Privacy Policy

This Privacy Policy explains what personal data we collect when you use NexumTrader (the "Service") and our website, how we use it, who we share it with, and the rights you have. We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and applicable German data protection law.

1. Data controller

The controller responsible for processing your personal data is:

Ohrlaf GmbH, Reichholz 1, 87634 Obergünzburg, Germany. Email: hello@nexumtrader.com. Full provider details are in our Legal Notice.

2. Data we collect

• Account data: your email address and authentication details when you register.
• Subscription and billing data: your plan, billing status, and transaction records. Card and payment details are collected and processed directly by our payment provider, Stripe, and are never stored on our servers.
• Configuration data: the trading accounts, credentials, webhooks, and routing settings you add so the Service can operate. Connected account credentials are stored in encrypted form.
• Signal and activity data: the trading signals you send and the routing and execution records the Service produces.
• Usage and technical data: log data, IP address, device and browser information, and diagnostics used to operate, secure, and improve the Service.
• Support data: the information you provide when you contact us or use the in-app support assistant.

3. How we use your data and legal bases

We process your data for the following purposes:

• To provide the Service (routing your signals, managing your account and configuration). Legal basis: performance of our contract with you (Art. 6(1)(b) GDPR).
• To process subscriptions and payments through Stripe. Legal basis: performance of contract and compliance with legal obligations (Art. 6(1)(b) and (c) GDPR).
• To provide support and respond to your requests. Legal basis: performance of contract and our legitimate interests (Art. 6(1)(b) and (f) GDPR).
• To secure the Service, prevent abuse and fraud, and keep it reliable. Legal basis: our legitimate interests (Art. 6(1)(f) GDPR).
• To meet legal, accounting, and tax obligations. Legal basis: compliance with legal obligations (Art. 6(1)(c) GDPR).
• To improve features and reliability using aggregated or de-identified usage data. Legal basis: our legitimate interests (Art. 6(1)(f) GDPR).

4. Service providers and recipients

We do not sell your personal data. We share it only with service providers (processors) who process it on our behalf under data processing agreements, and only as needed to run the Service:

• Supabase — authentication and database hosting, including storage of your account and encrypted configuration data.
• Vercel — website and application hosting, database, and privacy-friendly usage analytics.
• Google (Google Ireland Limited): Google Analytics 4 and Google Ads, used to measure how the site is used and which advertising brings visitors here. Only active if you consent to the analytics or marketing categories.
• Stripe (Stripe Payments Europe, Limited) — payment processing and Merchant of Record for subscriptions; Stripe acts as an independent controller for the payment data it collects.
• Plunk — sending transactional and service-related emails.

We may also disclose data where required by law or to protect our rights, and to a successor entity in connection with a merger, acquisition, or reorganization.

5. Cookies and analytics

We use a small number of strictly necessary cookies to keep you signed in, to operate the Service, and to remember your cookie choice. These are required for the Service to function and are set without consent, as the law allows.

Everything else is optional and off until you turn it on. When you first visit, a banner asks you to choose:

Category	What it does	Cookies
Strictly necessary	Signs you in, runs the Service, remembers this choice. Always on.	nt_consent, session cookies
Analytics	Google Analytics 4, so we can see how pages are found and used.	_ga, _ga_*
Marketing	Google Ads, so we can measure which advertising brings visitors here.	_gcl_*

We also use Vercel Analytics on the website and in the app. It is cookieless, collects no personal data, and cannot track you across websites or build an advertising profile, so it runs under the strictly necessary category and is not part of the choice above.

Google Analytics and Google Ads run under Google Consent Mode. Until you consent, they are loaded in a state where they set no cookies and cannot identify you. If you decline, they stay in that state.

Your choice is stored in the nt_consent cookie for six months and applies to both nexumtrader.com and the app, so you only answer once. You can change or withdraw it at any time using the Cookie settings link in the footer of any page. Withdrawing takes effect immediately and does not affect the lawfulness of processing that happened before.

6. International transfers

Some of our service providers may process data in countries outside the European Economic Area. Where that is the case, we rely on appropriate safeguards recognised under the GDPR, such as the European Commission's standard contractual clauses, to ensure your data receives an adequate level of protection.

7. Retention

We keep your personal data for as long as your account is active and as needed to provide the Service. After that, we retain data only as long as necessary to comply with legal, accounting, or tax obligations, to resolve disputes, and to enforce our agreements, after which it is deleted or anonymised.

8. Your rights

Subject to the conditions in the GDPR, you have the right to access your personal data, to have it corrected or deleted, to restrict or object to its processing, to data portability, and to withdraw any consent you have given, without affecting processing carried out before withdrawal. To exercise these rights, contact us at support@nexumtrader.com. You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the EU member state of your residence, place of work, or the place of the alleged infringement.

9. Security

We use appropriate technical and organizational measures to protect your data, including encryption of sensitive credentials, access controls, and secure infrastructure. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

10. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be communicated by reasonable means, and the "last updated" date above will always reflect the current version.

11. Contact

For any privacy question or to exercise your rights, contact us at support@nexumtrader.com, or see our Legal Notice.