Privacy Policy

This privacy policy explains how ProFuturesTrading("we", "us") processes personal data when you visit profuturestrading.de. We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG).

1. Controller

The controller responsible for data processing on this website is:
ProFuturesTrading.de · Phil Wasmuth, c/o Online-Impressum #8862, Europaring 90, 53757 Sankt Augustin, Germany.
Email: insider@profuturestrading.de

2. Hosting & Content Delivery (Cloudflare)

This website is hosted by Hostinger International Ltd., 61 Lordou Vironos Street, 6023 Larnaca, Cyprus. The provider processes server log files (including IP address, date and time of request, browser type) on our behalf for the purpose of delivering and securing the website. A data processing agreement (DPA) is in place. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a secure, functioning website).

In addition, we use services of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA (content delivery network, DNS and security layer). When you access the website, your IP address is processed by Cloudflare to deliver content and to protect the site against attacks. Cloudflare may transfer data to the United States; such transfers are safeguarded by the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) and Cloudflare's certification under the EU-U.S. Data Privacy Framework. A data processing agreement is in place. Legal basis: Art. 6(1)(f) GDPR. All fonts and animation assets are self-hosted; no requests are made to Google or other third-party font/asset servers.

3. Server Log Files

When you access the website, the following data is automatically collected and stored in server log files: browser type and version, operating system, referrer URL, host name, time of the server request, and IP address. This data is not merged with other data sources and is used solely for technical operation and security.

4. Cookies & Local Storage

This website uses only technically necessary cookies required for basic functionality. We do not use tracking or advertising cookies. Our website analytics (see section 12) works entirely without cookies and without storing or reading any information on your device. Should cookies requiring consent be introduced in the future, they will only be set after your explicit consent (Art. 6(1)(a) GDPR / § 25 TDDDG).

Beyond cookies, we store up to two further pieces of information in your browser. First, if you sign in to your account, your session is kept in your browser's local storage (a token issued by our authentication provider Supabase, together with its expiry). This keeps you signed in between page loads and when you return later, and it is read only by this website. We do not use local storage for analytics, advertising or profiling. Storing it is strictly necessary to provide the sign-in you asked for and therefore does not require consent (§ 25(2) no. 2 TDDDG); the legal basis for the associated processing of personal data is Art. 6(1)(b) GDPR. You can end the session at any time by signing out, which removes the token, or by clearing your browser data.

Second, if you load our booking calendar (see section 16), we store a single marker in your browser's local storage that remembers this choice, so the calendar loads directly on your next visit. It contains no personal data and is read only by this website. You can remove it at any time by clearing your browser data for this website.

5. Checkout & Payment (ablefy, CopeCart)

Purchases through ablefy. New purchases are made through the ablefy checkout (checkout.profuturestrading.de). The seller and your contractual partner there is namotto Universal Brands GmbH & Co. KG, Potsdamer Straße 125, 10783 Berlin, Germany. When you proceed to checkout, you are forwarded to that checkout, and the data you enter there (name, email, payment and billing details, and the ATAS account email you enter for activation) is processed by namotto under its own privacy policy, which is linked at the bottom of the checkout and names namotto as the controller. Payment providers used there are listed in that policy.

To activate and manage your license, we receive the details of your order from ablefy: in particular the order number, the product, the payment and subscription status (including refunds and chargebacks), the end of your access period and the ATAS account email you entered. The order details provided by ablefy also contain your name, email address and country. We use this data to unlock the purchased tools on your ATAS account (section 6), to keep the access in line with your subscription. Legal basis: Art. 6(1)(b) GDPR (performance of a contract).

Subscriptions bought through CopeCart. Subscriptions bought through CopeCart continue to be processed by our reseller CopeCart GmbH, Augustinusstraße 9d, 50226 Frechen, Germany, acting as merchant of record. For these purchases you were forwarded to CopeCart, and the data you entered there (name, email, payment and billing details) is processed by CopeCart under its own privacy policy. We receive only the information necessary to activate and manage your license (in particular your ATAS-linked email address). Legal basis: Art. 6(1)(b) GDPR (performance of a contract).

6. License Activation (ATAS)

To activate your indicator license, your ATAS-account email address is transmitted to the ATAS marketplace operator so that the purchased tools can be unlocked for your account. Legal basis: Art. 6(1)(b) GDPR.

7. Contact

If you contact us by email, the data you provide will be processed to handle your request. Legal basis: Art. 6(1)(b) or (f) GDPR.

