1. Who is responsible

The data controller is the sole proprietorship operating Tack (KvK 82826757, Netherlands). For any privacy question or request, contact privacy@tacktrading.com.

2. What we collect

Account: your email and a hashed (never plaintext) password.
Settings: your risk mode and account preferences.
Trading records: your bot's positions, trades, and equity history.
Exchange keys: your Bitvavo API key and secret, encrypted at rest and usable only to place trades on your own account — we require trade-only keys with withdrawals disabled.
Technical: limited server logs and IP address, used to keep the service secure and rate-limit abuse.
Payment data: none. Tack is free and invite-only — we never ask for, see, or store any payment details.

3. Why we use it (legal basis)

To provide the service you asked for (performance of our contract); to keep the service secure and prevent abuse (our legitimate interest); to meet legal obligations such as keeping tax records; and, only if you opt in, to send product updates (consent, withdrawable anytime).

4. What we never do

We never hold your funds, never store a withdrawal-capable key, and never sell your data or share it for advertising.

5. Who processes data for us

We use a small set of processors, each under a data-processing agreement:

• Bitvavo — trade execution on your own account (uses your keys).
• Hetzner — server hosting, in the EU (Germany).
• Our email provider — account and security emails.

Your data is stored in the EU. We do not transfer it outside the EU/EEA except where a provider offers GDPR-adequate safeguards.

6. How long we keep it

We keep your account data while your account is active. When you delete your account, your bot is removed and your keys and personal data are erased from our servers. Since Tack is free there are no billing or tax records to retain — only anonymised, non-identifying operational logs.

7. Security

Exchange keys are encrypted at rest and isolated per customer; each customer's bot runs in its own sandboxed container. Traffic is served over HTTPS. We require trade-only keys so that even in a worst case, funds cannot be withdrawn from your exchange account.

8. Your rights

Under the GDPR you can access, correct, export, delete, restrict, or object to the processing of your data. Delete your account at any time from Settings → Delete account, or email privacy@tacktrading.com. If you believe we've mishandled your data, you can complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or your local authority.

9. Cookies

We use a single essential cookie to keep you signed in. We don't use advertising or third-party tracking cookies.

10. Changes

We'll post any update here with a new date and, for material changes, notify you by email.

Data requests: privacy@tacktrading.com