Privacy policy

1.Controller

The controller for data processing on aceaurum.com and in the Ace Aurum app is:

Albrecht von Schlichting
Heinkelstraße 10
74369 Löchgau
Germany

Email: aceaurum.kontakt@gmail.com

Ace Aurum is a service provided by Albrecht von Schlichting. We have not appointed a data protection officer because there is no legal obligation to do so. If you have questions about data protection, please write to the email address above.

2.Summary

• We process your data to provide the signal service – not for advertising.
• There are no analytics or advertising trackers and no cookies for such purposes.
• Fonts and program libraries are loaded from our own server. Opening the site does not send data to Google or similar third parties.
• The app's data is stored in a data centre in Ireland.
• Your trading password – only when connecting via our server – is encrypted on your device before it is transmitted.
• You can delete your user account yourself in the app.

3.Visiting aceaurum.com (hosting)

The website and the app are hosted by Hostinger International Ltd., 61 Lordou Vironos str., 6023 Larnaca, Cyprus. When you visit aceaurum.com, Hostinger processes technically necessary access data: IP address, date and time, the address requested, the amount of data transferred, the previously visited page, and browser and operating system. Without this data the server cannot deliver the page; it is also logged briefly to detect faults and attacks.

The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in providing the website securely and reliably. The logs are deleted automatically after a short period.

Hostinger processes the data on our behalf under a contract pursuant to Art. 28 GDPR. To deliver the site, Hostinger also uses a network of servers in various countries (content delivery network, including Cloudflare). Where data is transferred to countries outside the European Economic Area in the process, this is safeguarded by EU standard contractual clauses.

4.User account: sign-up and sign-in

To use the app you create a user account. We process your email address, your password and the app language you choose. The password is only stored as an irreversible hash; we cannot read it. After you sign up, we send you an email with a confirmation link and, on request, a link to reset your password.

To secure sign-ins, our database provider (section 8) logs sign-in events with time and IP address.

The legal basis is Art. 6(1)(b) GDPR (contract and pre-contractual steps); for the logging, Art. 6(1)(f) GDPR – our legitimate interest is protecting your account against misuse.

5.Using the app

While you use the app, we store the data the service needs: your settings (e.g. subscribed and visible categories, lot sizes, display currency, language), which signals you confirmed and when, entries in your journal, messages in your inbox and whether you have read them, and the status of your subscription.

The legal basis is Art. 6(1)(b) GDPR.

6.Connecting your trading account (MetaTrader 5)

So that confirmed day-trade signals can be executed in your account and your account data can be shown in the app, you connect your MetaTrader 5 account at your broker to Ace Aurum. There are two ways to do this.

Option A: program on your own PC

You install an Expert Advisor in your MetaTrader and pair it using a one-time code from the app (valid for 15 minutes). We only store a checksum of the device key (SHA-256). We do not receive your password this way.

Option B: MetaTrader on our server

You enter the broker server, account number and trading password in the app. The password is encrypted on your device with a public key (RSA-2048); the database only holds this encrypted text. On our server it is decrypted to sign MetaTrader in at your broker, and it is stored encrypted on the server for later restarts. Whoever controls this server therefore has technical access to your password. The software only executes orders you have confirmed in the app.

Before you send the password, you expressly confirm that you agree; we store the time and the version of this confirmation. When you disconnect in the app, we delete the password from the database and the server and shut down your MetaTrader.

The server for this connection is operated for us by Contabo GmbH, Aschauer Straße 32a, 81549 München. The provider processes the data on our behalf under Art. 28 GDPR. The server is located in a data centre in the United Kingdom. The European Commission has decided that the United Kingdom ensures an adequate level of data protection (adequacy decision under Art. 45 GDPR).

Which account data we process

For both options we process: broker, server, account number, account currency and account type (demo or live), balance, equity and free margin (updated every 10 seconds), all open positions in the account – including positions you did not open through Ace Aurum – and closed trades, including trades you entered yourself; on first connection up to 30 days back. We use this data to execute confirmed signals, to show you your balance and positions, and to keep your journal.

The legal basis is Art. 6(1)(b) GDPR. Your broker is itself responsible for the data it processes about you. We have no contracts with brokers; data only flows to your broker to the extent needed to sign in to your account and to place or modify the orders you confirmed.

7.Sending emails

We send service emails such as confirmation links and password reset links via Brevo (Sendinblue SAS, 17 rue de Salneuve, 75017 Paris, France). This involves processing your email address, the app language (for the language of the email), the content of the email and technical delivery data (time, delivery status). Opens and clicks are only recorded anonymously and are not linked to you.

