Privacy Policy

This Privacy Policy explains what personal data we collect when you use NexumTrader (the "Service") and our website, how we use it, who we share it with, and the rights you have. We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and applicable German data protection law.

1. Data controller

The controller responsible for processing your personal data is:

Ohrlaf GmbH, Reichholz 1, 87634 Obergünzburg, Germany. Email: hello@nexumtrader.com. Full provider details are in our Legal Notice.

2. Data we collect

• Account data: your email address and authentication details when you register.
• Subscription and billing data: your plan, billing status, and transaction records. Card and payment details are collected and processed directly by our payment provider, Stripe, and are never stored on our servers.
• Configuration data: the trading accounts, credentials, webhooks, and routing settings you add so the Service can operate. Connected account credentials are stored in encrypted form.
• Signal and activity data: the trading signals you send and the routing and execution records the Service produces.
• Usage and technical data: log data, IP address, device and browser information, and diagnostics used to operate, secure, and improve the Service.
• Support data: the information you provide when you contact us or use the in-app support assistant.

3. How we use your data and legal bases

We process your data for the following purposes:

• To provide the Service (routing your signals, managing your account and configuration). Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR).
• To process subscriptions and payments through Stripe. Legal basis: performance of contract and compliance with legal obligations (Art. 6(1)(b) and (c) GDPR).
• To provide support and respond to your requests. Legal basis: performance of contract and our legitimate interests (Art. 6(1)(b) and (f) GDPR).
• To secure the Service, prevent abuse and fraud, and keep it reliable. Legal basis: our legitimate interests (Art. 6(1)(f) GDPR).
• To meet legal, accounting, and tax obligations. Legal basis: compliance with legal obligations (Art. 6(1)(c) GDPR).
• To improve features and reliability using aggregated or de-identified usage data. Legal basis: our legitimate interests (Art. 6(1)(f) GDPR).

4. Service providers and recipients

We do not sell your personal data. We share it only with service providers (processors) who process it on our behalf under data processing agreements, and only as needed to run the Service:

• Supabase — authentication and database hosting, including storage of your account and encrypted configuration data.
• Vercel — website and application hosting, database, and privacy-friendly usage analytics.
• Stripe (Stripe Payments Europe, Limited) — payment processing and Merchant of Record for subscriptions; Stripe acts as an independent controller for the payment data it collects.
• Plunk — sending transactional and service-related emails.

We may also disclose data where required by law or to protect our rights, and to a successor entity in connection with a merger, acquisition, or reorganization.

5. Cookies and analytics

We use a small number of strictly necessary cookies to keep you signed in and to operate the Service; these are required for the Service to function. On our website we use Vercel Analytics to understand aggregate traffic and performance. It is designed to be privacy-friendly and does not use analytics cookies to track you across websites or build advertising profiles. We do not use advertising cookies.

6. International transfers

Some of our service providers may process data in countries outside the European Economic Area. Where that is the case, we rely on appropriate safeguards recognised under the GDPR, such as the European Commission's standard contractual clauses, to ensure your data receives an adequate level of protection.

7. Retention

We keep your personal data for as long as your account is active and as needed to provide the Service. After that, we retain data only as long as necessary to comply with legal, accounting, or tax obligations, to resolve disputes, and to enforce our agreements, after which it is deleted or anonymised.

8. Your rights

Subject to the conditions in the GDPR, you have the right to access your personal data, to have it corrected or deleted, to restrict or object to its processing, to data portability, and to withdraw any consent you have given, without affecting processing carried out before withdrawal. To exercise these rights, contact us at support@nexumtrader.com. You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state of your residence, place of work, or the place of the alleged infringement.

9. Security

We use appropriate technical and organizational measures to protect your data, including encryption of sensitive credentials, access controls, and secure infrastructure. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

10. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be communicated by reasonable means, and the "last updated" date above will always reflect the current version.

11. Contact

For any privacy question or to exercise your rights, contact us at support@nexumtrader.com, or see our Legal Notice.