8. Your Rights

Under the GDPR you have the right to:

• access your personal data (Art. 15 GDPR);
• rectification (Art. 16 GDPR);
• erasure (Art. 17 GDPR);
• restriction of processing (Art. 18 GDPR);
• data portability (Art. 20 GDPR);
• object to processing (Art. 21 GDPR);
• lodge a complaint with a supervisory authority (Art. 77 GDPR).

9. Data Retention

We store personal data only as long as necessary for the purposes described above. Where statutory retention periods apply, the following applies: business and commercial correspondence is retained for 6 years (§ 257 German Commercial Code, § 147 German Fiscal Code); accounting records, invoices and payment data are retained for 10 years (§ 257 HGB, § 147 AO). Server log files are deleted after 14 days at the latest unless a security incident requires longer storage. All other personal data is deleted once the purpose of processing ceases.

10. EdgeBook App, Cloud Sync & AI Connector (MCP)

EdgeBook is our desktop trading journal (part of the PFT Terminal). By default it stores your journal locally on your device. The cloud and AI features described below are strictly optional and only take effect after you enable them.

Data processed.If you enable cloud sync, we process the journal data you choose to sync: trades (instrument, entry/exit, size, P&L, timestamps), your written notes, reflections, tags, ratings and setups/playbook entries, chart screenshots attached to trades, voice-note recordings and their text transcripts, and broker / prop-firm account data. Broker account numbers are shown to any connected AI in masked form (e.g. ****1234). We do not use your journal to train any AI model, and we do not sell it or use it for third-party advertising.

Where it is stored. Cloud journal data is stored in the EU with Supabase (Frankfurt, Germany); attached images are stored in access-controlled EU object storage (Cloudflare R2). Data is encrypted in transit (TLS) and at rest. Data-processing agreements are in place with both providers. Legal basis: Art. 6(1)(a) GDPR (consent) for the cloud/AI features; Art. 6(1)(b) GDPR for operating your account.

AI Connector (MCP). The optional EdgeBook AI Connector lets an AI assistant of your choice (for example Claude or ChatGPT) read your own journal over the Model Context Protocol. The connector is read-only: it cannot create, change or delete any data. Access is authorised per user via OAuth 2.1, every request is strictly limited to the signed-in user through database Row-Level Security, and access tokens are never exposed to the AI model.

“Bring your own AI”: important. When you connect an AI client, the journal data you request flows to the AI provider you chose(e.g. Anthropic for Claude, OpenAI for ChatGPT) so that it can answer you. That provider processes the data under its own privacy terms and your own account with it. We never send your data to an AI provider on our own initiative; it happens only in response to a request you make in your AI client. If that provider is located outside the EU, the transfer is safeguarded by the mechanisms in that provider's own agreement with you (e.g. EU Standard Contractual Clauses).

Retention. Cloud journal data (trades, notes, transcripts, screenshots and prop-account data) is kept for as long as your account is active. When you delete your account or your cloud data, the corresponding records and stored images are removed from our systems without undue delay, and residual backups are overwritten on their normal rotation. Statutory billing records are kept only where the law requires (see section 9).

Export & withdrawal. You can obtain a copy of your data or withdraw consent to the cloud/AI features at any time by disabling them in the app, deleting your cloud data, or emailing insider@profuturestrading.de. Your GDPR rights (access, portability, erasure) in section 8 apply.

11. AI Mentor (rAI)

The AI Mentor is optional and switched off by default. It only runs when you open it and send a message.

What is processed. Your messages, and the journal data the assistant needs to answer them: your trades, journal entries, statistics, strategies, prop-firm accounts and notes. The assistant can also store what it has learned about your trading, so that it does not have to ask you the same thing twice.

Where it runs. We use Scaleway (Scaleway SAS, France) as our model provider. Processing takes place within the European Union, currently in a data centre in Paris, France. Your data is not transferred outside the European Union for this purpose.

What does not happen. Your prompts, requests and the generated answers are not stored by the provider and are not used to train, retrain or improve any AI model. They are not accessible to third parties, to other customers of the provider, or to the creators of the underlying models. The provider records only aggregated, anonymised metadata such as token counts, status codes and timestamps in order to monitor performance; this is kept for up to six months. One exception: if a request causes a technical error or activity looks abusive, the provider may temporarily store and access the full content of that request in order to find and fix the cause, for no longer than two weeks.

How to remove it. You can delete individual conversations at any time. Deleting your account removes the entire history, including everything the assistant has learned about you.

