Privacy Policy

Last updated: 4 May 2026  |  Effective date: 4 May 2026

1. Who We Are

Signal Copier by Orion is operated by 762SUP LIMITED, a company incorporated in England and Wales (Company Number: 16797920), with registered office at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom.

For any privacy-related enquiry, contact us at: contact@signalcopier.app

2. Data We Collect

We collect and process the following categories of personal data:

• Account data: email address and hashed password (bcrypt), used solely for authentication.
• Telegram credentials: your Telegram phone number and an encrypted session string, used to connect your account to the signal-listening service. We never store your Telegram password.
• Broker credentials: your MT4/MT5 broker server, account number, and EA token. Passwords are not stored; the EA token is generated locally.
• Trading signals: signal text, parsed instrument, direction, SL/TP levels and execution status, stored for 90 days to allow history review.
• Payment data: subscription status and Stripe customer ID. Full card details are processed exclusively by Stripe and are never transmitted to or stored by us.
• Technical data: IP address (for rate limiting and fraud prevention), device type, app version, and error logs.

3. Legal Basis for Processing (GDPR)

• Contract performance (Art. 6(1)(b)): processing necessary to deliver the signal-copying service you subscribed to.
• Legitimate interests (Art. 6(1)(f)): fraud prevention, system security, and service improvement.
• Legal obligation (Art. 6(1)(c)): financial record-keeping and regulatory compliance.
• Consent (Art. 6(1)(a)): for any optional marketing communications (you may withdraw at any time).

4. How We Use Your Data

• Authenticate your account and maintain your session.
• Connect to your Telegram channels and forward trading signals to your broker.
• Process your subscription payment via Stripe.
• Send transactional emails (subscription confirmation, expiry notice).
• Detect and prevent abuse, fraud, and unauthorised access.
• Improve application performance and reliability.

5. Data Sharing

We do not sell your personal data. We share data only with the following processors under data processing agreements:

• Stripe, Inc. — payment processing (USA, EU Standard Contractual Clauses).
• Railway Corp. — cloud hosting for the backend API (USA, SCCs in place).
• Telegram Messenger Inc. — messaging service (you connect your own account; Telegram's privacy policy applies to that connection).

We may disclose data to law enforcement or regulatory authorities if required by applicable law.

6. Data Retention

• Account data: retained for the duration of your account, then 30 days after deletion request.
• Trading signals: 90 days rolling window.
• Payment records: 7 years (UK financial regulation).
• Technical logs: 30 days.

7. International Transfers

Our servers are hosted in the USA via Railway. Transfers to the USA are protected by Standard Contractual Clauses (SCCs) as approved by the European Commission.

8. Your Rights (GDPR / UK GDPR)

As a data subject you have the right to:

• Access — request a copy of your personal data.
• Rectification — correct inaccurate data.
• Erasure — request deletion ("right to be forgotten").
• Restriction — limit processing in certain circumstances.
• Portability — receive your data in a machine-readable format.
• Objection — object to processing based on legitimate interests.
• Withdraw consent — at any time, without affecting prior lawful processing.

To exercise any right, email contact@signalcopier.app. We will respond within 30 days. You also have the right to lodge a complaint with the UK ICO (ico.org.uk) or your local supervisory authority.

9. Security

We implement industry-standard security measures: TLS encryption in transit, bcrypt password hashing, token-based authentication, rate limiting, and regular dependency audits. No system is completely secure; we encourage you to use a strong unique password.

10. Children

Our service is not intended for persons under 18 years of age. We do not knowingly collect data from minors. If you believe a minor has created an account, contact us immediately for deletion.

11. Changes to This Policy

We may update this policy periodically. Material changes will be notified by in-app notification or email at least 14 days before taking effect. Continued use of the app after the effective date constitutes acceptance.

12. Contact