Privacy Policy

1. Introduction

EvalItUp ("we", "our", or "us") is committed to protecting your privacy and personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our trade copying software and website (collectively, the "Service"). This policy complies with the General Data Protection Regulation (GDPR) and applicable data protection laws.

2. Data Controller

The data controller responsible for your personal data is:

3. Data We Collect

3.1 Data You Provide

• Account information (email address, name, hashed password)
• Payment information (processed securely through Stripe — we do not store your banking details)
• Support communications

3.2 Data Stored Locally on Your Device

• Trading platform credentials (secured via Windows Credential Manager, stored only on your device)
• Application preferences and settings
• Trading configuration data

3.3 Automatically Collected Data

• Device information (operating system, hardware identifiers)
• Usage data (features used, session duration)
• Error logs and crash reports

4. How We Use Your Data

We use your personal data for the following purposes:

• To provide and maintain the Service
• To process payments and manage subscriptions
• To send important updates and notifications about the Service
• To provide customer support
• To improve and optimize the Service
• To detect and prevent fraud or abuse

5. Legal Basis for Processing

In accordance with the GDPR, we process your data on the following legal bases:

• Performance of a contract: processing is necessary to fulfill our contract with you (providing the Service).
• Consent: for sending marketing communications (you can withdraw consent at any time).
• Legitimate interests: improving the Service, fraud prevention, Service security.
• Legal obligations: retaining billing data in compliance with tax and accounting requirements.

6. Data Security

We implement industry-standard security measures to protect your data:

• Your trading credentials are secured via Windows Credential Manager and stored only on your local device — we never have access to them
• All data transmitted between your device and our servers is encrypted via HTTPS
• Payment information is processed by Stripe (PCI-DSS certified) and is never stored on our servers
• We conduct regular security audits

7. Data Sharing

We do not sell your personal data. We may share data with:

• Service providers: Stripe (payments), Google Cloud (hosting), Resend (emails). These providers are bound by contractual data protection obligations.
• Legal requirements: when required by law or to protect our rights.
• Business transfers: in connection with a merger or acquisition, your data may be transferred to the successor entity.

8. International Transfers

Your data may be transferred to countries outside the European Union, including the United States (for our service providers). These transfers are governed by appropriate safeguards in compliance with the GDPR: European Commission Standard Contractual Clauses or adequacy decisions. You can obtain a copy of these safeguards by contacting us.

9. Your Rights

Under the GDPR and applicable data protection laws, you have the following rights:

• Right of access: obtain a copy of your personal data.
• Right to rectification: correct inaccurate or incomplete data.
• Right to erasure: request deletion of your data (subject to legal retention requirements).
• Right to data portability: receive your data in a structured, machine-readable format.
• Right to object: object to the processing of your data on legitimate grounds.
• Right to restriction: request limitation of processing in certain cases.
• Withdrawal of consent: withdraw your consent at any time for processing based on consent.

To exercise these rights, contact us at privacy@evalitup.com. We will respond within one month.

You also have the right to lodge a complaint with your local data protection authority.

10. Data Retention

We retain your account data for as long as your account is active. Upon account deletion, we delete your personal data within 30 days, except where retention is required by law (including billing data for up to 10 years for tax compliance) or for legitimate purposes (fraud prevention).

11. Cookies

Our website uses essential cookies for authentication and security. We also use analytics cookies (which can be disabled) to understand how visitors use our site. We do not use advertising or tracking cookies. You can manage your cookie preferences through your browser settings.

12. Children's Privacy

The Service is not intended for persons under 18 years of age. We do not knowingly collect information from minors. If we learn that we have collected personal data from a minor, we will delete it immediately.

13. Changes to This Policy

We may update this Privacy Policy. For material changes, we will notify you by email or through the Service at least 30 days before they take effect. Your continued use of the Service after such changes constitutes your acceptance of the updated policy.

14. Contact Us

For questions about this Privacy Policy or to exercise your rights, please contact us: