1. Who is responsible for your data
The controller is EliteXCharts, LLC, a limited liability company organized under the laws of the State of Delaware, United States of America, with its registered office at 131 Continental Dr, Suite 305, Newark, DE 19713, USA, responsible for deciding what is collected and why. We handle requests by e-mail only.
For anything privacy-related — including access, correction or deletion requests — write to legal@elitexcharts.com.
Data protection officer (LGPD, art. 41): the EliteXCharts Data Protection Officer, at legal@elitexcharts.com. No representative in the European Union has been appointed at this time (GDPR, art. 27); data subjects in the European Union may exercise their rights at the same address.
2. The short version
If you read only one section, read this one:
- We don't sell your data. No one pays us for it. Measuring our ads on Meta and Google (below) may count as a “sale” or “sharing” of data under some US state laws, and you can refuse it at any time (section 12).
- We never see your card. Payments run entirely inside Stripe.
- We never see your broker password. It stays in your operating system's vault, encrypted, and never reaches us.
- App sync is on by default. It sends your trading accounts — Rithmic user, broker, balances and net result — and your trades to our server, where our team uses them for support and in our internal dashboard. You can switch it off in the app (section 6).
- The app's activity log goes to Sentry and includes your account id and figures from your trading accounts, such as balance, result and target (section 4).
- We identify the computer to keep a single open session at a time, to show your account's list of computers and to allow one free trial per computer. We store a cryptographic digest, never the serial number itself.
- We keep a record of every access to your account — date, time, IP, city, internet provider and computer — for 12 months, for your account's security and fraud prevention (section 4).
- The cookie rules depend on where you are. In Brazil, the European Union (and the European Economic Area), the United Kingdom and Switzerland, session recording, analytics cookies and ad measurement only run if you accept the banner — Google Analytics always loads, but without cookies. In the United States and the rest of the world they are on by default, and you can stop sharing your data for ads at any time through the Your privacy choices link in the footer; your browser's Global Privacy Control signal counts as that request too (sections 12 and 14).
- When you create an account, start a free trial or buy, we tell Meta and Google, to learn which ad or post brought you: with your consent where we ask for it, or until you opt out everywhere else. What goes is your e-mail as a hash (irreversible), the ad click identifier, the IP address and the browser (section 4).
- We record where each visit comes from, with 400-day cookies, for the affiliate programme and campaign measurement (section 4).
- You can delete your account yourself, from the panel, without asking anyone.
3. Data you give us
| What | When | Why |
|---|---|---|
| E-mail and password | When you create the account | To identify you and protect access. The password is stored as a hash (scrypt), never as text. |
| E-mail confirmation | After sign-up | To confirm the address is yours. We keep the link sent and the address until the account is anonymised. |
| Product news e-mail preference | At sign-up (the box comes ticked) and in the preference centre | To send product news and to record your choice, with date, IP and browser, as proof. |
| Record of your acceptance of the Terms and this Policy | When you create the account and each time you accept the Terms and the Policy | To prove acceptance. We keep the version of each document, the date and time, the IP, the country, the browser and the source (website, app or admin panel). |
| Display name and avatar | Optional, in your profile | To personalise the interface. |
| On the waiting list | To tell you when the beta opens. Double opt-in — we only write to people who clicked the link. | |
| Name, e-mail and message | In the contact form | To reply to you. |
| Text, screenshots and diagnostics | When you send feedback from the app | To reproduce and fix the problem. You take the screenshot and you see what you're sending. |
| Billing details | On subscribing or purchasing | Processed by Stripe. We only get back the last digits, the brand and the status — never the full number. |
| Commissions and payouts | If you join the affiliate programme | To calculate and pay your commissions. We keep your referrals, commissions, payouts and the details you provide to receive them. |
4. Data generated by use
On the website. On every visit, regardless of the banner, we set two attribution cookies in your browser, valid for 400 days: xc_vid, a random browser identifier, and xc_attr, where your visits came from. Each time a new source appears, we send our server that identifier, the source (UTM parameters, ad click identifiers such as gclid and fbclid, the fbc cookie, the landing page and the referring site), the IP address, the country reported by Cloudflare's edge, the browser agent and your consent status. This supports the affiliate programme and the measurement of our campaigns.
Sign-up, free trial and purchase. When you create an account, start a free trial, buy or renew a plan, our server tells Meta (Facebook and Instagram, through the Conversions API) and Google (through Google Analytics), to learn which ad or post brought you. There is no Meta pixel on the website: this is sent from our server. Meta receives the event, your e-mail as a hash (SHA-256, irreversible), a hashed identifier of your account, the ad click identifier (fbc), the IP address, the country and the browser; Google Analytics receives the event, your browser's Google Analytics identifier and your internal account id. For purchases, both also receive the amount and the order number.
Where we ask for consent — Brazil, the European Union, the European Economic Area, the United Kingdom and Switzerland —, Meta only receives this if you accept the banner, and Google Analytics only with analytics consent. In the United States and the rest of the world, sending is the default, unless you had already rejected the cookie banner; once you opt out, or when your browser sends the Global Privacy Control signal, nothing more goes to Meta, and Google Analytics receives the event without the advertising signals.
In every region, this only applies to accounts created under this version of the policy or a newer one: sign-ups, free trials and purchases of older accounts are not sent.
Referrals through the app. Clicks on affiliate links are recorded with the IP address. If you create your account in the app without a referral, we link the account to the affiliate whose link was clicked from the same IP address in the previous 7 days.
In the app. We send usage events — which tools were opened, which version is installed, which operating system — to understand what gets used and what needs work. Sending these events can be turned off with the environment variable ELITEX_TELEMETRY=off.
Crashes. When the app breaks, an error report goes to Sentry with the stack trace, the version and the operating system. It identifies you only by your internal account id — no e-mail, and IP sending is turned off.
Activity log. The app keeps a log of what happens while you use it (the log file), and that log is mirrored to Sentry Logs. It includes your internal account id and information from your trading accounts, such as balance, net result and target. We use it to diagnose failures and provide support.
Your account's computers. We keep the list of computers you have signed in on, with each one's name, and while the platform is open the app sends a presence signal every minute. This is what lets us keep a single open session at a time (section 5).
Access log. We keep a record of every access to your account: signing in (including refused attempts), signing out, the start and end of each session, password or e-mail changes, coupon redemptions and plan changes. Each record carries the date and time, the IP address, the city, country and internet provider reported by Cloudflare's edge, the computer (section 5) and the app version or browser. We use this record to protect your account and to prevent free-trial fraud.
5. Identifying your computer
This section exists because the practice deserves an explanation, not a line buried in the middle of the text.
What it is for. You can use your account on as many computers as you like, but with a single open session at a time: signing in on one computer ends the session open on the others, and the app asks first if the platform is open on another one. To do that, the server needs to recognise which computer you are on. It also needs to know whether that computer has already used a free trial, because the free trial is one per computer.
What we do. When you sign in through the app, it reads a few identifiers from your computer, turns each one into an irreversible cryptographic digest (SHA-256) on your machine, and sends only those digests. The server applies a second layer of protection before storing them.
| System | What is read | Why this one |
|---|---|---|
| Windows | The Windows installation identifier and the motherboard identifier (SMBIOS) | They survive reinstalling the app |
| macOS | The platform identifier and the hardware serial number | Same reason |
| Both | A random identifier the app generates itself, another one it keeps in the operating system vault, and the physical address of the first network adapter | Supporting signals, weighted lower |
| Both | The computer's manufacturer and model, as the system reports them | To recognise a virtual machine. Sent as text: they tell the kind of equipment, not which one is yours |
What we do not do. We do not store the serial number, the network address or any identifier in readable form. What sits in our database cannot be reversed into the original value or used to tell which machine is yours. We never use this for advertising or profiling.
What it decides. Which computer holds the open session, which computers appear in your account and whether that computer can still use a free trial. It does not limit how many computers you use. A computer that has already used a free trial cannot use another, with any account: if an account on a free trial tries to sign in on a computer that already had one, it does not get in and loses the trial, on every computer. The free trial is also not available on a virtual machine or a virtual private server (VPS): trying to sign in on one with a free trial has the same effect. The check happens when you sign in through the app, not at sign-up. None of this affects subscribers: a subscriber uses the platform on any computer, virtual machines included.
IP address and review. The IP address of each access (section 4) is only supporting evidence. On its own it never ends a trial, because many people share the same IP, on mobile internet and with many providers. When the signals are not enough to be sure, the case goes to our team for review, and they decide before anything is done.
6. Your trading data
App sync is on by default. While it is on, the app sends our server your registered trading accounts — with your Rithmic user, the broker, the starting, current and ending balances and the net result —, your orders, fills and trades, your journal notes and your workspace settings.
This data is available to our team in our internal dashboard and is used to provide support and to monitor how the platform is working.
You can switch sync off, entirely or by category, in the app's Account window. Once it is off, this data is no longer sent.
We pass this to no one, we don't use it for market analysis, we don't aggregate it into a product and we don't sell it.
7. AI Assistant
The Assistant uses your API key, from the provider you choose (Anthropic, OpenAI, Google or OpenRouter).
