1. Data Controller
Kristian Kovac, Am Grimnitzsee 3, 16247 Althüttendorf, Germany
Email: info@ngutrading.com
2. What Data We Collect
We collect and process the following personal data:
- Account data: Email address, display name, password (hashed)
- Trading data: Journal entries, trade logs, P&L records, account information, screenshots
- Usage data: Interface preferences, navigation history, XP/level progression
- Authentication data: Session tokens, Google account ID (if linked)
2a. Creator Space (open to every account)
If you use the Creator space, we additionally store only what you type into it, so that it can show you your own income and workload:
- Payouts and deals: campaign or brand name, amount and currency, what a payout was for (videos, bonus), how many videos, the date, status, delivery and payment dates, payment terms, hours, a short title and note, and — for a deal marked as paid — the exchange rate on that day
- Preferences: display currency, the share of income you choose to set aside, and which spaces you use
- Access record: only if you redeemed an invitation code (codes are no longer needed): that you did, when, and which code
We deliberately provide no fields for contact details of people at brands, and ask you not to enter personal data of third parties beyond the brand’s name. Brand names and notes are visible only to you, and your received amounts count toward the income goals you set yourself; nothing is shared with other members, used for ranking or benchmarks, or sent to AI providers. The Creator space makes no automated decisions about you with legal or similarly significant effect; the figures it shows are arithmetic on your own entries.
To show amounts in euros we fetch the European Central Bank’s public daily reference rates from our server. That request contains no personal data about you.
Legal basis: performance of the contract (Art. 6(1)(b) GDPR). Retention: as long as your account exists; deleting your account removes your deals and preferences in the same request, and detaches your account from any invitation code you used. Everything above is included in the data export in Settings.
2b. Platform Sync and Market Data
You can connect a trading platform so that your closed trades arrive in your journal without a file. This is optional; file import works without it.
- TopstepX: connected through the ProjectX Gateway API with an API key you create yourself in TopstepX. We store that key and your TopstepX user name, because the API needs both to start a session.
- Tradovate: once available, you sign in on Tradovate’s own page (OAuth). We never see your Tradovate password; we store only the access and refresh tokens Tradovate issues to us.
Keys and tokens are stored encrypted (AES-GCM) and are used only to read your accounts and your closed trades — when you tap Sync now and once a day. We never place, change or close an order. What we read is the account names and, per trade, instrument, direction, quantity, prices, times, profit or loss and fees; these become ordinary trades in your journal.
You can disconnect at any time. Disconnecting deletes the stored key or tokens and any trades still waiting for you to choose an account; the trades already in your journal stay until you delete them. You can also revoke the key in TopstepX itself. Your account at the platform is governed by that provider’s own privacy terms.
Price charts on a trade’s page use candles from public market-data providers (Binance, Hyperliquid, Twelve Data). Our server requests them with only the symbol, the timeframe and the time range; no personal data about you is sent to them.
Legal basis: performance of the contract (Art. 6(1)(b) GDPR). Retention: credentials until you disconnect or delete your account; synced trades like any other trade.
3. Legal Basis for Processing
- Contract performance (Art. 6(1)(b) GDPR): Processing your trading data to provide the journaling service
- Consent (Art. 6(1)(a) GDPR): Optional features like weekly email summaries and public profiles. A new account starts private: no public profile, no shared P&L and no name on the leaderboard until you turn them on in Settings → Profile visibility
- Legitimate interest (Art. 6(1)(f) GDPR): Security measures, fraud prevention, service improvement
4. Third-Party Services
- Vercel: Application hosting and content delivery — processes technical request data (IP address, user agent) to serve the app
- MongoDB Atlas: Database hosting — data may be stored on servers in the EU/US
- Stripe: Payment processing for subscriptions and one-time purchases — processes your email and payment details. We never see or store your full card number. See Stripe’s Privacy Policy
- AI providers (Google Gemini, OpenAI): Optional AI features (journal review, screenshot grading, coaching) send the relevant journal text, trade data, or chart screenshots to an AI provider for processing. Requests go to Google’s Gemini API first and fall back to OpenAI if it is unavailable, so either provider may process a given request. AI features only process your data when you actively use them, and a request carries only the journal data needed for that answer. OpenAI’s API terms say API data is not used to train its models by default; Google’s Gemini API terms say the same for paid API use
- Trading platforms you connect (TopstepX via ProjectX, Tradovate): Only if you connect one (see 2b). Our server sends your API key or tokens to that platform to read your accounts and closed trades. The platform holds your account under its own terms and privacy policy; it is not our processor
- Resend: Transactional emails (password reset, verification) — processes email addresses
- Google OAuth: Optional authentication — only email and name are accessed if you choose Google login
- Google Analytics: Usage analytics (only with your consent) — collects anonymized page views, session data, and device type. Processed by Google LLC. See Google’s Privacy Policy
- Vercel Web Analytics: Aggregate page-view measurement, processed by Vercel Inc. It sets no cookie and stores no identifier on your device, so it runs without a consent banner; it records the page visited, referrer, country and device type, and cannot follow you between sites or sessions
- Push notification services: If you turn on push notifications, your browser issues a subscription address which we store and send messages to. That address belongs to your browser’s push service — Google (Chrome/Android), Apple (Safari) or Mozilla (Firefox) — and identifies your device to them. Turning notifications off deletes it
- Speech recognition (journal dictation): Dictating a journal entry uses your browser’s own speech service — Chrome sends the audio to Google, Safari to Apple. We have no control over that and never receive the audio ourselves, only the text it returns. Typing instead avoids it entirely
We do not sell data to third parties. Google Analytics is only loaded after you accept analytics cookies via the cookie banner; Vercel Web Analytics is cookieless and runs regardless, as described above.
4a. Transfers Outside the EU/EEA
Several of the processors above are established in the United States (Vercel, Stripe, OpenAI, Google, Resend) or may store data on US servers (MongoDB Atlas). Where personal data reaches them outside the EU/EEA, the transfer is based on the European Commission’s Standard Contractual Clauses under Art. 46(2)(c) GDPR, included in each provider’s data processing terms, and additionally on the EU–US Data Privacy Framework for those providers certified under it (Art. 45 GDPR). You may request a copy of the relevant safeguards at the contact address above. If you connect TopstepX or Tradovate, both based in the United States, our server contacts them on your instruction to reach your own account there.
5. Cookies
By default we use only essential cookies required for authentication and storing your preferences (theme, interface mode). Google Analytics cookies are set only if you accept them via the cookie banner — you can decline and the Service works fully. No advertising cookies are used. See our Cookie Policy for details.
6. Data Retention
- Account and trading data: retained as long as your account is active
- Authentication tokens: automatically deleted after 15 minutes (or upon use)
- Rate limiting records: automatically deleted once their window has passed
- Product event log (which screens were opened, for diagnosing faults and usage): automatically deleted after 180 days
- Server performance and health records: automatically deleted after 14 and 7 days respectively
- Upon account deletion: all personal data is removed immediately, in the same request — every collection is swept, not a fixed list. Routine encrypted database backups may still contain it for up to 30 days before they expire
7. Your Rights (GDPR Articles 15–22)
You have the right to:
- Access your personal data (Art. 15)
- Rectify inaccurate data (Art. 16)
- Delete your account and all data (Art. 17) — available in Settings
- Export your data in a machine-readable format (Art. 20) — available in Settings
- Restrict processing (Art. 18)
- Object to processing (Art. 21)
- Withdraw consent at any time (Art. 7(3))
To exercise any of these rights, contact us at info@ngutrading.com or use the self-service options in your Settings page.
8. Data Security
We implement appropriate technical and organizational measures to protect your data, including encrypted connections (HTTPS), hashed passwords (bcrypt), hashed authentication tokens (SHA-256), and rate-limited API endpoints.
9. Right to Lodge a Complaint
You have the right to lodge a complaint with a supervisory authority, in particular in the EU member state of your habitual residence, place of work, or place of the alleged infringement. The competent authority in Germany is the data protection authority of the state of Brandenburg (LDA Brandenburg).
10. No Financial Advice
NGU Edge is a journaling and performance tracking tool. Nothing on this platform constitutes financial, investment, or trading advice. All trading decisions are your sole responsibility. See our full disclaimer.