This privacy notice for Trade Automation Toolbox, LLC ("Company," "we," "us," or "our"), describes how and why we might collect, store, use, and/or share ("process") your information when you use our services ("Services"), such as when you:
- Visit our website at tradeautomationtoolbox.com, or any website of ours that links to this privacy notice;
- Download and use our desktop application (Trade Automation Toolbox); or
- Engage with us in other related ways, including customer support, sales, marketing, or events.
Reading this privacy notice will help you understand your privacy rights and choices. If you do not agree with our policies and practices, please do not use our Services. If you have any questions or concerns, please contact us at support@tradeautomationtoolbox.com.
Summary of Key Points
- What personal information do we process? When you visit, use, or navigate our Services, we may process personal information depending on how you interact with Trade Automation Toolbox, LLC and the Services, the choices you make, and the features you use.
- Do we process any sensitive personal information? Only in limited form. We collect your TAT account login credentials and, through Stripe, payment card information, which California law treats as sensitive personal information; we use them only to provide the Services, secure your account, and process payments. We do not collect Social Security numbers, driver's license numbers, genetic data, biometric identifiers, or precise geolocation data.
- Do we receive information from third parties? We do not receive data from third-party data brokers. Private brokerage account credentials, tokens, and secret keys remain stored locally and encrypted on your machine.
- How do we process your information? We process your information to deliver software license keys, process subscription payments, maintain application security and stability, enforce single-user license limits, prevent software piracy, and comply with law. We also process encrypted database backups solely at user direction. The Software also transmits mandatory summary usage data (trade and order counts, quantities, symbols, broker, and a truncated partial brokerage account number) to enforce subscription usage limits, and, only if you opt in, uploads trade records to generate your trade reports.
- With whom do we share personal information? We do not sell or rent your personal information. We only share personal information with vetted, authorized service providers strictly as necessary to provide our services:
- Stripe, Inc. for payment processing and subscription billing management;
- Hivelocity, Inc. for dedicated server hosting, infrastructure, and license verification APIs, and storage of usage and trade reporting data;
- Backblaze, Inc. for encrypted cloud backup storage; and
- Postmark for transactional email delivery (account notices, license delivery, and legal communications).
- How do we keep your information safe? We maintain administrative, technical, and physical safeguards. Private broker API secret keys and passwords are encrypted locally on your personal computing hardware and are not hosted or monitored centrally by TAT.
- What are your rights? Depending on where you reside, applicable privacy laws (such as GDPR, UK GDPR, or California CCPA/CPRA) grant you specific rights regarding your personal information.
- How do you exercise your rights? The easiest way to exercise your rights is by submitting a verifiable request to support@tradeautomationtoolbox.com.
1. What Information Do We Collect?
Personal information you disclose to us: We collect personal information that you voluntarily provide to us when you register on the Services, express an interest in obtaining information about us or our products, participate in activities on the Services, or contact customer support.
The personal information we collect may include: names, email addresses, billing addresses, phone numbers, account passwords, and IP addresses/telemetry identifiers.
Sensitive Personal Information & No Derived Profiling: Trade Automation Toolbox, LLC COLLECTS ONLY LIMITED "Sensitive Personal Information" (as defined under Cal. Civ. Code § 1798.140(ae)), consisting of (i) your TAT account log-in in combination with your account password and (ii) payment card numbers and security codes, which are collected and stored by Stripe, Inc. This information is used solely to provide the Services, authenticate you, secure your account, and process payments, as permitted under Cal. Civ. Code § 1798.121(d) and 11 CCR § 7027(m), and is not used to infer characteristics about you. While the Software and licensing servers process IP addresses and unique machine GUIDs solely for technical software license verification, single-user seat enforcement, and application security, the Company does not combine, infer, profile, or derive any characteristics, preferences, behavior, or sensitive insights regarding consumers from this technical telemetry, Usage Data, or Trade Reporting Service data.
Payment Data: We collect data necessary to process your payment if you make purchases, such as your payment instrument number and security code. All payment data is processed and stored by Stripe, Inc. You may review their privacy policy at https://stripe.com/privacy.
Trade Data & Operational Telemetry: Trade Automation Toolbox is fundamentally a locally installed desktop client application. Your private broker account credentials, API secret keys, passwords, and trading triggers are stored locally and encrypted on your personal computing hardware. The Company does not host, intercept, or store unencrypted broker passwords or API secret keys on its central web servers. We collect technical telemetry, software license validation data, trigger execution timestamps, diagnostic error logs, and the mandatory Usage Data described below, as necessary to ensure your account operates within the authorized scope of your license tier (e.g., verifying personal vs. commercial use), prevent unauthorized commercial syndication, and maintain software integrity.
