Privacy Policy

How UltimaTrader collects, uses, shares and protects personal data when you use the UltimaTrader website, web application and sign-in service.

Last updated: October 18, 2026

1. Introduction

This Privacy Policy explains how UltimaTrader (“we”, “our” or “us”) collects, uses, discloses and protects personal data through the UltimaTrader website at ultimatrader.com, the UltimaTrader web application (the “cabinet”), the UltimaTrader sign-in service and associated services (the “Platform”).

By accessing or using the Platform, you consent to the practices described in this Privacy Policy. If you do not agree with them, do not use the Platform. This Privacy Policy forms part of our Terms of Service. Our use of cookies and similar technologies is described in our Cookie Policy.

We do not sell your personal data.

2. Information We Collect

2.1 Information You Provide

• Account information: your email address and the password you choose when you register by email.
• Google sign-in: if you sign in with Google, the basic account information Google shares with us for sign-in, such as your email address, name and Google account identifier. We do not receive your Google password.
• Access requests: if you request access through the cabinet, your name, your email address and, if you choose to give them, a Telegram username or phone number and a comment.
• Support messages: if you contact support through the cabinet, your email address, the subject and priority you select and the content of your message.
• Correspondence: the content of any email you send us and of our replies.

2.2 Information Collected Automatically

• Technical data: your IP address, browser and device type, the pages and resources you request, the time of each request and related information recorded in standard server and security logs.
• Account security data: the time of sign-ins, failed sign-in attempts and related security events, used to protect your account, for example to apply temporary lockouts after repeated failed attempts.
• Session data: the strictly necessary cookies that keep you signed in, described in our Cookie Policy.

The website and the cabinet do not use analytics tools, advertising pixels or tracking cookies.

2.3 Information Stored Only in Your Browser

The cabinet stores a random identifier used to generate the demonstration figures shown during early access, and your display preferences, in your browser's local storage. This information stays on your device and is not sent to us.

3. How We Use Personal Data

We use personal data to:

• create and maintain your account and let you sign in, including with Google;
• send you service emails, such as email confirmation, password reset, welcome and security notices;
• respond to your access requests, support messages and other enquiries;
• operate, maintain, secure and improve the Platform;
• detect, prevent and investigate fraud, abuse, unauthorised access and other harmful activity;
• comply with legal obligations, enforce our Terms of Service and protect our rights and the rights of others;
• inform you about the Platform, including when new features become available, where permitted by law.

Service emails are part of the Platform and cannot be switched off while you have an account.

4. Legal Bases for Processing

Where the law requires a legal basis for processing, we rely on:

• Contractual necessity: to provide the Platform to you under our Terms of Service, including account creation, authentication, service emails and support;
• Legitimate interests: to secure, maintain and improve the Platform, prevent fraud and abuse, respond to enquiries and access requests, and protect our legal rights;
• Legal obligations: to comply with applicable laws, regulations and lawful requests from authorities;
• Consent: where we ask for it, for example for optional communications. You may withdraw consent at any time without affecting processing carried out before.

5. Sharing and Disclosure

5.1 We Do Not Sell Personal Data

UltimaTrader does not sell, rent or trade your personal data for money.

5.2 Service Providers

We share personal data with service providers who process it on our behalf to operate the Platform, including:

• Google, for sign-in with Google;
• SendGrid (Twilio), for delivering service emails;
• Cloudflare, for delivering and protecting our websites and services;
• hosting and infrastructure providers, for running our servers, databases and email.

These providers are bound by confidentiality and data protection obligations appropriate to the services they provide.

5.3 Legal and Business Disclosures

We may disclose personal data:

• to regulators, law enforcement, courts and other authorities where required by law or to respond to lawful requests;
• to professional advisers, such as lawyers, accountants and auditors;
• to protect the rights, property or safety of UltimaTrader, our users or others, and to enforce our Terms of Service;
• to a party involved in a merger, acquisition, financing or sale of all or part of our business, subject to this Privacy Policy.

5.4 Anonymised Data

We may use and share aggregated or anonymised information that does not identify you for any purpose.

6. Data Security

We use technical and organisational measures designed to protect personal data, including encrypted connections (HTTPS), restricted access to systems and data, and security monitoring. The session cookies that keep you signed in cannot be read by scripts on web pages.

No transmission over the internet and no storage system is completely secure, and we cannot guarantee the security of your personal data. You are responsible for keeping your sign-in details and devices secure.

If we become aware of a personal data breach, we will investigate and respond to it and will notify affected users and authorities where required by law.

7. Data Retention

We keep personal data for as long as necessary for the purposes described in this Privacy Policy, including to provide the Platform, comply with legal obligations, resolve disputes and enforce our agreements. As a general guide:

• account information: for as long as your account is active and afterwards for as long as needed for legal, accounting and dispute-resolution purposes, typically up to 7 years;
• access requests, support messages and correspondence: typically up to 5 years;
• technical and security logs: typically up to 3 years, or longer where needed to investigate an incident;
• one-time codes in confirmation and password reset emails expire automatically, after 24 hours and 15 minutes respectively.

When personal data is no longer needed, we delete or anonymise it within a reasonable time.

8. Your Rights

Depending on your jurisdiction, you may have the right to:

• access your personal data and information about how we process it;
• rectify inaccurate personal data;
• erase your personal data in certain circumstances;
• restrict or object to certain processing;
• data portability, to receive your personal data in a structured, machine-readable format;
• withdraw consent where processing is based on consent.

Residents of the European Economic Area and the United Kingdom may also lodge a complaint with their local data protection authority. Residents of California have the right to know what personal information we collect, use and disclose, to request its deletion, and not to be discriminated against for exercising their rights; we do not sell personal information.

To exercise your rights, contact us at the address in the Contact section. We may need to verify your identity before acting on a request. We respond within the time required by applicable law, typically within one month. Some rights are subject to exceptions under applicable law.

9. International Data Transfers

Our service providers, including Google, SendGrid and Cloudflare, process data in the United States and other countries where they or their sub-processors operate. These countries may have data protection laws different from those of your country.

Where required by law, we rely on appropriate safeguards for international transfers, such as standard contractual clauses approved by the European Commission or the United Kingdom, or adequacy decisions.

10. Communications

We send service emails from [email protected]. These messages are automated; replies to them are not monitored. Any other communications we may send about the Platform include a way to opt out where the law requires it.

11. Children

The Platform is not intended for anyone under 18 years of age, and we do not knowingly collect personal data from children. If we learn that we have collected personal data from a child, we will delete it.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in the Platform, our practices or the law. The updated policy is published on this page with a new date. Your continued use of the Platform after the update means you accept the updated policy. Where a change is material, we may also notify you by email or within the Platform.

13. Complaints

If you have a concern about how we handle your personal data, contact us first so that we can try to resolve it. If you are not satisfied with our response, you may contact the data protection authority in your country.

Contact

For questions about this Privacy Policy or to exercise your rights, contact us at [email protected].