Privacy Policy

How data is handled in and around CopySignals

7.1 Two Roles

For account data (your company details, billing records, sign-in history and support correspondence) we are the controller. For workspace content, above all the connection credentials, the copiers and the event logs in your workspace, you are the controller and we are a processor acting only on your instructions. A data-processing agreement forms part of these terms for business customers; contact us for a signed copy.

7.2 What We Process

• Account data: your email, billing and subscription records, and support correspondence.
• Trading Account credentials: the account number, the password and the server name you give us. Passwords are encrypted before they are written, are never shown again in the panel and are never returned to a browser. They are held because the connection has to sign back in by itself after an interruption, and they are deleted when you remove the account.
• Telegram session data: the session your connected account is signed in with, stored encrypted and deleted when the connection is removed.
• Copier configuration: the channel a copier reads, the accounts it trades and every setting you chose.
• Trading records: the orders a copier placed, the instrument, side, size and level, and whether a position was later closed or moved. These are the record of what the Platform did on your instruction.
• Event logs: the last hundred decisions per copier, each with a short preview (up to 240 characters) of the message it was made from, so you can see why a post was traded or skipped. Older entries are deleted as newer ones arrive.
• What we do NOT keep: there is no message store. Messages in a connected Telegram account are parsed as they arrive and are not written to our systems beyond the short preview described above. Your private chats are not read, not synced and not copied anywhere.

7.2a Your Broker And Your Money

We never hold your funds. Your money stays with your broker in your own account, and the Platform can do nothing with it except place, modify and close orders on that account, as your copiers instruct. We cannot withdraw, transfer or move funds, and we never ask for anything that would allow it. If you would rather an account could not be traded at all, an investor password still connects and still reports the balance.

7.3 If You Write A Channel Somebody Copies

If a Customer copies your channel, the Platform reads posts you published to the members of that channel, of which that Customer is one. It parses each post into a trade and keeps a short preview of the text in that Customer's own log, so they can see what their copier did. We do not republish your posts, do not sell them and do not build a public database of them. If you believe a Customer is copying your room in breach of your own terms, that is a matter between you and them; write to us and we will pass it on.

7.4 Advertising Platforms and Hashed Data

We advertise CopySignals, so our own marketing pages carry the tags described in the Cookie Policy, which load only if you accept them, and our servers report the same events (a page view, a checkout opened, a payment) to those networks. Email addresses are hashed with SHA-256 before they leave us; the click and browser identifiers the networks set are sent as they require them, because they cannot be matched in any other form.

Where a Customer enables pixel integrations, event data is sent to the chosen platforms (such as Meta, TikTok or Snapchat). Identifiers such as email addresses are hashed before transmission; raw email addresses are not sent to advertising platforms and are not stored in event logs. Advertising click identifiers and browser cookie values are transmitted as the platforms require them, unhashed, because that is the only form in which they can be matched. The Customer is responsible for having a lawful basis, and where required consent, for this tracking.

7.4a Buying Without An Account

A purchase can be started before an account exists. Payment is taken by Whop, who are merchant of record: we never see your card. Whop tells us the payment succeeded and the address it was made with, and that address becomes your account, so the plan you paid for is waiting when you sign in with it. If you would rather it were a different address, write to us and we will move it.

7.5 Retention, Security and Transfers

Workspace content is retained while the workspace exists and is deleted when the workspace is deleted, following a short recovery window. Removing a Trading Account closes its connection and deletes its stored credentials at once. Secrets are encrypted at rest with a key held outside the database, so a stolen copy of the database alone reveals none of them. Where data is transferred internationally we use recognised safeguards. We use a small number of sub-processors: hosting, email delivery (Resend), payment processing (Whop) and, only if you accept cookies, Google Analytics (Google) and the Meta Pixel (Meta). A current list is available on request.

7.6 Your Rights

Depending on your jurisdiction you may have rights to access, rectify, erase, restrict or port personal data, and to object to certain processing. For account data, contact us directly. For anything inside a workspace, the Customer who owns that workspace is the controller and the request belongs with them; we will help them answer it. You may also complain to your data-protection authority.

Cookie Policy

This section explains the cookies and similar browser storage that copysignals.io uses, and how to change your choice. Analytics and advertising cookies are only set if you click Accept on the cookie bar. If you click Decline, or make no choice, none of them load and the site works exactly the same.

Strictly necessary

These make the site work and are set without asking, because the service cannot run without them. None of them is used for advertising.

copysignals_consent: remembers whether you accepted or declined analytics and advertising cookies, so the bar does not ask again on every page. Kept for 12 months. The same choice is also kept in your browser's local storage.

cs_session: keeps you signed in to the panel after you enter your sign-in code. Kept for up to 30 days, and deleted when you sign out.

cs_admin: the same for our own staff sign-in. Kept for up to 8 hours.

cs_tz: your time zone offset, set inside the signed-in panel so times and daily totals show in your local time. Kept for 12 months.

cs_ref: set only when you arrive through a partner's referral link, so a purchase made within 30 days is credited to that partner. Kept for 30 days.

Cloudflare Turnstile: the human check on the sign-in page, run by Cloudflare, Inc. It checks your browser to keep automated sign-ins out and may keep a short-lived value in your browser for that check. It is not used for advertising.

Local storage: the site also remembers, in your browser only, when you closed the install-app prompt or an announcement, so they stay closed.

Analytics, only with your consent

Google Analytics 4, provided by Google Ireland Limited and Google LLC. It tells us how many people visit, which pages they read and how they found us. It sets _ga and _ga_E8RRDM9YK6, kept for up to 2 years. Google may process this data in the United States. Google Analytics 4 does not log or store IP addresses. You can also block it on every site with Google's opt-out add-on at https://tools.google.com/dlpage/gaoptout.

Advertising, only with your consent

Meta Pixel, provided by Meta Platforms Ireland Limited. It tells us which Facebook or Instagram advert brought a visitor and lets a sale be counted once. It sets _fbp, kept for 3 months, and _fbc when you arrive from a Meta advert, also kept for 3 months. You can manage how Meta uses this at https://www.facebook.com/adpreferences.

Whop pixel, provided by Whop, Inc., who also take our card payments. It tells us which visits led to a checkout. It sets _wuid and _wuid_link, identifiers for your browser. Where we advertise on TikTok, that tag follows the same rule. All of them load only after you accept, and never before. We do not sell what any of these tags collect and we do not use them to build a profile of you for anyone else.

Changing your choice

Use the Cookie Settings link at the bottom of any page to open the cookie bar again and pick Accept or Decline. If you decline after accepting, the site deletes the _ga, _ga_E8RRDM9YK6, _fbp, _fbc, _wuid and _wuid_link cookies it can reach and stops loading the tags. You can also delete cookies at any time in your browser's settings.

The signed-in panel

The panel and the admin never load analytics or advertising tags, whatever you chose. Only the strictly necessary cookies above are used there.

Contact

For any questions about these terms, our policies, or to exercise a data-protection right, please contact us at the address below.