Privacy Policy

Last updated: 1 November 2026

At Summit Strategy AI, we take your privacy and the security of your data seriously. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website or use our webhook execution infrastructure.

1. Information We Collect

We collect information to provide and optimize our computational execution tools:

  • Personal Identification: Name, email address, billing details, and referral codes provided during waitlist sign-up or registration.
  • Execution & Webhook Data: Incoming TradingView webhook HTTP POST payloads, alert timestamps, IP addresses, symbol identifiers, and user-configured signal parameters.
  • Terminal Credentials & Tokens: Encrypted broker account numbers, relay authentication tokens (used to link your MT5 terminal to the Strategy Lab), and trade status logs.
  • Affiliate & Seller Payout Details: PayPal email addresses (and, where you choose them, bank or crypto wallet details) provided by partners and marketplace sellers so we can pay commissions and earnings.
  • Payment Records: Your PayPal (or Stripe) subscription reference, payment amounts, dates and status, and the email address of the paying PayPal account. Card numbers are entered directly with PayPal or Stripe; we never see or store your full card details.
  • Strategy & Journal Data: Strategies you save in the Strategy Lab, marketplace listings, purchases and reviews, and Trading Journal entries you record.

2. How We Process Your Data

We process your data strictly to execute our core platform services:

  • To route authorized webhook signals from TradingView to your target execution account.
  • To process subscription payments and calculate partner commissions.
  • To prevent fraudulent activity, including unauthorized self-referrals or platform abuse.
  • To maintain system uptime, audit logs, and security monitoring.
  • To send promotional emails (offers and product news) only if you ticked the box when signing up or joining the waitlist, or switched them on in Dashboard → Settings. If you joined the waitlist, we also email you your invitation when spots open. Every promotional email has an unsubscribe link, and you can switch them off in Dashboard → Settings at any time; account, security and billing emails are not affected.

3. Legal Basis for Processing (UK / EU GDPR)

For users in the UK and European Economic Area (EEA), we process personal data under the following lawful bases:

  • Contractual Obligation: Processing is required to perform our service contract (e.g. routing your webhooks).
  • Legitimate Interests: Necessary for platform security, fraud prevention, and system performance monitoring.
  • Legal Compliance: Retaining financial transaction records for tax compliance.
  • Consent: Promotional emails. You can withdraw consent at any time with the unsubscribe link or in Dashboard → Settings. We keep a record of unsubscribed addresses so we don't email them again.

4. Data Storage & Encryption Security

We enforce high security standards to protect your sensitive integration keys:

  • All broker credentials and API tokens are encrypted at rest using AES-256 standards.
  • Database access is enforced using secure role-based session isolation and institutional-grade encrypted cloud database storage.
  • Webhook payloads are processed transiently through encrypted HTTPS channels.

5. Data Sharing & Third-Party Infrastructure

We do not sell your personal data. Data is shared exclusively with verified service providers necessary to operate the platform:

  • Website hosting: Vercel Inc. (hosting, serverless processing and privacy-friendly analytics).
  • Database & sign-in: Supabase Inc. (account database and authentication).
  • Payments: PayPal (membership subscriptions, marketplace purchases, and payouts to partners and sellers). Stripe may also be used for card payments; if so, the same safeguards apply.
  • Discord (optional): if you connect Discord in Dashboard → Settings, we store your Discord user ID and display name to add you to our server and give members access to the members-only channels. We don't keep your Discord sign-in token. Disconnect at any time in Settings.
  • Email: Resend (delivery of account, security, billing and support emails, and promotional emails you opted in to; EU region) and Microsoft 365 (our support mailbox).

5a. International Data Transfers

Our account database is hosted in Japan (Supabase, Tokyo region), and some of our providers (including Vercel and PayPal) process data in the United States and the European Union. The UK recognises Japan and the EU as providing adequate data protection. Transfers to the United States rely on the UK–US data bridge where the provider is certified, or on the UK International Data Transfer Addendum to the EU Standard Contractual Clauses. You can ask us for details of these safeguards.

5b. How Long We Keep Data

We keep your account data while your account is open. Payment and tax records are kept for six years as required by UK law. When you ask us to delete your account, we delete or anonymise your other personal data within 30 days.

6. Your Privacy Rights

Under UK GDPR and applicable privacy laws, you have the right to request access to, correction of, or deletion of your personal data. You may also object to processing or request data portability. You can download a copy of your data and request deletion at any time from Dashboard → Settings, or by emailing us. If you are unhappy with how we handle your data, you can complain to the Information Commissioner's Office (ico.org.uk).

7. Contact Us

For privacy-related questions or data protection requests, email us at Support@SummitStrategy.co.uk.