Database Backup Service Data: If you enable the optional Database Backup Service within the Software (Settings > Live Mode Settings > Database Backup), your local TAT database file (including historical trade records, templates, condition logic, schedules, and configuration parameters) will be encrypted and backed up to secure cloud storage hosted by Backblaze, Inc. This data is processed and stored in an encrypted format solely for user-directed archival storage, disaster recovery, data restoration, and seamless machine or virtual machine (VM) migration. The Company does not conduct real-time trade monitoring, active portfolio surveillance, or live order routing from backup files. You may disable backups or request deletion of stored backup archives at any time through Software settings or by contacting support@tradeautomationtoolbox.com.
Mandatory Usage Data: To measure and enforce the usage limits of your subscription plan, the Software automatically transmits summary usage information to our servers ("Usage Data"): counts of trades and orders placed through the Software; contract or share quantities; symbols and underlyings traded; the connected broker and a truncated partial brokerage account number; and associated timestamps, license key, machine GUID, and Software version. Usage Data is required to use the Software's live trading features and cannot be disabled. It does not include broker passwords, API secret keys or tokens, unhashed account numbers, account balances, or buying power. See Section 6.3 of the Terms of Use.
Optional Trade Reporting Service Data: If you choose to enable the optional Trade Reporting Service, the Software uploads trade records from your local TAT database to our servers, where they are processed in readable form to generate your reports. These records may include symbols, strategy and template names, order types, strikes, quantities, entry and exit times, fill prices, commissions and fees, and profit and loss, together with the connected broker and a truncated partial brokerage account number. The service is off by default, and you may disable it and request deletion of uploaded data at any time. This data is encrypted in transit and at rest. See Section 14.11 of the Terms of Use.
De-Identified, Aggregated Data: We may create de-identified, aggregated statistics from Usage Data and Trade Reporting Service data that do not identify you or any brokerage account, and use them to operate and improve the Software. We maintain such data in de-identified form, do not attempt to re-identify it, and do not sell your trade data or disclose your individual trade data to other users.
2. How Do We Process Your Information?
We process your personal information for specific business and operational purposes:
- To facilitate account creation, authentication, and user account management;
- To deliver and facilitate delivery of services, including software license activation and validation;
- To respond to user inquiries and provide technical and customer support;
- To send administrative information, terms update notices, and security alerts via transactional email;
- To fulfill and manage orders, payments, and subscription renewals;
- To prevent unauthorized commercial syndication, software piracy, and terms violations;
- To administer user-directed encrypted database backups for disaster recovery and VM migration;
- To measure and enforce subscription plan usage limits using mandatory Usage Data;
- To generate trade reports and analytics for you if you enable the optional Trade Reporting Service; and
- To create de-identified, aggregated statistics used to operate and improve the Software.
3. What Legal Bases Do We Rely On? (GDPR & UK GDPR)
If you are located in the European Union (EU) or United Kingdom (UK), we process your personal data under the following legal bases pursuant to Article 6 of the GDPR:
- Consent (Art. 6(1)(a)): Where you have given explicit consent for a specific purpose. You may withdraw consent at any time.
- Performance of a Contract (Art. 6(1)(b)): Where processing is necessary to deliver the Software, process subscriptions, fulfill user-directed encrypted database backups, provide requested customer support, measure and enforce subscription usage limits using Usage Data, and provide the Trade Reporting Service if you enable it.
- Legitimate Interests (Art. 6(1)(f)): Where processing is necessary for our legitimate commercial interests, including software license validation, single-user seat enforcement, piracy prevention, server infrastructure security, maintaining software stability, and creating de-identified, aggregated statistics to improve the Software (a formal Legitimate Interests Assessment ("LIA") is documented and on file).
- Legal Compliance & Dispute Defense (Art. 6(1)(c) & (f)): We maintain an immutable compliance audit trail of terms acceptance, modification notices, and decline events (including user account email, timestamp, IP address, machine GUID, software build version, terms version, and cryptographic SHA-256 hash of the presented agreements) to comply with statutory recordkeeping and defend against legal claims.
4. When and With Whom Do We Share Your Personal Information?
We share personal information solely with vetted third-party infrastructure and transactional service providers who require access to provide operational services:
- Payment Processor: Stripe, Inc. (payment processing, recurring billing, and tax calculations; global; https://stripe.com).
- Server Hosting & Infrastructure: Hivelocity, Inc. (dedicated server hosting, infrastructure, and licensing verification APIs, and storage and processing of Usage Data and Trade Reporting Service data; United States; https://www.hivelocity.net/).