When you use it, the conversation context goes from your computer straight to the provider you chose and we do not store it. Its handling is then governed by that provider's own policy.
The exception: when the Assistant's guard detects an attempt to obtain the platform's internal logic (Terms of Use, Section 15.3), the message and the conversation excerpt — up to 8,000 characters — are sent to our server, where they are recorded, and by e-mail to our team, for review.
Your API key stays in your machine's operating system vault.
8. Who we share with
Only those needed to run the service, and only what they need — plus, to measure our ads, Meta and Google, as described in section 4. Apart from those two, none of them receives your data for their own use; Meta and Google also handle what they receive under their own policies.
| Who | What for | What they get |
|---|---|---|
| Stripe | Payments and subscriptions | Name, e-mail and card details (which we never see). The card stays saved in Stripe for subsequent charges. |
| Amazon SES and Resend | Transactional e-mail | E-mail address and message content |
| listmonk (run by us on a dedicated server) | Product news e-mails | E-mail address and your sending preference |
| Cloudflare | Hosting of the website and the server, database, file storage (feedback screenshots and installers), CDN and bot protection (Turnstile) | The platform data we store, plus IP, country and request data |
| Sentry | App crash reports and activity log | Stack trace, version, OS, your internal account id and the log lines (section 4) |
| Google Analytics 4 | Website audience measurement and, from our server, of sign-ups, free trials and purchases | Browsing data and IP on every visit; analytics cookies with your consent, where we ask for it. From the server, the event, the browser's Google Analytics identifier and the internal account id (section 4) |
| Meta (Facebook and Instagram) | Ad measurement (Conversions API): learning which ad or post brought the sign-up, the free trial or the purchase | The event, the hashed e-mail, a hashed account identifier, the click identifier, the IP, the country and the browser. With your consent where we ask for it, or until you opt out (section 4) |
| Contentsquare | Website heatmaps and session recording | If you accept the banner, where we ask for consent; on by default everywhere else |
| The AI provider you choose | AI Assistant | Your conversation context, straight from your machine |
| GexBot | Gamma Levels, called directly from the app with your key | Your key, the level queries and your computer's IP |
| Economic calendar (nfs.faireconomy.media) | Economic events, fetched directly by the app | Your computer's IP and the request |
| Google Drive / Dropbox / OneDrive | Exporting files, when you ask | Only the file you chose to send |
We may also disclose data where legally required, under a court order, or to investigate fraud and protect rights.
9. Our legal basis for each purpose
| Purpose | GDPR | LGPD |
|---|---|---|
| Creating and running your account, delivering the platform, keeping the single session | Art. 6(1)(b) | Contract performance (art. 7, V) |
| Billing, invoicing and tax obligations | Art. 6(1)(c) | Legal obligation (art. 7, II) |
| Security, fraud prevention (including the one-free-trial-per-computer rule), the AI Assistant guard and device identification | Art. 6(1)(f) | Legitimate interest (art. 7, IX; art. 10) |
| Access log (date, time, IP and computer of each access) | Art. 6(1)(f) | Legal obligation (art. 7, II; Marco Civil da Internet, art. 15) and legitimate interest (art. 7, IX) |
| Sync for support and the internal dashboard, the activity log and app telemetry | Art. 6(1)(f) | Legitimate interest (art. 7, IX) |
| Referral attribution and campaign measurement | Art. 6(1)(f) | Legitimate interest (art. 7, IX) |
| Cookieless audience measurement (Google Analytics without consent) | Art. 6(1)(f) | Legitimate interest (art. 7, IX) |
| Analytics cookies, heatmaps and session recording | Art. 6(1)(a) | Consent (art. 7, I) |
| Telling Meta and Google about sign-ups, free trials and purchases, to measure our ads | Art. 6(1)(a) | Consent (art. 7, I) |
| Product news e-mail | Art. 6(1)(f) | Legitimate interest (art. 7, IX) |
Where consent is the basis, you can withdraw it at any time — this does not affect what was done before, and you do not lose access to the product. Where legitimate interest is the basis, you can object: product news e-mails stop through the unsubscribe link or the preference centre, and for anything else just write to the address in section 1.
We ask for consent in Brazil, the European Union, the European Economic Area, the United Kingdom and Switzerland. In the United States and the rest of the world, analytics, session recording and ad measurement are on by default. In US states with a privacy law, you have the right to ask that your data not be sold or shared for advertising: that is the request made through the Your privacy choices link in the footer, and your browser's Global Privacy Control signal counts as one (section 12).
