Privacy Policy

1. Who we are

This policy explains how REPLICA TECHNOLOGIES S.R.L., with its registered office in Bucharest, Sector 4, 8 Emil Racoviță Street, Block U1, Entrance 4, Floor 4, Apartment 58, Romania ("Replica", "we"), processes personal data when you visit www.replicacopier.com, create an account, subscribe to and use the Replica software, or contact us. For this processing Replica is the controller within the meaning of Regulation (EU) 2016/679 (the General Data Protection Regulation, "GDPR").

You can contact us about any data protection matter by email at support@replicacopier.com or by post at the registered office address above. We have not appointed a data protection officer, as we are not required to do so under Article 37 GDPR.

2. What we do not process

The usernames, passwords, tokens and API keys you use to connect your broker and platform accounts are stored in encrypted form on your own device and are not transmitted to our servers, with one exception: when you connect Tradovate, the access token Tradovate issues is passed through our server to complete the sign-in, and a copy is kept encrypted on our server, for at most 72 hours at a time, only to renew your Tradovate session automatically (Article 6(1)(b) GDPR). Your orders are sent directly from your device to your broker and do not pass through our servers. We have no access to your funds, and we do not ask for special categories of personal data, such as data concerning health, religious beliefs or political opinions.

3. What data we process, why and on what legal basis

Account and authentication. When you create an account we process your name, username, country, email address and password, which we store only in hashed form. If you use them, we also store your profile (bio, social links, interests, profile picture and banner) and your application preferences, so that they follow you across devices. We need these data to create and secure your account and to provide the Service under the contract with you (Article 6(1)(b) GDPR).

Subscription, payment and invoicing. We process the plan you chose, the billing period, your billing address, the history of payments and invoices, and the limited payment information made available to us by the payment processor (for example the card type, its last four digits and expiry date). Full card details are processed by the payment processor, not by us. We process these data to perform the contract (Article 6(1)(b) GDPR) and to comply with our accounting and tax obligations (Article 6(1)(c) GDPR).

Licence verification and updates. When the software starts and while it runs, it sends to our servers the data needed to verify that your subscription is active and to check for updates, namely your account identifier, the application version, a one-way hashed identifier of your computer, your IP address and the date and time of the request. This processing is necessary to perform the contract (Article 6(1)(b) GDPR).

Diagnostics and support. When you write to us by email or through our Discord server, we process your messages and the data you choose to include in them. A diagnostic report, containing the software's activity log and your order and fill history, which may include the identifiers of your trading accounts, is sent to us only when you choose to send it from the Support section; passwords and keys are removed from it before sending, and it is deleted automatically after 7 days. We process these data to provide the support you requested under the contract (Article 6(1)(b) GDPR).

Service communications. We send you by email messages that are necessary for the contract, such as order confirmations, payment notices, renewal reminders, notices of changes to the Service, the prices or these documents, and security alerts (Article 6(1)(b) and (c) GDPR).

Commercial communications. We send you news and offers by email only if you have given your prior express consent (Article 6(1)(a) GDPR and Article 6(1) of Law no. 365/2002 and Article 12(1) of Law no. 506/2004). You may withdraw your consent at any time, free of charge, using the link in each message or from the settings of your account; the withdrawal does not affect the lawfulness of the messages sent before it.

Security and prevention of abuse. We process technical data, such as IP addresses, access logs and payment method fingerprints provided by the payment processor, to protect our systems and your account, to detect and prevent fraud, unauthorised access and the misuse of free trials, and to enforce the Terms of Service. The legal basis is our legitimate interest in keeping the Service secure and preventing abuse (Article 6(1)(f) GDPR).

Legal claims. Where necessary, we process the data described above to establish, exercise or defend legal claims, on the basis of our legitimate interest (Article 6(1)(f) GDPR).

Website and cookies. When you visit our website we use cookies and similar technologies as described in our Cookies Policy. Cookies that are not strictly necessary are placed only with your consent.

Aggregated statistics. We may produce statistics about the operation of the Service, such as replication speed or error rates, from which neither you nor any other person can be identified. Such statistics are not personal data.

4. Whether you must provide your data

The account, billing and licence verification data described above are necessary to conclude and perform the contract; without them we cannot provide the Service. Providing data for diagnostics beyond your own support request, and for commercial communications, is optional.