- Encrypted Backup Storage: Backblaze, Inc. (encrypted cloud storage for user-initiated database backups via B2 cloud storage; United States; https://www.backblaze.com/).
- Transactional Email Delivery: Postmark (Wildbit LLC / ActiveCampaign LLC) (transactional email transmission for account notices, license key delivery, password resets, and legal communications; United States; https://postmarkapp.com/).
5. Cookies and Tracking Technologies
We may use cookies and similar tracking technologies (like web beacons and pixels) solely to maintain session state and secure website logins. We do not use third-party tracking cookies for targeted or cross-context behavioral advertising.
6. How Long Do We Keep Your Information?
We retain personal data strictly according to the following definitive schedules:
- Corporate, billing, tax, and license verification records: Retained for seven (7) years following subscription termination pursuant to statutory accounting and tax regulations.
- Technical licensing logs and operational telemetry: Retained on a rolling 90 to 180-day cycle (90–180 days), after which they are permanently purged or aggregated into non-identifiable statistical metrics.
- Encrypted database backups: Stored in encrypted cloud archives solely during active subscription status, and automatically purged thirty (30) days following account termination, cancellation, user disabling of the backup feature, or user deletion.
- Usage Data: Retained for the current billing period plus twenty-four (24) months, then deleted or converted into non-identifiable aggregated statistics.
- Trade Reporting Service data: Retained while the service is enabled and your subscription is active; deleted within thirty (30) days following your deletion request or account termination or cancellation, and within ninety (90) days after you disable the service.
- Terms acceptance audit logs (timestamps, IP addresses, machine GUIDs, version hashes): Retained for seven (7) years to defend legal claims and establish contractual assent.
- Customer support communications: Retained for three (3) years from resolution.
7. How Do We Keep Your Information Safe?
We have implemented administrative, technical, and physical safeguards designed to protect personal information. However, no electronic transmission over the internet or storage system can be guaranteed 100% secure. You are strictly responsible for maintaining physical and cyber security over your personal computing hardware, operating system, and broker API credentials as set forth in Section 4 of the Terms of Use.
8. Information From Minors
We do not knowingly solicit data from, market to, or permit use of the Services by individuals under 18 years of age. You affirmatively represent and warrant that you are at least 18 years of age. Individuals under 18 are strictly prohibited from using the Services. If we learn that personal information from an individual under 18 has been collected, we will immediately deactivate the account, revoke software access, and purge the data.
9. What Are Your Privacy Rights? (GDPR & UK GDPR)
If you reside in the EEA, UK, or Switzerland, you possess statutory rights under applicable data protection laws, including:
- The right to request access and obtain a copy of your personal data;
- The right to request rectification of inaccurate data or erasure of data;
- The right to restrict or object to the processing of your personal data;
- The right to data portability (where technically feasible); and
- The right to lodge a complaint with your local data protection supervisory authority.
To exercise these rights, email us at support@tradeautomationtoolbox.com.
Additional detail regarding our lawful bases for processing, international data transfers (including Standard Contractual Clauses and the UK International Data Transfer Addendum), data retention, and your rights under the GDPR and UK GDPR is set out in Section 14 of the Terms of Use, which is incorporated into this Privacy Policy by reference.
10. Controls for Do-Not-Track Features
Most browsers include Do-Not-Track ("DNT") settings. Because no uniform industry standard for DNT signals exists, our website does not currently respond to automated DNT browser signals.
11. California Consumer Privacy Act (CCPA / CPRA) Notice at Collection
This Section constitutes our CCPA/CPRA Notice at Collection for California residents:
| Statutory Category |
Examples |
Business Purpose |
Disclosed To |
| Category A: Identifiers |
Name, email address, billing address, phone number, IP address, machine GUID, software license key. |
Software license validation, transaction processing, account administration, security. |
Stripe, Hivelocity, Postmark. |
| Category B: Customer Records |
Name, billing address, phone number, payment card information (collected and stored by Stripe). |
Transaction processing, account administration. |
Stripe, Postmark. |
| Category D: Commercial Information |
Subscription history, billing records, license renewal status. |
Contract fulfillment, corporate accounting, tax compliance. |
Stripe, corporate accounting advisors. |
| Category D: Commercial Information (Usage Data – mandatory) |
Trade and order counts, contract quantities, symbols/underlyings traded, connected broker, truncated partial brokerage account number, timestamps. |
Measuring and enforcing subscription usage limits; license-abuse prevention. |
Hivelocity. |
| Category D: Commercial Information (Trade Reporting Service – optional) |
Uploaded trade records: symbols, strategy/template names, order types, quantities, strikes, entry/exit times, fill prices, fees, P&L, connected broker, truncated partial brokerage account number. |
Generating user-requested trade reports; de-identified aggregate product analytics. |
Hivelocity. |
| Category F: Internet / Network Activity |
Application launch telemetry, build version, OS environment, error logs. |
License anti-piracy verification, software stability, debugging. |
Hivelocity. |
| Category G: Geolocation Data |
Coarse, non-precise IP-based geographic location. |
Territorial license compliance, tax jurisdiction, fraud prevention. |
Hivelocity, Stripe. |
| Encrypted Database Backups (Categories A, B, and D, as applicable) |
User-initiated encrypted database archives. |
Disaster recovery, data restoration, machine migration. |
Backblaze (encrypted storage). |
| Category L: Sensitive Personal Information |
TAT account log-in with password; payment card number and security code (collected by Stripe). |
Authentication, account security, and payment processing only (Cal. Civ. Code § 1798.121(d)). |
Stripe. |
Affirmation Regarding Sale or Sharing: Trade Automation Toolbox, LLC DOES NOT SELL your Personal Information and DOES NOT SHARE your Personal Information for cross-context behavioral advertising. We have not sold or shared personal information in the preceding twelve (12) months.