10. How long we keep it
| Data | Period |
|---|---|
| Account and content (settings, journal, trading accounts, orders, the account's computers) | For as long as the account exists |
| Deletion request | 30-day grace period, then the account is anonymised |
| Active sessions (refresh token) | 30 days, renewed on each use |
| Billing and revenue records | Kept after deletion, for tax and accounting obligations |
| Record of acceptance of the Terms and this Policy | For as long as the account exists; on deletion, the IP, country and browser are erased, and the version and date are kept as proof of acceptance |
| Text recorded by the AI Assistant guard | Until the account is anonymised |
| Visit origin (attribution) | Records linked to an account are deleted on anonymisation; those of visitors without an account are kept for as long as needed to settle referrals and measure campaigns |
| Cryptographic digests of the computer and the record that it used a free trial | The link to the account is deleted on anonymisation; the digests and the trial record, unlinked, may remain (section 5) |
| Access log (section 4) | 12 months; if the account is deleted, each record is kept only until it is 6 months old |
| Suppression list (people who asked not to be e-mailed) | For as long as the address is in our database; it is deleted when the account is anonymised |
| Google Analytics | 14 months |
| Meta (ad measurement) | Under Meta's data policy |
| Contentsquare and Sentry | As configured in each service's retention settings |
11. Your rights, and how to use them
The GDPR (arts. 15–22) and the LGPD (art. 18) give you: confirmation that we process your data, access to it, correction, anonymisation or erasure, portability, information about who we share it with, objection to processing based on legitimate interest, and withdrawal of consent.
Account deletion: from the panel, under My account → Delete account. You do it yourself, without waiting on us. The request ends your open sessions, deactivates the account for 30 days and stops the plan from renewing. During that window you can change your mind by signing in again: the account and the plan carry on normally, and the plan resumes renewing, unless you had already asked to cancel it. Without that, the account is anonymised at the end of the window and the plan ends.
E-mails: through the preference centre, or the unsubscribe link at the foot of any message.
Cookies, session recording and ads: at any time, through the link in the footer of any page of the site — Cookie preferences, where we ask for consent, to accept or reject again, and Your privacy choices, everywhere else, to opt out or allow again. Once you reject or opt out, your data stops being sent to Meta and Google to measure ads; what was already sent follows each one's policy.
Contentsquare: where we ask for consent, rejecting stops Contentsquare from being loaded, and we delete the cookies and data it stored in your browser for this site; what was already sent follows Contentsquare's policy. In the United States and the rest of the world it is on by default, and opting out does not turn it off: it measures how our own site is used and is not used for ads. If you had already rejected the cookie banner, it stays off until you choose Allow under Your privacy choices.
App sync: in the app's Account window (section 6).
Anything else: write to legal@elitexcharts.com. We reply within 15 days.
You may also complain to your national data protection authority in the EU, or to the ANPD in Brazil.
12. If you are in the United States
The privacy laws of several US states, such as California's (the CCPA, as amended by the CPRA), give residents of those states the right to:
- Know what personal data we process about you, where it came from, what it is used for and who we share it with, and get a copy of it;
- Delete the data we collected from you;
- Correct data that is inaccurate;
- Opt out of the sale or sharing of your data for targeted advertising;
- Not be discriminated against for exercising these rights: the price, the plan and your access stay the same;
- Appeal a refusal, asking us to review your request. If the appeal is also refused, you can complain to your state's Attorney General.
We don't sell data for money. But telling Meta and Google about sign-ups, free trials and purchases to measure our ads (section 4) may count as “sharing” or “targeted advertising” under these laws. That is why you can refuse it at any time, through the Your privacy choices link in the footer of any page of the site. Your browser's Global Privacy Control signal counts as that request, with nothing else for you to do.
For the other rights, or to appeal, write to contact@elitexcharts.com. We reply within 15 days. Before acting on a request, we may ask you to confirm it is yours — for example, by sending it from your account's e-mail address —, and an authorised agent may also make the request on your behalf.
13. International transfers
Our servers and some processors sit outside the European Union and outside Brazil. Using the platform means your data may be processed in those countries, always under the contractual safeguards the applicable law requires — standard contractual clauses and the processors' own protection commitments.
15. Security
All traffic between your computer and our servers is encrypted (TLS). Passwords are stored as salted hashes, never as text. Secrets on your machine — broker password, AI key — stay in the operating system vault, not with us.
No system is impenetrable. Should an incident occur that poses a meaningful risk to you, we will notify you and the competent authorities within the legal deadlines.
16. Minors
The platform is not intended for anyone under 18 and we do not knowingly collect data from children. If we identify such a registration, it will be removed.
17. Changes to this policy
When something material changes, we will tell you by e-mail or inside the product before it takes effect. The date at the top always shows the last revision.