advertising, and advertising consent signals remain denied.

Affiliate attribution cookies (trarity_ref, trarity_vid) are also non-essential and are set only after consent. Referral click logging to our server can still occur without setting non-essential cookies, based on legitimate interest, to support referral verification and fraud prevention.

Name	Provider	Purpose	Duration	Category
auth	Trarity	Authentication and login persistence	7 days	Strictly necessary
sid	Trarity	Session state	7 days	Strictly necessary
sso_nonce	Trarity	SSO login validation	10 minutes (only during SSO login)	Strictly necessary
cookie.consent.v1 (localStorage)	Trarity	Stores your consent choice	Until changed	Strictly necessary
_ga, _ga_*	Google Analytics (via Google Tag Manager)	Traffic and usage statistics (www.trarity.com, app.trarity.com, and white-label partner domains) only after consent	Up to 2 years	Statistics (consent required)
trarity_ref, trarity_vid	Trarity	Affiliate attribution (set only after consent)	30 days	Marketing/affiliate attribution (consent required)
Affiliate referral click log (server-side, no device storage)	Trarity	Referral verification and fraud prevention (hashed IP, user agent, landing URL, optional referral metadata)	30 days	Legitimate interest (GDPR Art. 6(1)(f))
Third-party media cookies	YouTube (youtube-nocookie.com), Vimeo	Embedded video playback	Set by provider	External media

Consent is stored per domain. Your choice on www.trarity.com and your choice on app.trarity.com are separate, and white-label partner domains keep their own separate consent record.

To change or withdraw your cookie consent on this website, use Cookie settings in the footer. In the app, use Settings → Cookie settings. This reopens your consent choice; if you reject, existing analytics and referral cookies are deleted.

12. Children

Our services are not intended for persons under 18 years of age, and we do not knowingly collect personal data from children under 18.

13. Changes and Contact

We may update this policy from time to time. Material changes will be communicated through the website or service where appropriate.

If you have questions about this policy or our personal data processing, contact info@trarity.com.