Submitting CCPA Requests: California residents may submit a verifiable consumer request by emailing support@tradeautomationtoolbox.com (Subject: CCPA Consumer Rights Request) or calling (872) 222-7499. We respond within forty-five (45) calendar days.
12. Other U.S. State Privacy Rights
Residents of Colorado, Connecticut, Virginia, Utah, Texas, Oregon, and other states with comprehensive consumer privacy laws enjoy statutory rights to access, correct, delete, or obtain a portable copy of personal information, and to opt out of data sales or targeted advertising. Trade Automation Toolbox, LLC does not sell personal information or engage in targeted behavioral advertising. To exercise state privacy rights, email support@tradeautomationtoolbox.com.
13. Illinois Biometric Information Privacy Act (BIPA) Compliance
Trade Automation Toolbox, LLC is headquartered in McLean County, Illinois. The Company affirmatively warrants and certifies that:
- It DOES NOT collect, capture, purchase, receive through trade, obtain, record, or store any "biometric identifiers" (such as retina or iris scans, fingerprints, voiceprints, or scans of hand or face geometry) or "biometric information" (as defined under 740 ILCS 14/10);
- The Software does not utilize facial recognition, fingerprint verification, or biometric telemetry for authentication or licensing; and
- If the Company ever contemplates incorporating biometric technology in the future, it shall first publish a written BIPA policy, establish a retention schedule, and obtain prior informed written consent in strict compliance with 740 ILCS 14/15.
14. Legal Process, Subpoena Response & Government Inquiries
The Company may disclose personal information (such as account registration email, billing records, or IP logs) in response to lawful subpoenas, court orders, or verified government investigatory demands. Prior to producing responsive records regarding any subscriber, the Company will (to the maximum extent permitted by applicable law, grand jury secrecy rules, or non-disclosure orders) provide advance written notice to the affected user at their registered email address, allowing ten (10) business days for the user to seek a protective order or move to quash.
15. Authorized Sub-Processors & Data Processing Agreements
Current authorized Sub-Processors include:
- Stripe, Inc. (payment processing and billing management; global; https://stripe.com);
- Hivelocity, Inc. (dedicated server infrastructure, server hosting, and licensing verification APIs, and storage and processing of Usage Data and Trade Reporting Service data; United States; https://www.hivelocity.net/);
- Backblaze, Inc. (encrypted cloud backup storage for user-initiated database backups via B2 cloud storage; United States; https://www.backblaze.com/); and
- Postmark (Wildbit LLC / ActiveCampaign LLC) (transactional email transmission for account notices, license key delivery, password resets, and legal communications; United States; https://postmarkapp.com/).
The Company maintains executed Data Processing Agreements (DPAs) incorporating European Commission Standard Contractual Clauses (SCCs) with all Sub-Processors.
16. Security Incident & Data Breach Notification
In the event of a confirmed security breach involving personal information under the Illinois Personal Information Protection Act (815 ILCS 530/) or GDPR Articles 33–34, the Company will notify the Illinois Attorney General and competent supervisory authorities without unreasonable delay (and within 72 hours where feasible). Affected users will be notified without unreasonable delay via their primary account email with descriptions of the incident, compromised data categories, and recommended protective measures.
17. Contact Us
If you have questions or comments about this Privacy Policy, you may contact us at:
Trade Automation Toolbox, LLC
14671 Knob Hill Dr
Heyworth, IL 61745
United States
Email: support@tradeautomationtoolbox.com
Phone: (872) 222-7499