The legal basis is Art. 6(1)(b) GDPR; for the delivery logs, Art. 6(1)(f) GDPR (legitimate interest in reliable delivery). Brevo processes the data on our behalf under Art. 28 GDPR within the EU.

8.Database and sign-in service (Supabase)

We store the app's data – user account, settings, account connection, trades and messages – with Supabase (Supabase Pte. Ltd., 65 Chulia Street #38-02/03, OCBC Centre, Singapore 049513). The database is located in a data centre in Ireland (EU). Supabase processes the data on our behalf under Art. 28 GDPR.

For operations and support, Supabase may also access data from outside the EU, for example from Singapore or the USA. These transfers are safeguarded by EU standard contractual clauses pursuant to Art. 46(2)(c) GDPR.

9.Payments

Subscriptions cannot be purchased yet. Payments will be handled by an external payment service provider that takes care of the checkout, invoices and cancellation. Before subscriptions become available, we will add here who that is and which data it receives.

From this provider we only receive the information we need to manage your subscription – plan, status, term and payment events. We do not receive payment details such as card or account numbers.

The legal basis is Art. 6(1)(b) GDPR; for keeping records, Art. 6(1)(c) GDPR in conjunction with the retention obligations under tax and commercial law.

10.Notifications

Push notifications are technically prepared but currently switched off. If we switch them on, your browser will ask for your permission first. Only then is an identifier of your device stored, which the push service of your browser or device manufacturer (e.g. Apple, Google or Mozilla) uses to deliver notifications. You can withdraw the permission at any time in your browser or device settings. The legal basis is then your consent (Art. 6(1)(a) GDPR, Section 25(1) of the German TDDDG).

11.Storage in your browser

The app stores in your browser's local storage: your sign-in session, so that you stay signed in, as well as language, display currency and whether you have already seen the home-screen hint. This is strictly necessary for the service you requested and permitted without consent under Section 25(2) no. 2 of the German TDDDG. We do not set cookies for analytics or advertising. You can delete these entries in your browser at any time; you will then have to sign in again.

12.Contacting us by email

If you write to us, we process your email address, your name (if provided) and the content of your message to handle your request. The legal basis is Art. 6(1)(b) GDPR where your contract is concerned, otherwise Art. 6(1)(f) GDPR (legitimate interest in answering enquiries). We delete the messages once they have been dealt with, unless we are required to keep them.

13.Recipients at a glance

• Hostinger International Ltd., Cyprus – hosting (section 3)
• Supabase Pte. Ltd., Singapore – database and sign-in, stored in Ireland (section 8)
• Sendinblue SAS (Brevo), France – sending emails (section 7)
• Contabo GmbH, Aschauer Straße 32a, 81549 München – server for option B
• a payment service provider – once subscriptions can be purchased (section 9)
• Your broker – only as described in section 6

We do not sell data and do not pass it on for advertising. We only disclose data to authorities where we are legally required to do so.

14.How long we keep data

• User account and app data: for as long as your account exists. You can delete it in the app at any time (Settings › Delete account). You need to cancel a running subscription first.
• On deletion we remove your account, your settings, your account connection, your trades and journal entries, and messages that were sent only to you.
• Trading password (option B): as soon as you disconnect or delete your account.
• Payment records: until the end of the statutory retention periods (up to ten years). During this time they are blocked for any other use.
• Server and sign-in logs: only as long as needed for security and troubleshooting.

15.Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). You can withdraw consent at any time with effect for the future (Art. 7(3)).

Right to object: Where we process data on the basis of Art. 6(1)(f) GDPR, you may object at any time on grounds relating to your particular situation (Art. 21 GDPR).

Simply write to the email address in section 1. You may also lodge a complaint with a data protection supervisory authority, in particular in the EU member state of your habitual residence, your place of work or the place of the alleged infringement (Art. 77 GDPR).

16.Do you have to provide data?

Without an email address and password we cannot create a user account, and without a connection to your trading account we cannot execute signals in your account. Any other information is voluntary.

17.No automated decisions

All customers in a category receive the same signals. We do not make decisions based solely on automated processing within the meaning of Art. 22 GDPR and do not create profiles of you.

18.Security

All connections to aceaurum.com and to the database are encrypted with TLS. We additionally encrypt the trading password as described in section 6. Only the provider has access to the data in the admin area.

19.Changes

We update this policy when our service or the legal situation changes. The version published here applies.