Privacy Policy

Version 2026-11-02r2 · Effective 2026-11-02r2

MyBoTrade Ltd is the controller of your personal data. This policy says what we hold, why we are allowed to hold it, how long for, and what you can make us do about it. We have tried to write it so that it is actually readable.

1Who to contact

MyBoTrade Ltd, Registered address not configured. For anything about your data, write to support@mybotrade.com with “Data request” in the subject.

2What we collect, why, and on what basis

The table below is the whole picture. “Lawful basis” is the ground under the UK/EU GDPR that permits us to process it.

Data	Why we hold it	Lawful basis	Kept for
Name, email, password hash	To give you an account, deliver licences and send receipts	Performance of our contract with you	While your account exists
Order records: amount, currency, product, status, masked card number, gateway invoice id	To take payment, provide a receipt, meet accounting and tax obligations	Contract; and legal obligation for the accounting record	7 years from the transaction
IP address, browser user-agent, country, coarse device fingerprint, timestamps at signup and at checkout	To evidence that a purchase was authorised if it is later disputed, and to detect payment fraud	Legitimate interests — defending against chargeback fraud and protecting our merchant account	2 years, or until any dispute over the payment is finally resolved
Licence keys, activations (your broker account number), download history with time and IP	To enforce licence limits and to prove the product was delivered and used	Contract; and legitimate interests for the delivery evidence	While the licence exists, then 2 years
Record of the terms, refund policy and risk disclosure you accepted, with version, time and IP	To show what you agreed to, to us and to an acquiring bank	Legal obligation and legitimate interests	7 years from the transaction
Risk score and the reasons behind it	To decide whether an order can proceed automatically or needs a human look	Legitimate interests — fraud prevention	2 years
Affiliate attribution: the partner code you arrived through, landing page, click log	To credit the correct partner and pay them	Consent (the attribution cookie), then contract with the partner	Click logs 12 months; attribution while your account exists
Support emails and refund requests	To answer you and keep a record of what was agreed	Contract and legitimate interests	3 years from last contact
A copy of every service email we send you, including its contents	So we can show what we told you and when — a licence key we can prove we sent is the difference between winning and losing a payment dispute — and so a failed delivery can be retried rather than lost	Contract; and legitimate interests for the delivery evidence	2 years, or until any dispute over the payment is finally resolved
Session records: IP, user-agent, time	To keep you signed in and let you see where your account is active	Contract and security	Until the session expires or is revoked

We do not collect special category data, and we do not ask for it. Please do not send us health, political or similar information — we have no use for it.

We never receive your full card number, expiry date or security code. Card details are entered on our payment provider’s own hosted page. We receive only the outcome of the payment, the masked card number, the fee and the provider’s reference.

3Automated decision-making

This is the part most sites leave out, so we will be specific. When you place an order we score it automatically for fraud risk. The score combines things like how old your account is, whether the email domain is disposable, how many payment attempts have failed recently, how many accounts share your IP or device, whether your billing country matches your connection, and whether the account has previously charged back.

Depending on the score, one of three things happens:

the order proceeds to payment normally;
the order is held and a person reviews it before it can proceed;
the order is declined and never reaches the payment provider.

Your rights here, which we honour in practice and not only on this page:

You can ask for a human to review a declined or held order. Email us and a person will look at the actual reasons recorded against it.
You can ask us what the reasons were. We store them as readable sentences, not an opaque number, precisely so they can be explained.
You can contest the outcome and give us information we did not have.

No automated decision we make affects anything other than whether a single purchase can go through. We do not profile you for advertising and we do not sell or share any profile.

4Who else sees your data

Recipient	What they get	Role
Our payment provider	Your email, order reference, amount, and the card data you give them directly	Separate controller for the payment itself; they have their own privacy notice
Our hosting and database providers	Whatever is stored, as a consequence of hosting it	Processors acting on our instructions under a data-processing agreement
Our email provider	Your email address and the content of messages we send you	Processor
An acquiring bank or card scheme	Order, delivery and acceptance records, only if you dispute a payment	Separate controller; disclosure is necessary to defend the dispute
Affiliate partners	That a referral converted, and the commission amount. Never your name, email or card data	Separate controller for their own records
Accountants, auditors, lawyers, or a regulator or court	Only what is necessary and only when we are required to or must defend a claim	As applicable

We do not sell personal data, and we do not share it for anyone else’s advertising.

5Transfers outside the UK and EEA

Some of our providers operate outside the UK and EEA. Where data is transferred, we rely on an adequacy decision for that country, or on the UK International Data Transfer Addendum / EU Standard Contractual Clauses together with a transfer risk assessment. We can tell you which mechanism applies to a particular provider if you ask.

6Your rights

Access. Get a copy of what we hold. Do it yourself, immediately, from your settings — it exports as JSON.
Rectification. Have inaccurate data corrected.
Erasure. Have your data deleted. You can start this from your settings. See clause 7 for the limits.
Restriction and objection. Ask us to pause processing, or object to processing we base on legitimate interests — including the fraud-prevention processing described in clause 3.
Portability. Receive the data you gave us in a machine-readable format. The export covers this.
Withdraw consent. Where we rely on consent — the affiliate attribution cookie — withdraw it at any time via the cookie notice.
Complain. To your national data protection authority. In the UK that is the Information Commissioner’s Office. We would rather you came to us first, but it is your right either way.

We respond within one month. We do not charge for a request, and we do not require a reason.

7The honest limit on erasure

The right to erasure is not absolute, and we will not pretend otherwise. When you erase your account we remove your name, email, IP addresses, device records and click history, end every session and revoke every licence. We keep the financial record of completed purchases — amount, date, product, gateway reference — in anonymised form, because we are required to retain transaction records for tax and accounting, and because a payment can still be disputed after you leave. That retention is permitted under Article 17(3)(b) and (e). Nothing in the retained record identifies you.

The same applies to the emails we sent you. Their contents are deleted — your name, your licence keys, your order details — and what remains is which kind of message was sent, on what date, and that it was accepted for delivery. That is the delivery record, kept for the same reason and under the same provision as the financial one.

8Security

Passwords are stored only as bcrypt hashes. We cannot read your password, and nor can anyone who obtains the database.
Sessions are opaque random tokens; only a hash is stored server-side, and every session can be revoked immediately.
The site is served over HTTPS with HSTS, and the product files sit outside the web root and are served only through an authenticated, logged route.
Administrative actions are written to an append-only audit log with the acting account recorded.
No system is perfectly secure. If a breach affects your rights we will tell you and the regulator within the time the law requires.

9Children

Our products are not for under-18s and we do not knowingly collect their data. If you believe a child has registered, tell us and we will remove the account.

10Changes

This policy carries a version number. We record which version you accepted. If we make a change that materially affects you we will tell you by email before it takes effect.