Legal basis: Art. 6(1)(a) GDPR (your consent; the feature is off until you use it).

12. Web Analytics (Pirsch)

To understand how our website is used and which pages and page sections people actually reach, we use Pirsch Analytics, a service of Emvi Software GmbH, Nickelstraße 1b, 33378 Rheda-Wiedenbrück, Germany. Processing takes place on servers in Germany (Nuremberg and Falkenstein). A data processing agreement under Art. 28 GDPR is in place.

Pirsch works without cookies and does not store or read any information on your device. It does not build profiles across websites and does not track you elsewhere. Recorded are aggregated statistics: page views, the referring website, any campaign parameters contained in the link you followed, the type of device and browser, and the country and city derived from your IP address.

In addition, we record how far a visit extends on a page, i.e. which sections of the page (for example the pricing section) were scrolled into view, as well as clicks on links to other websites and file downloads. These events contain only the name of the page section or the link target, never content you enter, and are evaluated together with the statistics listed above.

We also count a small number of defined actions, so that we can see how many visitors complete a step, not who did. These are: starting a download of the terminal (recorded with the platform and the version downloaded), starting a download of a broker bridge (the bridge in question), joining a waiting list (which list), opening a checkout page (which product), completing a registration or a sign-in (the method used, i.e. password or Google), sending one of our contact forms (which form), booking a call through our calendar (no further values), starting a download of a free workspace file (which workspace), and, in the PFT Prop Scout, copying a prop firm's discount code or opening a prop firm's website through our partner link (which firm, where on the page, and whether the firm has a code). Each of these is counted only once the action has actually succeeded.

These action events contain no personal data. They carry none of the following: your name, your email address, your account or order number, or anything you typed into a field. The values listed above are fixed terms taken from our own source code, not from your input, and they are not linked to your account. Like the rest of Pirsch, they work without cookies and nothing is stored on or read from your device. Where we do need to record an action against your account (a download, for example), that happens separately in our own database and is described elsewhere in this policy, not here.

Your IP address is not stored as such. It is combined with your browser's user agent and a random string that is unique to this website, in order to calculate a number that distinguishes visitors from one another. A visit is counted for at most 24 hours, after which a new number is assigned. Because the random string differs per website, that number cannot be matched across sites.

Legal basis is our legitimate interest in a statistical evaluation of website usage and in improving our offering (Art. 6(1)(f) GDPR). As no information is stored on or read from your device, consent under § 25 TDDDG is not required. Further information: pirsch.io/privacy.

13. Product Emails & Newsletter (Brevo)

We send emails through Brevo (Brevo GmbH, Köpenicker Str. 126, 10179 Berlin, Germany). Brevo uses sub-processors, some of them in the USA (e.g. Cloudflare); transfers rely on the EU-US Data Privacy Framework and Standard Contractual Clauses.

Two kinds of email have to be told apart here, because they rest on different legal grounds.

Service emails are sent because you use the product, for example the setup instructions after you confirm your address, or a notice about your license. They are necessary to provide what you signed up for. Legal basis: Art. 6(1)(b) GDPR. They do not advertise anything and cannot be switched off separately, as long as you have an account.

Product updates and trading resources are only sent if you actively asked for them. The checkbox during registration is not pre-ticked, and ticking it is never a condition for creating an account. Legal basis: Art. 6(1)(a) GDPR.

Your consent only takes effect once you confirm your email address: the entry in our mailing list is created after that click, not when you submit the form. This double opt-in makes sure nobody can sign up an address that is not theirs. We record when you consented, through which channel, and which version of the consent text you were shown. That record is our proof under Art. 7(1) GDPR and is kept for as long as we rely on it.

You can withdraw your consent at any time, with effect for the future, using the unsubscribe link in every such email or by writing to insider@profuturestrading.de. Withdrawing is as easy as giving consent and has no effect on your account or on service emails. Data processed until the withdrawal remains lawful.

Workspace files in exchange for your newsletter subscription. On our resources page we offer ATAS workspace files in exchange for subscribing to our newsletter. We say so openly next to the form: you get the file by entering your email address and confirming it, and with that you also subscribe to our newsletter. When you submit the form, we store your email address, the workspace you asked for, the time, the version of the text you were shown and, if known, the campaign that brought you to our site. Brevo then sends you a confirmation email. Only when you click the link in that email are you added to our newsletter list, and only then do you get the download link, which works for 30 days. If you do not confirm, you will not receive the newsletter and we delete the entry after 45 days.