5. Who receives your data

We disclose personal data only to the extent necessary, to the following categories of recipients: our reseller and payment processor Stripe, which acts as merchant of record for orders and processes payment data as a separate controller under its own privacy policy, hosting and infrastructure providers Supabase and Vercel, the email service providers that send our account and payment emails (Supabase and Stripe), and our accountants, auditors, lawyers and fiscal consultants, all of whom are bound by confidentiality. Providers that process data on our behalf do so under a contract that meets the requirements of Article 28 GDPR and only on our instructions. We also disclose data to public authorities and courts where the law requires it, and to a company that takes over the Service, if the business is transferred.

Discord is operated by an independent company, which processes the data you publish or send on its platform under its own privacy policy. We recommend that you do not share account details or other personal information in public channels.

We do not sell personal data and we do not share it for advertising purposes.

6. Transfers outside the European Economic Area

Some of our providers may process data outside the European Economic Area, in particular in the United States. In such cases the transfer takes place on the basis of an adequacy decision of the European Commission (Article 45 GDPR), including, for providers certified under it, the EU-U.S. Data Privacy Framework, or on the basis of the standard contractual clauses adopted by the European Commission (Article 46(2)(c) GDPR). You may obtain information about these safeguards, and a copy of them, by writing to support@replicacopier.com.

7. How long we keep your data

We keep account data for as long as your account is active and for 6 months after it is closed, to allow reactivation and the handling of any outstanding requests. Invoices and payment records are kept for the periods required by Romanian accounting and tax legislation, currently up to 10 years. Support messages are kept for up to 12 months after the request has been resolved, and diagnostic reports are deleted automatically after 7 days. Security logs are kept for up to 12 months. Data processed on the basis of consent are kept until you withdraw it. Where data are needed for a dispute, we keep them until the dispute is finally resolved and the relevant limitation periods have expired.

8. Your rights

Right to object. You have the right to object at any time, on grounds relating to your particular situation, to processing based on our legitimate interest described in Section 3 (security and prevention of abuse, legal claims), in which case we stop the processing unless we demonstrate compelling legitimate grounds which override your interests, rights and freedoms, or the processing is necessary for the establishment, exercise or defence of legal claims. You may object at any time, without giving reasons, to the processing of your data for direct marketing, in which case the data will no longer be processed for that purpose (Article 21 GDPR). You can send your objection to support@replicacopier.com and, for commercial communications, also through the link in each message.

Under the GDPR you have the right of access to your data (Article 15), the right to rectification (Article 16), the right to erasure (Article 17), the right to restriction of processing (Article 18), the right to data portability (Article 20) and the right to object (Article 21). Where processing is based on consent, you may withdraw it at any time, without affecting the lawfulness of the processing carried out before the withdrawal (Article 7(3)).

We do not take decisions based solely on automated processing, including profiling, which produce legal effects concerning you or similarly significantly affect you.

To exercise your rights, write to support@replicacopier.com. We will reply without undue delay and in any event within one month of receiving your request; this period may be extended by two further months where necessary, taking into account the complexity and number of requests, in which case we will inform you (Article 12(3) GDPR). We may ask for information needed to confirm your identity.

You also have the right to lodge a complaint with the National Supervisory Authority for Personal Data Processing (ANSPDCP, www.dataprotection.ro) or with the supervisory authority of the Member State in which you live or work (Article 77 GDPR), and the right to bring proceedings before the courts.

9. Security

We protect personal data by technical and organisational measures appropriate to the risk, including encrypted connections (HTTPS/TLS), storage of passwords in hashed form, restricted access for our team on a need-to-know basis and signed software updates. If a personal data breach occurs, we will notify the supervisory authority and, where the breach is likely to result in a high risk to you, we will inform you, in accordance with Articles 33 and 34 GDPR.

10. Minors

The Service is intended only for persons aged 18 or over. We do not knowingly collect personal data from minors, and if we learn that we have done so, we delete the data.

11. Residents of the United States

We do not sell personal information and we do not share it for cross-context behavioural advertising. Where the privacy laws of a state of the United States apply to our processing, you may exercise the rights they give you by writing to support@replicacopier.com.

12. Changes to this policy

We may update this policy to reflect changes to the Service or to the law. We will publish the updated version on our website with its effective date and, where the changes are material, we will inform you by email before they take effect.