Privacy Policy

We do not continuously track, stream, or store your live trading profit and loss. Your strategy runs in your own connected broker account; we retain only the bot's lifecycle events and its session output file, both deleted when you delete the job or your account. If you want ongoing P&L tracking, your strategy can send it to a destination of your choice (for example a Telegram alert).

We process your data under the following bases:

• Contract: account data, strategy code, job config, and results are necessary to provide the service you signed up for.
• Consent: broker credentials are stored only when you explicitly connect a broker and can be removed at any time.
• Legitimate interest: usage data, error logs, and security & abuse monitoring (including strategy-validation crash patterns), to keep the platform secure, stable, and protected against exploitation.
• Legal obligation: billing records, as required by tax law.

We do not sell your data. We share it only with the following sub-processors, each bound by their own data processing agreements:

Our application servers and database are hosted by Combell in EU data centres (ISO 27001). On the shared platform, backtest and live-bot execution runs on our own on-premise infrastructure: no third-party cloud provider executes your strategies or holds your broker credentials during trading. On a Dedicated VPS, execution and your broker credentials are isolated to your own single-tenant instance, hosted by Hetzner in your chosen EU or US region.

If you configure a webhook for notifications, your bot's signals and lifecycle events are sent to the URL you choose. That endpoint is under your control, not ours, and is not a PineconeX sub-processor. You are responsible for how the data is handled once it arrives there.

When you connect a broker, we encrypt your credentials at rest using ChaCha20-Poly1305 with a master key that never leaves our servers. They are decrypted only at job launch time and passed directly to the isolated job container; the decrypted copy is never logged and is not retained beyond the lifetime of the job.

We delete your stored broker credentials from our database when you disconnect a broker, log out, or delete your account. A credential in active use by a running bot is held on the execution host only for the lifetime of that bot. You can disconnect a broker at any time from the Live page.

If you are in the EEA or UK, you have the right to:

• Access: request a copy of all data we hold about you.
• Portability: receive your data in a machine-readable format.
• Rectification: correct inaccurate data.
• Erasure: delete your account and all associated data.
• Restriction: ask us to stop processing your data while a dispute is resolved.
• Object: object to processing based on legitimate interest.

To exercise any of these rights, email privacy@pineconex.com or use the account deletion feature in your account settings (once available). We will respond within 30 days.

You also have the right to lodge a complaint with your local supervisory authority (in Belgium: the Gegevensbeschermingsautoriteit).

We use a single HTTP-only session cookie to keep you signed in. We do not use advertising cookies, tracking pixels, or third-party analytics scripts. No cookie consent banner is shown because the only cookie is strictly necessary for the service to function.

Credentials are encrypted at rest. Communication between your browser and our servers uses TLS. Job containers are isolated and have no network access beyond what is required to connect to your broker. We keep dependencies updated and run regular security reviews.

We may update this policy as the platform evolves. If we make material changes, we will notify you by email or by a notice in the app at least 14 days before the change takes effect. The effective date at the top of this page always reflects the current version.