[BRACKETED]
placeholder and have it reviewed by a qualified lawyer for your jurisdiction before launch. On white-label
(author) domains, define who is the data controller vs processor (typically the author is
the controller of their customers' data; Karnek the processor) — that needs legal input.
Privacy Policy
Last updated: [DATE]
Who we are
Karnek is operated by [COMPANY LEGAL NAME] ("we", "us"), [COMPANY ADDRESS]. For any privacy question or to exercise your rights, contact [PRIVACY CONTACT EMAIL].
What we collect
- Account details — your name, email, and a securely hashed password.
- Trading metrics — from the MetaTrader accounts you connect, we receive balances, equity, open/closed trades, and derived statistics. The connector is read-only and never trades. For passwordless monitoring we never receive your trading password; where you choose investor-password monitoring, that password is encrypted at rest.
- Billing — handled by our payment processor (Stripe); we store subscription status, not your full card details.
- Technical — IP address, timestamps, and an essential session cookie needed to keep you logged in. We do not use advertising or third-party tracking cookies.
Why we use it (legal basis)
To provide the monitoring service you signed up for (performance of a contract), to send the alerts and reports you configure, to take payment, and to keep the service secure (legitimate interests).
Who we share it with
We do not sell your data. We use a small number of processors strictly to run the service: [HOSTING PROVIDER] (infrastructure) and Stripe (payments). Where you use a white-label (author-branded) portal, your data is visible to that author, who provides the service to you.
How long we keep it
While your account is active. After you cancel, we retain data for up to [90 days] to allow reactivation, then delete or anonymise it. You can request earlier deletion at any time (see below).
Your rights
Subject to applicable law (including the GDPR/UK GDPR), you may request to access, correct, export, or delete your data, or object to/restrict certain processing. Email [PRIVACY CONTACT EMAIL] and we will respond within the statutory time limit. You also have the right to complain to your data-protection authority (e.g. the [ICO / your DPA]).
Security
Data is encrypted in transit (TLS) and each tenant's data is isolated at the database level (row-level security). Sensitive credentials are encrypted at rest.
International transfers
Our infrastructure is located in [REGION]. Where data is transferred outside your region, we rely on [SAFEGUARD — e.g. Standard Contractual Clauses].
Changes
We will post any changes here and update the date above.