Privacy Policy

1. Controller

The controller responsible for your personal data under this Privacy Policy is:

2. Data collected

We collect and process the categories of data necessary to operate The Mental Edge:

• Account and profile information (name, email address, authentication identifiers)
• Timezone preference for accurate date/period reporting
• Trading-account labels and identifiers you create
• Trade Ideas, including entries, exits, instruments, directions and sizes
• Strategies, confluences and trading rules you define
• Psychology and execution-review entries
• Discipline Score and related analytics
• Journal notes and screenshots you upload
• AI-generated reviews and AI Coach conversations/messages
• Subscription and billing status
• Technical and security logs necessary to operate and protect the service

If you choose to connect an MT4/MT5 account, we additionally process:

• Your broker server name and account login, provided by you at connection time
• Your investor (read-only) password, transmitted once to our connection sub-processor (see Service providers) to establish the connection — see "Broker credentials" below
• Data reported by your broker through the connection, including account balance and equity, open and historical positions and deals, prices, stop-loss/take-profit levels, volumes, commissions and swaps

2a. Broker credentials (MT4/MT5)

When you connect a MetaTrader 4 or MetaTrader 5 account, you provide your broker server name, account login and investor (read-only) password. The investor password is used once, in memory, to establish the connection: it is sent over an encrypted connection to our connection sub-processor MetaApi (see Service providers) and is never stored by The Mental Edge — not in our database, not in our logs, and not in your browser's storage. We never request, accept or store a trading-capable (master) password, and the connection we establish is technically incapable of placing, modifying or closing trades.

What we do store is the broker-reported data itself — account balance and equity, trade and position history, server name and a masked account login — together with a connection identifier issued by MetaApi. We store this to build your journal, compute your analytics and balance history, and keep your account in sync. This data is deleted together with your account when you permanently delete it (see section 11), and disconnecting a broker connection stops further syncing and removes the connection with the sub-processor.

3. Purposes

We use your data to:

• Create and manage your account
• Provide journaling, analytics and performance features
• Calculate Discipline Scores and other metrics
• Generate AI insights when you request them
• Process subscriptions and payments
• Provide support and respond to inquiries
• Maintain security and prevent abuse
• Meet legal, accounting and tax obligations

4. GDPR legal bases

Our processing relies on the following legal bases where applicable:

• Performance of contract — to provide the features you subscribe to.
• Legitimate interests — for security, fraud prevention, service operation and improvement, balanced against your rights.
• Legal obligations — for billing, accounting and tax compliance.
• Consent — where legally required, for example for optional communications or non-essential processing.

We do not claim consent as the legal basis for processing that is necessary to deliver the core service.

5. Trading and psychology data

Psychology and emotion entries are voluntarily supplied by you for trading-performance analysis. They are not collected or processed as medical diagnoses or health records, and The Mental Edge does not provide mental-health services.

6. AI processing

When you invoke AI features, selected journal data is sent to OpenAI to generate the requested analysis. AI requests are used solely to provide the analysis you asked for.

The Mental Edge does not use AI output as automated investment advice. OpenAI API data handling terms apply. By default, data sent through the OpenAI API is not used to train OpenAI models unless the account holder explicitly opts into such sharing. Provider retention practices may apply according to OpenAI's current API policies.

7. Payments

Subscription payments are processed by Stripe. The Mental Edge does not store full card numbers. Stripe may act as a processor and/or independent controller depending on the processing activity, in accordance with Stripe's privacy framework.

8. Service providers

We rely on carefully selected service providers to operate The Mental Edge:

• Application hosting provider — website hosting and deployment infrastructure
• Supabase — authentication, database and private file storage
• Stripe — subscription payments and billing
• MetaApi — MT4/MT5 account connection and trade-history synchronisation (sub-processor; receives your broker server, login and investor password only to establish and maintain the connection)
• OpenAI — AI-powered journal analysis
• Google Workspace — business email

These providers process data only as necessary for the services they deliver and under their own contractual and privacy frameworks.

9. International transfers

Some service providers may process data outside the Netherlands or the European Economic Area. Where such transfers are subject to GDPR requirements, we rely on appropriate safeguards as legally required.

10. Retention

We retain data as follows:

• Product and journal data are retained while your account exists and as necessary to provide the service.
• Permanently deleted account data is removed from active application systems through the account-deletion process.
• Screenshots are deleted together with the account.
• Broker-synced data (account balance history, imported trade history, connection metadata) is deleted together with the account; disconnecting a broker connection stops further syncing immediately.
• AI reviews and conversations are deleted together with the account.
• Billing, accounting and payment records may be retained as legally required.
• Security and payment audit logs are retained only as necessary for operational, security or legal reasons.
• Backups may persist temporarily until normal backup rotation removes them.
• Data is not retained longer than necessary for the relevant purpose, subject to statutory retention requirements.

11. Account deletion

You can permanently delete your account in Settings → Danger Zone. The process removes your user-owned product and journal data from active systems and cancels any active subscription.

Deletion through The Mental Edge does not necessarily delete data that Stripe or other processors are independently required to retain for legal, tax, fraud-prevention or payment reasons.

12. User rights

Under applicable GDPR law, you have the right to access, rectify, erase, restrict or object to processing of your personal data, and to data portability where applicable. Where processing relies on consent, you may withdraw consent at any time.

You also have the right to lodge a complaint with a supervisory authority. For users in the Netherlands, this is the Autoriteit Persoonsgegevens.

To exercise your rights, contact us at info@tmetrade.com.

13. Security

We apply reasonable technical and organisational measures to protect your data, including:

• Authenticated access controlled by your account credentials
• Database row-level security policies
• Private screenshot storage scoped to your account
• HTTPS encryption in transit
• Server-side handling of secrets and payment tokens

No system is completely secure. Please use a strong, unique password and keep your account credentials safe.

14. Children

The Mental Edge is intended for users aged 18 and older. We do not knowingly collect personal data from children under 18.

15. Cookies and analytics

When you first visit The Mental Edge, a cookie banner asks for your choice before any non-essential cookie or similar technology is set. You can accept all, reject everything that is not strictly necessary, or open “Customise” to decide per category. Your choice is stored locally in your browser so you are not asked again, and you can change it at any time through the Cookie preferences link in the website footer. Rejecting non-essential cookies does not restrict any product feature.

We use two categories:

• Strictly necessary (always active, no consent required under Article 11.7a of the Dutch Telecommunications Act) — your authentication/session token, security and anti-abuse protection such as CSRF tokens, your theme and timezone preference, and the record of your cookie choice itself. These are set by us and are required for the service to function.
• Analytics (only after you opt in) — product analytics provided by PostHog (EU hosting), used to count visits and see which pages and features are used so we can improve them. It records page views, the key product events listed below, an anonymous device identifier and, if you are signed in, your account identifier. It is never used for advertising, profiling or resale, and no journal, trade or psychology content is sent to it. Events tracked: starting and completing signup, starting a trial, completing checkout, connecting a broker account and logging a first trade.

We do not use advertising pixels or trackers such as Meta Pixel, TikTok Pixel, Google Ads or Hotjar. Analytics processing relies on your consent (Article 6(1)(a) GDPR), which you may withdraw at any time; strictly necessary cookies rely on the necessity of delivering the service you requested.

16. Changes

We may update this Privacy Policy from time to time. Material changes will be posted with a new “Last updated” date and, where appropriate, with additional notice. We encourage you to review this page periodically.

17. Contact

For privacy questions or to exercise your rights, contact:

For data-protection complaints, you may also contact the Autoriteit Persoonsgegevens.