Legal basis. Until you confirm, we process your email address on the basis of Art. 6(1)(f) GDPR: our legitimate interest in sending you the confirmation email and in protecting the form against misuse. From your confirmation, the newsletter rests on Art. 6(1)(a) GDPR (your consent). We record the consent as proof under Art. 7(1) GDPR. Providing your email address is not required by law; without it we cannot send you the workspace. We keep the record of your consent until you unsubscribe and then for 3 years to be able to prove it.

The workspace is an extra that you can do without: every setting is shown in the video, so you can build the same workspace yourself. You can unsubscribe at any time with the link in every newsletter or by writing to insider@profuturestrading.de; a workspace you have already downloaded stays yours. To stop the form from being used to flood other people's inboxes, we also store a pseudonymised hash of your IP address (never the address itself) and limit how often a request can be sent. This hash is deleted after 30 days. Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in preventing abuse). These records are stored in the EU with Supabase (Frankfurt, Germany).

14. Account & Sign-in

You can create an account on this website to manage your purchases, to download the PFT Terminal and to use the optional cloud features. To do so we process your email address and a cryptographic hash of your password; we never store the password itself and cannot read it. We also store the time your account was created and the time of your last sign-in, plus the technical session data described in section 4.

Campaign label: if you create an account after arriving through one of our links that carries a campaign label (for example from one of our emails or posts), we store that label (the source, channel and campaign name, never anything you entered) with your account and with your downloads, so that we can see which of our channels led to it. Legal basis: Art. 6(1)(f) GDPR; our legitimate interest is knowing which of our channels work. It is deleted together with your account.

Purpose: creating and operating your account, authenticating you, giving you access to the products you bought and allowing us to answer your requests. Legal basis: Art. 6(1)(b) GDPR. The processing is necessary to perform the contract with you or to take steps at your request before entering into one. Providing this data is not a statutory requirement, but without it an account cannot be created.

Where it is stored: with Supabase in the EU (Frankfurt, Germany), encrypted in transit and at rest, under a data-processing agreement. Details on the cloud journal are in section 10.

How long we keep it: your account data is stored for as long as your account exists. You can ask us to delete your account at any time, in the account area or by writing to insider@profuturestrading.de. After you request deletion there is a grace period of 30 days in which you can change your mind; once it has passed, the account and the data attached to it are deleted and cannot be restored.

What survives deletion, and why: records that document a purchase (invoices, payment records and the accounting data behind them) are not deleted with your account. We are required to retain them under German tax and commercial law (§ 257 German Commercial Code, § 147 German Fiscal Code); the periods are set out in section 9. The legal basis for keeping them is Art. 6(1)(c) GDPR. These records are blocked from further use and are kept only to meet that obligation.

15. Cancelling a Contract

If you cancel a contract using our cancellation page, we process the details you enter there: your name, your email address, the contract concerned, an order or customer number if you provide one, the type of cancellation, the reason where you state one, and the date on which the cancellation should take effect. We add the date and time of your declaration and a reference number.

Purpose: receiving and processing your cancellation and confirming it to you. Legal basis: Art. 6(1)(b) GDPR (performance of the contract) and Art. 6(1)(c) GDPR, because § 312k of the German Civil Code obliges us to accept and confirm cancellations by this route. The record is stored in the EU with Supabase (Frankfurt, Germany) and is retained for as long as it may be needed as evidence of when and how your contract ended, and in any case for the statutory retention periods set out in section 9.

You do not have to use the form. A cancellation sent by email or by post is equally valid; the addresses are in our Imprint.

16. Booking a Call (Calendly)

On our course page you can book a call with us through a scheduling tool provided by Calendly, LLC, 115 E Main St., Ste A1B, Buford, GA 30518, USA. When you book, Calendly processes on our behalf the details you enter: your name, your email address, the time slot you choose and your answers to the questions in the booking form (for example what you expect from the mentorship, your current stage in trading and your professional situation). We use this information to prepare and hold the call.

If you reached the course page through one of our links that carries a campaign label (for example from one of our emails), that label (the source, channel and campaign name, never anything you entered) is passed to the calendar and stored with your booking, so that we can see which of our messages led to it.

The calendar is only loaded after you click "Book a 15-minute call" (or the button shown in the calendar's place). From that moment your browser connects to Calendly's servers, Calendly receives your IP address and technical information about your browser, and Calendly may store cookies or similar technologies on your device. Until you click, no connection to Calendly is made. We remember your click in your browser's local storage, so the calendar loads directly when you return to the page.

