Privacy Policy
Last updated: May 2026 · Version 1.1
This translation is provided for convenience; the Italian version prevails.
1. Data controller
The controller of the personal data collected through the We All Trader platform (available at wealltrader.com) is:
We All Trader
Controller: [Full name or company name]
VAT no. / Tax code: [XXXXXXXXXXXXXXXXXX]
Address: [Street, City, Postcode, Italy]
Email: privacy@wealltrader.com
The fields in brackets will be completed before the official launch of the platform.
2. Data we collect
We collect and process the following categories of data:
Registration and profile data
- Email address (required to register)
- Display name and avatar (optional)
- Encrypted password (handled by Supabase Auth)
Trading and usage data
- Trades, sessions, notes and journal entries added by the user
- Personal statistics and analytics (P&L, drawdown, etc.)
- Platform settings and preferences
- Broker connections through EasierProp (MT5 credentials encrypted with AES-256-GCM by the provider)
Payment data
- Credit card data is handled exclusively by Stripe and never passes through or is stored on our servers
- We only store: Stripe subscription ID, active plan, renewal date
Data processed by AI systems
- Aggregated trading statistics (not individual raw trades) sent to our AI providers (Anthropic as primary provider; Groq and OpenAI as fallback) to generate personalised AI Insights
- The data sent does not include direct identifiers (name, email)
- AI providers do not use this data to train their models, under their respective commercial terms / DPAs
Technical and browsing data
- IP address (anonymised in logs)
- Browser and device type
- Pages visited and actions on the platform (aggregated analytics)
3. Legal basis and purposes of processing
Performance of a contract (Art. 6(1)(b) GDPR)
Providing the journaling, analytics and backtesting service; account management; payment processing.
Legitimate interest (Art. 6(1)(f) GDPR)
Platform security, fraud prevention, service improvement based on aggregated and anonymous data.
Consent (Art. 6(1)(a) GDPR)
Sending promotional communications, newsletters and product updates. You can withdraw your consent at any time.
Legal obligation (Art. 6(1)(c) GDPR)
Retention of tax and accounting records for the periods required by Italian law (10 years).
4. Data processors (sub-processors)
We use third-party providers that process data on our behalf. A GDPR-compliant Data Processing Agreement (DPA) has been signed with each of them:
Supabase Inc.
Database, authentication, storage · USA (SCC)
Stripe Inc.
Payment and subscription processing · USA (SCC)
Resend Inc.
Transactional email delivery · USA (SCC)
EasierProp
MT5 broker connection (AES-256-GCM credentials) · EU
Vercel Inc.
Platform hosting and CDN · USA (SCC)
Anthropic PBC
AI Insights processing (LLM models, primary provider) · USA (SCC)
Groq Inc.
AI Insights processing (LLM models, fallback) · USA (SCC)
OpenAI, L.L.C.
AI Insights processing (LLM models, fallback) · USA (SCC)
Upstash Inc.
Rate limiting and caching (IP address) · USA (SCC)
Functional Software, Inc. (Sentry)
Error monitoring and diagnostics · USA (SCC)
SCC = Standard Contractual Clauses (the EU→US data transfer mechanism approved by the European Commission).
5. Retention periods
6. Cookies and tracking technologies
Under the ePrivacy Directive (2002/58/EC) and the measures of the Italian Data Protection Authority (Garante Privacy), we use the following categories of cookies:
Technical / necessary cookies
Authentication session (Supabase), UI preferences, dark/light theme. Always active — no consent required under Art. 122 of Italian Legislative Decree 196/2003.
Third-party cookies — Stripe
Stripe uses its own cookies for fraud prevention and payment handling. These cookies are set directly by Stripe Inc. and are subject to its Privacy Policy. They are active on payment pages regardless of consent (legitimate interest / performance of a contract).
Analytics cookies (optional)
Aggregated, anonymous usage statistics to improve the platform. Enabled only with the user's explicit consent.
You can manage your cookie preferences at any time through the cookie banner shown on your first visit, or by contacting us at privacy@wealltrader.com.
7. Your rights (GDPR Arts. 15–22)
You have the right to:
Access
Obtain a copy of all your personal data
Rectification
Correct inaccurate or incomplete data
Erasure
Request deletion of all your data
Portability
Receive your data in a structured format (CSV/JSON)
Objection
Object to processing based on legitimate interest
Restriction
Restrict processing in certain circumstances
Withdraw consent
Withdraw your consent at any time
Complaint
Lodge a complaint with the Italian Data Protection Authority
How to exercise your rights: Go to Account Settings to export or delete your data. For more specific requests, email privacy@wealltrader.com. We will reply within 30 days.
Italian Data Protection Authority (Garante per la protezione dei dati personali): www.garanteprivacy.it
8. Data security
- All data is encrypted in transit (TLS 1.3) and at rest (AES-256)
- Row-Level Security (RLS) on Supabase: each user can only access their own data
- Broker connection tokens are encrypted and cannot be read in plain text
- Under normal circumstances, no employee has access to users' trading data
- Automatic daily backups with 30-day retention
- Monitoring of unusual access and security alerts
9. Minors
The service is intended only for people over 18 years of age. We do not knowingly collect data from minors. If you become aware that a minor has provided us with personal data, please contact us immediately.
10. Changes to this Privacy Policy
We may update this Privacy Policy. If we make material changes, we will notify users by email or in-app notification at least 30 days in advance. The current version will always be available on this page.
11. Contact
For any privacy question or to exercise your rights: