Privacy Policy

1. Who is responsible for your data

STS Trading is a trading name of Aurion Labs, registered in Wyoming, USA. We decide how the personal data described here is used, and we are responsible for it. Contact us any time at support@statisticaltradingsystems.com, or through the chat on this website.

2. What we collect

When you open an account

• Your email address and the name you give us.
• Your password, stored only as a cryptographic hash that cannot be read back.
• Settings you choose: timezone, currency, theme, notification preferences.
• Your licence key, the plan you are on, and when you signed in last.

When you pay

• The Stripe customer and subscription identifiers, what you are subscribed to, and its status.
• Billing email and name as Stripe reports them.
• We do not receive or store your card number, expiry or security code.

When you connect a trading account

• Account number and name, broker, server, account currency and leverage.
• Balance, equity, margin and daily profit or loss, refreshed while the bridge is running.
• Your closed trades: instrument, direction, size, prices, profit, commission and swap.
• What the system placed and why: the strategy, timeframe, targets, and whether it came from a portfolio you armed.
• We do NOT collect your broker password or investor password.

When you use alerts and Telegram

• Your Telegram chat id and username, once you link Telegram yourself, so alerts can reach you.
• The alert rules you set, and what was sent to you.
• Whether you have opted in to appear on the Telegram leaderboard. This is off unless you turn it on, and you can turn it off again with a command to the bot.

When you contact support

• Your messages, and our replies.
• Anything you attach. Screenshots of a trading terminal usually show your account number, your balance and your open positions, so send them only if you are content for us to see that.
• Diagnostic logs you upload from MetaTrader, which include your account number, broker server and terminal version.
• If you use the contact box on the public site: your email, your message, which page you were on, and a one-way cryptographic hash of your IP address that we use only to stop the form being flooded. We do not keep the address itself.

When we send you email

• Delivery status from our email provider: delivered, bounced, and where enabled, opened or clicked.
• If you came to us through a marketing page or an advertisement, which page and which campaign.

Licence checks

When software activates against your licence, we record a machine identifier, the account number, the platform version and the IP address it activated from. This exists to stop one licence being shared, and for nothing else.

3. Why we use it, and on what basis

• To provide what you signed up for: your account, the signals, the alerts, placing the orders you asked for, and support. This is necessary to perform our contract with you.
• To take payment and keep billing records. Contract, and legal obligation for accounting.
• To keep the service secure and working, to investigate faults and abuse, and to protect our licensing. Our legitimate interests.
• To tell you about the product by email where you have asked for it or it is directly relevant to what you bought. Consent, or legitimate interests, and you can stop it at any time.
• To meet legal obligations when we must.

We do not sell your personal data, and we do not share it with anyone who wants to advertise to you.

4. Who else touches it

We use a small number of providers, and only for the job described:

• Supabase: the database, sign-in and file storage behind the product.
• Stripe: payments and subscriptions. Stripe handles your card under its own privacy policy.
• Resend: sending email, and reporting whether it arrived.
• Telegram: delivering alerts and support messages, if you connect it.
• Vercel and DreamHost: hosting the terminal and this website.
• Microsoft OneDrive: storage for our encrypted backups.

If you open an account with a partner broker through a link on our site or in the app, that broker knows you came from us, and we may be told that an account was opened or funded so we can be paid. Your trading account, and everything in it, is governed by that broker's own privacy policy, not this one.

We may also disclose data where the law requires it, or to establish or defend a legal claim, and to a buyer if the business is ever sold, under the same protections.

5. Cookies and what is kept in your browser

• The terminal keeps your sign-in session and your preferences in your browser's own storage. Without these it cannot keep you signed in, so they are essential.
• This marketing site and the terminal set no analytics or advertising cookies.
• One older page, our partner and affiliate landing at /ststrading/, does carry Meta and Google advertising tags, and asks for your consent before loading them.
• If we ever add analytics to the main site, we will ask first, and this policy will say so before it happens.

6. Where your data is held

We are a US company and our providers operate in the United States and in Europe, so your data may be processed outside the country you live in. Where data leaves the UK or the European Economic Area, we rely on the protections our providers put in place for those transfers.

7. How long we keep it

• While you have an account, and for as long as we need it afterwards for billing, tax and legal records.
• Support conversations and diagnostic logs, while they are useful for supporting you.
• Website enquiries, until they are answered and for a short period after.
• Our backups are encrypted and roll off after 30 days, and our database provider keeps its own backups for 7 days, so deleted data can persist in a backup for that long before it disappears.

8. Your rights

Depending on where you live, you can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or hand it to another provider. You can withdraw consent at any time, and you can unsubscribe from any marketing email with one click. Once you unsubscribe we keep your address on a suppression list so it cannot be added back by a later import.

Ask at support@statisticaltradingsystems.com and we will deal with it. There is no self-service delete button yet, so deletion is handled by hand. Some records we must keep, such as invoices, and anything already written to a backup disappears when that backup expires.

If you think we have handled your data badly, please tell us first so we can put it right. You can also complain to your data protection regulator; in the United Kingdom that is the Information Commissioner's Office.

9. Security

• Your data is separated at the database level so that a signed-in account can read only its own records.
• Passwords are hashed, connections are encrypted in transit, and backups are encrypted at rest.
• A small number of staff accounts can see subscriber records in order to run the service and answer support.
• No system is perfectly secure, and we cannot guarantee one. If a breach affects you, we will tell you and our regulator where the law requires it.

10. Children

The services are for adults. They are not offered to anyone under 18, and we do not knowingly collect their data. If you believe a child has given us data, tell us and we will remove it.

11. Changes

If this policy changes, the date at the top changes with it, and we will tell you about anything significant before it takes effect.

12. Contact

Email support@statisticaltradingsystems.com, or use the chat on this site. That address reaches us for privacy questions as well as everything else.