Privacy Policy
Last updated: 4 October 2026
Who we are
Karnek is operated by Stanchion Systems Ltd, trading as Karnek , a company registered in England and Wales (company number 17287154), whose registered office is at 66 Paul Street, London, England, EC2A 4NA. We are the data controller for the personal data described below. For any privacy question or to exercise your rights, contact [email protected].
What we collect
- Account details: your name, email, and a securely hashed password.
- Trading metrics: from the MetaTrader accounts you connect, we receive balances, equity, open and closed trades, and derived statistics. The connector is read-only and never trades. For passwordless monitoring we never receive your trading password; where you choose investor-password monitoring, that password is encrypted at rest.
- Billing: handled by our payment processor (Stripe), or by Apple for purchases in the iPhone app; we store subscription status, not your full card details.
- Notifications: if you turn on push notifications in the mobile app, a device token so we can deliver your alerts. If you link Telegram, the chat you choose for alerts.
- Technical: IP address, timestamps, and an essential session cookie needed to keep you logged in. We do not use advertising cookies. We use Google Analytics to measure traffic on our website and web app only if you accept it in our cookie banner, and we remove account numbers and other identifying parts of page addresses before anything is sent.
Why we use it (legal basis)
To provide the monitoring service you signed up for (performance of a contract), to send the alerts and reports you configure, to take payment, and to keep the service secure, including keeping the free trial to one per person (legitimate interests). Analytics cookies are used only with your consent, which you can withdraw at any time.
Who we share it with
We do not sell your data. We use a small number of processors strictly to run the service:
- 20i, hosting, with servers in the United Kingdom
- Cloudflare, network delivery and security
- Stripe, payments
- Apple, App Store payments
- Postmark, email delivery, including your alerts and reports
- Expo, together with Apple and Google push notification services, to deliver alerts to the mobile app when you turn them on
- Telegram, only if you link it to receive alerts
- Google Analytics, only if you accept analytics cookies
Where you use a white-label (author-branded) portal, your data is visible to that author, who provides the service to you.
How long we keep it
We keep your data while your account exists. When you delete your account, your data is removed as described on our account deletion page, except records we are legally required to keep, such as invoices, which we keep only for as long as the law requires. You can also ask us to delete specific data at any time (see below).
To keep the free trial to one per person, we keep a scrambled code made from each trading account number and server you connect, and from the payment method you subscribe with (for a card, a reference from Stripe, never the card number). A code cannot be turned back into the number, and we use these codes only to check whether a free trial has already been used, so we keep them after you delete an account or your workspace. We may also compare the internet address you sign up from with earlier sign ups; on its own, that never stops anyone signing up.
Your rights
Subject to applicable law (including the UK GDPR and the GDPR), you may request to access, correct, export, or delete your data, or object to or restrict certain processing. Email [email protected] and we will respond within the statutory time limit. You also have the right to complain to a data protection authority. In the United Kingdom that is the Information Commissioner's Office (ICO), at ico.org.uk.
Security
Data is encrypted in transit (TLS) and each tenant's data is isolated at the database level (row-level security). Sensitive credentials are encrypted at rest.
International transfers
Our servers are located in the United Kingdom. Some of the service providers listed above may process data outside the United Kingdom. Where that happens, we rely on the safeguards required by UK data protection law. Contact us if you would like more information about these safeguards.
Changes
We will post any changes here and update the date above.