1. Data Controller
Koduarve OÜ (registry code 16293599, seat: Oru, 20205 Narva, Estonia) — hereinafter "Company", "we", "us" — is the controller of personal data processed via the mtexpert.eu platform.
Contact: timofei@koduarve.ee
2. What Data We Collect
- Account data — name, email, phone (optional), Telegram handle (optional), preferred language, password hash (bcrypt).
- Trading data — MT4/MT5 login numbers, broker/server, trade history synced from your terminals (ticker, volume, price, profit, timestamps).
- Exchange API credentials — API key/secret/passphrase for Binance/Bybit/OKX/KuCoin, stored AES-256-GCM encrypted (AAD bound to user + account + field) and never exposed in logs or UI.
- Payment data — Stripe customer id and subscription state. Card details are held only by Stripe and never touch our servers.
- Technical data — IP address, session id, browser fingerprint (User-Agent), pages visited (server-side logs).
- Content you upload — profile avatar, EA files, chat messages, support tickets.
3. Purposes and Legal Basis
| Purpose | Basis (GDPR Art. 6(1)) |
|---|---|
| Providing the trading terminal service, copy-trading, spot exchange integration | (b) contract |
| Billing, invoicing, subscription management | (b) contract, (c) legal obligation |
| Security, fraud prevention, session integrity | (f) legitimate interest |
| Compliance with Estonian accounting law (7-year record retention) | (c) legal obligation |
| Marketing communications (only if opted in) | (a) consent |
4. Recipients and Subprocessors
We disclose data only to the minimum necessary set of subprocessors:
- Stripe Payments Europe, Ltd. (Ireland) — payments and subscriptions
- Hetzner Online GmbH (Germany) — server hosting, GDPR-compliant EU-only
- TradingView Inc. (US/UK) — chart rendering (Widget/Advanced Charts); no personal data is sent to TradingView beyond public browsing headers
- Cryptocurrency exchanges (Binance/Bybit/OKX/KuCoin) — only when you connect your API keys and request order placement
- MetaQuotes Software Corp. — via the MT4/MT5 protocol between your rented terminal and your chosen broker
- Twilio / SendGrid — transactional email (verification, receipts)
- Zone Media OÜ (Estonia) — domain registration
No data is sold, rented, or shared with advertising networks.
5. Data Storage and Security
- Servers in Hetzner EU regions (Germany).
- Postgres databases encrypted at rest; API credentials additionally encrypted at the application layer (AES-256-GCM).
- TLS 1.2+ everywhere in transit.
- Session cookies HttpOnly, Secure, SameSite=Lax; JWT with 12–24 h TTL.
- Two-factor authentication (Telegram-based) available and recommended.
6. Retention
- Account data — while the account is active + 30 days after deletion request.
- Financial records (invoices, trades) — 7 years as required by the Estonian Accounting Act.
- Encrypted API credentials — until you revoke them or delete the account.
- Server logs — 90 days.
7. Your Rights (EU / EEA)
You have the right to:
- Access your data and request a machine-readable copy (Art. 15, 20).
- Rectify inaccurate data (Art. 16).
- Erase your data — "right to be forgotten" (Art. 17), subject to retention obligations above.
- Restrict or object to processing (Art. 18, 21).
- Withdraw consent for optional processing (Art. 7(3)).
- Lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon): aki.ee.
To exercise any right, email timofei@koduarve.ee. We respond within 30 days.
8. Cookies
We use strictly necessary cookies only: session token, theme preference, language. No third-party advertising or analytics cookies are set by us. TradingView charts may set their own functional cookies within the chart iframe; see their privacy notice.
9. International Transfers
Data is processed within the EU/EEA. Where a subprocessor is outside the EEA (e.g., Stripe US), transfers rely on Standard Contractual Clauses and additional safeguards as required by GDPR Chapter V.
10. Changes
We may update this Policy. Material changes are announced by email to registered users at least 14 days before taking effect. The current version is always available at this URL.
Effective date: 2026-02-06.