Privacy Policy

Trade Desk is a trading tool. Two distinct parties handle your personal information:

• Business Science Cohort Technology FZCO ("BSCT", "we", "us") is the platform operator and acts as the data controller for your account record, billing data, device logs, security events, and any information you send us directly through Support.
• Workspace (tenant) administrators are the data controllers for everything created inside their workspace — team members, strategies, backtests, scan candidates, trading records, exchange connections added by their users, and any content they upload. BSCT acts as the data processor for that workspace-scoped content under instructions from the workspace administrator.
• If you joined Trade Desk through an invitation link from a workspace administrator, that administrator is responsible for the lifecycle of your in-workspace data. You can still contact BSCT directly for any platform-level request.

We collect the smallest set of information needed to operate Trade Desk securely. Specifically:

a. Account information

• Email address, display name, and password hash (passwords are never stored in plain text).
• The workspace(s) you belong to and your role in each (member, admin, owner, affiliate, etc.).
• Email verification token and timestamp, when applicable.
• Login history (timestamp, result, approximate IP for fraud detection).

b. Exchange and trading data

• Encrypted exchange API credentials you choose to connect (Binance, Bybit, or MT5). Keys are encrypted at rest with per-tenant envelope encryption. We never request withdrawal permission on your keys and strongly recommend users do not grant it.
• Backtest runs, strategy configurations, scan candidates, signals, and trading records produced inside your workspace.
• Order submissions, fills, rejections, failure reasons, and reconciliation events tied to the connected exchange account.
• Metadata about which assets, timeframes, sessions, Kill-Zone windows, and risk settings you backtest or trade with.

c. Billing information

• Subscription plan, coin / credit balance, invoice history, and renewal state.
• Payment details are processed by Stripe directly — we do not store card numbers, CVCs, or bank credentials. Stripe returns a tokenised reference that we store against your account.
• Tax information where legally required (country, VAT ID when supplied).

d. Device and app information

• Device model, operating system version, app build / version, and language setting.
• Push notification token (FCM for Android, APNs for iOS) issued when you enable notifications. The token is tied to your account for routed alerts.
• Crash diagnostics and stability signals via Firebase Crashlytics (Google LLC) — this includes an installation ID, device model, OS version, stack trace, and a limited breadcrumb trail. Crashlytics does not collect precise location.
• Server-side request logs (IP, user agent, path, status code, latency) retained for security and operational diagnostics.

e. AI processing inputs

• When you use AI features (strategy founder, market scan reasoning, pattern analysis), the input prompt and the market context assembled by Trade Desk are sent to our AI sub-processors (OpenAI and Anthropic) for inference. Results are returned to Trade Desk and stored against your workspace.
• We do not send your email address, password, exchange API secrets, or billing details to these AI sub-processors.
• OpenAI and Anthropic have confirmed they do not train their foundation models on data submitted through their paid API endpoints, which is the channel Trade Desk uses.

f. Information we do NOT collect

• Precise or approximate location (we do not request location permission).
• Camera, photo library, or microphone content (we do not request these permissions).
• Contacts, calendar, or health data.
• SMS, call logs, or any other on-device communication.

If a future release of Trade Desk introduces biometric sign-in (Face ID / Touch ID), the biometric template never leaves your device — it is handled by the operating system's secure enclave and only a boolean "unlocked" signal is passed back to the app.

• To operate Trade Desk — authenticate you, show your workspaces, run backtests, dispatch scans, route orders to the exchange account you have authorised, and reconcile executions.
• To send transactional emails (welcome, verification, password reset, trade confirmations, failed-order notifications, renewal reminders, affiliate-commission notices, support replies).
• To send push notifications you have opted in to receive — new scan candidates, order fills, rejection alerts, subscription changes, and other account-critical events.
• To bill you accurately for subscriptions, coin packs, and paid strategies purchased.
• To diagnose crashes, debug failures, prevent abuse, and keep the platform operational.
• To respond to Support tickets you submit.
• To comply with legal obligations (anti-money-laundering, tax, lawful requests from authorities) and to protect our rights and other users.
• We do not sell your personal information. We do not run behavioural advertising. We do not profile you to build a saleable segment.

We share only the minimum needed to deliver Trade Desk:

• Exchange operators — order submissions, cancellations, and reconciliation calls are sent to Binance, Bybit, or MT5 using the API credentials you provided.
• Stripe — handles payment card data under its own PCI-DSS certified environment. We receive only a tokenised reference, the amount, and the result.
• Resend — our transactional email delivery provider. Receives recipient email, subject, body, and send metadata.
• Firebase (Google LLC) — Crashlytics stability data and FCM push notification routing.
• Apple Push Notification service (APNs) — delivery of push notifications on iOS.
• OpenAI, Anthropic — AI inference as described in Section 2e.
• Infrastructure providers — our Managed Kubernetes host and MongoDB cluster provider operate the servers that run Trade Desk. They do not read your data as a routine matter.
• Workspace administrators — may view audit events and workspace-scoped data as part of operating their team workspace.
• Legal authorities — where required by lawful request or court order.

We do not sell, rent, or share your data for advertising. We do not share data across unrelated workspaces.

• Transport: HTTPS/TLS 1.2+ for all client ↔ server traffic.
• Storage: data at rest is stored in access-restricted databases with encrypted volumes. Exchange API secrets are additionally wrapped with per-tenant application-level encryption so a database dump alone cannot recover them.
• Password hashing: salted bcrypt with a work factor tuned to current hardware.
• Access control: workspace-scoped reads/writes with role checks enforced on every request.
• Audit logging: sensitive events (login, API-key add/remove, strategy transfer, trade execution) are logged with timestamp and actor.
• No security control is perfect. Report suspected security issues to privacy@bsct.cloud and we will investigate promptly.

• Account record: for the lifetime of your account plus up to 24 months after closure for dispute, audit, and anti-abuse purposes.
• Billing records: 7 years from the invoice date, as required by applicable tax law.
• Trading records (orders, fills, backtests, scan history): retained for the lifetime of your workspace. Workspace administrators may delete older runs on request.
• Server request logs: 30 days by default; up to 90 days where retained for security investigation.
• Push notification tokens: deleted when you log out or disable notifications.
• Support tickets and email correspondence: 24 months.
• When you ask us to delete your account (see Section 7 and the Support page), we remove or irreversibly anonymise data within 30 days except where law requires longer retention — in which case we isolate it from active systems.

Depending on where you live, you have the right to:

• Access the personal information we hold about you.
• Correct inaccurate or incomplete information.
• Request deletion of your account and the personal information tied to it. Use the Support page at /support#delete-account or email privacy@bsct.cloud. We verify your identity before processing a deletion request.
• Export a copy of your personal data in a portable format (CSV / JSON) for backtest history, strategies, and scan candidates.
• Object to or restrict certain processing.
• Withdraw consent for optional processing (e.g. push notifications) at any time, from in-app settings.
• Lodge a complaint with your local data protection authority. For UAE residents, contact the UAE Data Office.

Requests are free of charge and answered within 30 days. For account deletion specifically, see our step-by-step process on the Support page.

Trade Desk is not directed to anyone under the age of 18 and we do not knowingly collect personal information from minors. If you believe a minor has created an account, contact privacy@bsct.cloud and we will remove it.

We may update this Privacy Policy from time to time. When we do, we update the "Last updated" date at the top of this page. Material changes will be communicated through in-app notice and / or email at least 7 days before they take effect. Continued use of Trade Desk after the effective date means you accept the updated policy.

Questions, requests, or complaints about this Privacy Policy can be sent to: