Privacy Policy

We do not continuously track, stream, or store your live trading profit and loss. Your strategy runs in your own connected broker account; we retain only the bot's lifecycle events and its session output file, both deleted when you delete the job or your account. If you want ongoing P&L tracking, your strategy can send it to a destination of your choice (for example a Telegram alert).

We process your data under the following bases:

• Contract — account data, strategy code, job config, and results are necessary to provide the service you signed up for.
• Consent — broker credentials are stored only when you explicitly connect a broker and can be removed at any time.
• Legitimate interest — usage data, error logs, and security & abuse monitoring (including strategy-validation crash patterns), to keep the platform secure, stable, and protected against exploitation.
• Legal obligation — billing records, as required by tax law.

We do not sell your data. We share it only with the following sub-processors, each bound by their own data processing agreements:

We run our own infrastructure for backtest and live-bot execution — no third-party cloud provider processes your strategy code or trading results.

If you configure a webhook for notifications, your bot's signals and lifecycle events are sent to the URL you choose. That endpoint is under your control, not ours, and is not a PineconeX sub-processor — you are responsible for how the data is handled once it arrives there.

When you connect a broker, we encrypt your credentials at rest using ChaCha20-Poly1305 with a master key that never leaves our servers. Credentials are decrypted only at job launch time and are passed directly to the isolated job container. No credential is logged or retained beyond the lifetime of the job.

You can disconnect a broker at any time from the Live page, which permanently deletes the stored credentials from our database.

If you are in the EEA or UK, you have the right to:

• Access — request a copy of all data we hold about you.
• Portability — receive your data in a machine-readable format.
• Rectification — correct inaccurate data.
• Erasure — delete your account and all associated data.
• Restriction — ask us to stop processing your data while a dispute is resolved.
• Object — object to processing based on legitimate interest.

To exercise any of these rights, email privacy@pineconex.com or use the account deletion feature in your account settings (once available). We will respond within 30 days.

You also have the right to lodge a complaint with your local supervisory authority (in Belgium: the Gegevensbeschermingsautoriteit).

We use a single HTTP-only session cookie to keep you signed in. We do not use advertising cookies, tracking pixels, or third-party analytics scripts. No cookie consent banner is shown because the only cookie is strictly necessary for the service to function.

Credentials are encrypted at rest. Communication between your browser and our servers uses TLS. Job containers are isolated and have no network access beyond what is required to connect to your broker. We keep dependencies updated and run regular security reviews.

We may update this policy as the platform evolves. If we make material changes, we will notify you by email or by a notice in the app at least 14 days before the change takes effect. The effective date at the top of this page always reflects the current version.