Privacy Policy

1. Information We Collect

We collect several types of information to provide and improve the Platform.

2. How We Use Your Information

3. Legal Basis for Processing (UK GDPR)

We process personal data only where we have a lawful basis to do so. The bases we rely on are:

• Contractual Necessity: to perform services you have subscribed to
• Consent: for marketing communications and optional features — you may withdraw consent at any time without detriment
• Legitimate Interests: for service improvement, fraud prevention, security, and anonymised analytics, where those interests are not overridden by your rights
• Legal Obligation: to comply with UK and applicable international law

4. Data Sharing and Disclosure

5. Data Security

We implement industry-standard technical and organisational measures to protect your data, including:

• Encryption in Transit: TLS/SSL encryption for all data transmission
• Encryption at Rest: database-level encryption for stored data
• Access Controls: role-based access controls and multi-factor authentication for internal systems
• Security Monitoring: continuous logging, anomaly detection, and periodic vulnerability assessments
• Password Security: passwords hashed using bcrypt or equivalent algorithms — we never store plaintext passwords
• Two-Factor Authentication: available to users for enhanced account security

No method of electronic transmission or storage is completely secure. While we take all reasonable steps to protect your data, we cannot guarantee absolute security. You are responsible for keeping your account credentials confidential and for notifying us promptly if you suspect unauthorised access.

6. Data Retention

• Active Accounts: data retained for as long as your account remains active
• Inactive Accounts: accounts inactive for more than 24 months may be deleted following advance notice to you
• Deleted Accounts: personal data deleted within 30 days of account deletion, except where retention is required by law
• Financial Records: billing and payment records retained for 7 years in compliance with UK tax and accounting obligations
• Anonymised Data: may be retained indefinitely for research, analytics, and service improvement

7. Your Rights Under UK GDPR

You have the following rights in relation to your personal data. To exercise any of these rights, email us at info@systemly.ai with “Data Subject Request” in the subject line. We will verify your identity and respond within 30 days (extendable to 60 days for complex requests). No fee is charged unless a request is manifestly unfounded or excessive.

These rights apply under UK GDPR (for UK residents) and EU GDPR (for EEA residents). California residents have additional rights under the CCPA/CPRA — see Section 16.

You also have the right to lodge a complaint with the relevant supervisory authority. For UK residents, this is the Information Commissioner’s Office (ICO) — ico.org.uk — 0303 123 1113. For EEA residents, this is the data protection authority in your country of residence. We would, however, appreciate the opportunity to address your concerns before you contact a supervisory authority.

8. International Data Transfers

Our primary platform infrastructure is hosted via Vercel (with edge nodes in the UK, EEA, and United States). We also use US-based service providers including Stripe, ActiveCampaign, Twilio, Google, Meta, and TikTok. Where we transfer personal data outside the UK or EEA, we ensure an adequate level of protection is in place through:

• UK International Data Transfer Agreements (IDTAs) for transfers to countries not covered by an adequacy decision
• EU Standard Contractual Clauses (SCCs) where applicable
• Adequacy decisions recognised under UK GDPR or EU GDPR
• Encryption and security measures for all data in transit and at rest
• Data processing agreements with all named processors requiring them to maintain appropriate security standards

We accept users from the United Kingdom, the European Economic Area, and the United States. We comply with UK GDPR, EU GDPR, and — for California residents — the CCPA/CPRA (see Section 16). We do not represent that the Platform is appropriate for jurisdictions where its use is prohibited by local law.

9. Cookies and Tracking Technologies

We use cookies and similar technologies. For full details, please see our Cookie Policy. In summary:

10. Children's Privacy

The Platform is intended solely for users aged 18 and over. We do not knowingly collect personal data from individuals under 18. If we become aware that we have collected data from a minor, we will delete it promptly. Parents or guardians who believe their child has provided us with personal data should contact us immediately at info@systemly.ai.

11. Marketing Communications

12. Data Breach Notification

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms:

• We will notify affected users without undue delay and, where feasible, within 72 hours of becoming aware of the breach
• Notification will describe the nature of the breach and the categories of data affected
• We will outline the steps being taken to contain and remediate the breach
• We will recommend protective actions you should take
• We will notify the relevant supervisory authority as required by applicable law — for UK users this is the ICO; for EEA users this is the lead supervisory authority under the EU GDPR one-stop-shop mechanism

13. Third-Party Websites and Services

The Platform may contain links to third-party websites or integrate with third-party services (such as MT5 platforms or social media). We are not responsible for the privacy practices of those third parties. We encourage you to review their privacy policies before providing personal information.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. Where changes are material, we will notify you by email or via a prominent notice on the Platform prior to the change taking effect. The updated policy will display a revised "Last Updated" date. Continued use of the Platform after that date constitutes acceptance of the revised policy. We encourage you to review this page periodically.

15. Contact Us

For privacy enquiries, data subject requests, or concerns about how we handle your data, please contact us:

• Email: info@systemly.ai (subject line: 'Privacy Inquiry' or 'Data Subject Request')
• Post: Data Protection, Good Market Trader LTD, 128 City Road, London, EC1V 2NX, United Kingdom

We aim to respond to general enquiries within 5 business days and formal data subject requests within 30 days.

If you are not satisfied with our response, you have the right to lodge a complaint with the relevant data protection supervisory authority in your jurisdiction.

16. Additional Rights for California Residents (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act (CCPA) as amended by the CPRA grants you the following additional rights in relation to your personal information:

• Right to Know: request disclosure of the categories and specific pieces of personal information we have collected about you, the categories of sources, the business purpose for collection, and the categories of third parties with whom we share it
• Right to Delete: request deletion of your personal information, subject to certain exceptions (e.g. completing a transaction, legal obligations)
• Right to Correct: request correction of inaccurate personal information we hold about you
• Right to Opt Out of Sale or Sharing: we do not sell your personal information, nor do we share it for cross-context behavioural advertising in a way that constitutes a 'sale' under the CCPA. You may still contact us to confirm this
• Right to Limit Use of Sensitive Personal Information: we do not use or disclose sensitive personal information beyond the purposes permitted by the CPRA
• Right to Non-Discrimination: we will not discriminate against you for exercising any of these rights

To exercise any of these rights, email us at info@systemly.ai with “California Privacy Request” in the subject line. We will respond within 45 days as required by the CCPA/CPRA. You may designate an authorised agent to submit a request on your behalf.

For the purposes of the CCPA, we are a "business" that collects personal information from California consumers. The categories of personal information we collect are described in Section 1. We do not knowingly sell personal information of minors under 16 years of age.