Calendly processes data in the United States. Calendly, LLC is certified under the EU-U.S. Data Privacy Framework; the transfer is based on the adequacy decision of the European Commission (Art. 45 GDPR). A data processing agreement under Art. 28 GDPR is in place.

Legal basis: loading the calendar and the cookies it sets are based on your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG), which you give by clicking the button and can withdraw at any time with effect for the future by deleting the cookies and site data (local storage) for this website in your browser. Your booking details are processed to take steps at your request before a possible contract (Art. 6(1)(b) GDPR). We keep them for as long as we need them to prepare and follow up on the call, and otherwise as set out in section 9. Further information: calendly.com/legal/privacy-notice.

17. YouTube Videos

Some pages, for example our blog articles and our resources page, show videos hosted on YouTube, a service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Before you click, we only show a preview image that is stored on our own server; no connection to YouTube or Google is made.

Only when you click a video does your browser load it from youtube-nocookie.com (YouTube's privacy-enhanced mode) and start playback. From that moment YouTube receives your IP address and technical information about your browser, and Google may store cookies or similar technologies on your device and process data in the United States. Google LLC is certified under the EU-U.S. Data Privacy Framework; the transfer is based on the adequacy decision of the European Commission (Art. 45 GDPR). We do not store your click; every video is only loaded after its own click.

Legal basis: loading a video is based on your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG), which you give by clicking the video. You can withdraw it at any time with effect for the future by not playing further videos and by deleting the cookies for YouTube and Google in your browser. Further information: policies.google.com/privacy.

18. rAI Prop Firm Advisor and website AI chat

On our PFT Prop Scout pages you can answer a few questions and let rAI suggest prop firms that fit how you trade. To weigh the options, our server sends your answers (for example platform, account size, budget, experience, trading style, priorities and, if you give it, your country), together with the published data of the prop firms pre-selected for you, to Scaleway (Scaleway SAS, France), our model provider. We do not send your IP address, your name or any account information to Scaleway. Processing takes place within the European Union, currently in a data centre in Paris, France; your data is not transferred outside the European Union for this purpose.

To protect the advisor against abuse, our server keeps a shortened, one-way hash of your IP address for at most about 24 hours. Your answers and the state of the conversation are stored only in your own browser (local storage), so rAI remembers them when you come back; you can delete them at any time by clearing your browser data.

Website AI chat (“Ask PFT AI”).In the help window at the bottom right of our website you can switch from “Message Ulrich” to “Ask PFT AI”. If you ask a question there, our server sends the text you type, together with the earlier messages of the same conversation, to Scaleway to select the matching answer from our website content and to word the reply. We do not send your IP address, your name or any account information to Scaleway. Please do not enter personal or account details in the chat; for questions about your account, use “Message Ulrich” instead. To enforce a daily limit on questions, our server uses your IP address in a shortened, one-way hashed form and deletes it after about 24 hours. We do not store the conversation: it exists only in the open browser tab and is gone when you reload or close the page. Whether you last chose “Message Ulrich” or “Ask PFT AI” is remembered in your browser's local storage so the window opens the same way next time; it contains no message content.

What Scaleway does not do with it. Prompts, requests and generated answers are not stored by the provider and are not used to train, retrain or improve any AI model. They are not accessible to third parties, to other customers of the provider, or to the creators of the underlying models. The provider records only aggregated, anonymised metadata such as token counts, status codes and timestamps in order to monitor performance; this is kept for up to six months. One exception: if a request causes a technical error or activity looks abusive, the provider may temporarily store and access the full content of that request in order to find and fix the cause, for no longer than two weeks.

Legal basis: our legitimate interest in answering your request and in protecting the service (Art. 6(1)(f) GDPR). Using rAI is optional; the comparison works without it.

19. Partner Applications

If you apply for our partner program using the form on our affiliate page, we process your name, your email address and the message you write to us, together with the page you sent the form from. To limit repeated submissions, our server also uses your IP address in a shortened, one-way hashed form; the IP address itself is not stored.

Purpose: handling your application and replying to you. Legal basis: Art. 6(1)(b) GDPR (steps taken at your request before entering into a contract). The application is stored in the EU with Supabase (Frankfurt, Germany) and forwarded to our support inbox by email through Brevo (see section 13). It is deleted when it is no longer needed for the application.