Last updated: 21 October 2026. Version: 1.1.
This policy explains what personal data PositionBoss collects, why, and what rights you have, wherever you live. Regional details are in section 12.
1. Who is responsible
PositionBoss ("we") is responsible for your personal data (the "controller"). Contact for all privacy questions: support@positionboss.com (subject "Privacy").
2. What we collect
| Data | When | Why |
|---|---|---|
| Your internet address, browser type, the page requested and the time | when you visit our website | to deliver the website and protect it against attacks; handled by our hosting company |
| Name, e-mail address, country, order number | when you buy | to deliver the licence, for invoices, tax records and support |
| Payment details | when you pay | handled by the Reseller; we never see or store your card number |
| Licence key, licence values, status | when your licence is created | to run your licence |
| MetaTrader 5 account number, broker server name, broker company name, account type (real or demo) | when the Software checks the licence | to count the accounts your licence allows |
| Software version, MetaTrader 5 build number, a random number that stands for one MetaTrader 5 installation, time of each check | when the Software checks the licence | for support, to see which versions are in use, and to detect misuse |
| A short code made from your internet address (not the address itself) | at each licence check | to detect misuse |
| Your messages and attachments (for example screenshots) | when you contact us | to help you |
| Name, e-mail, website or channel, and payout details handled by the Reseller | when you join the Partner Program | to run the program and pay commissions |
3. What we do not collect
The Software does not send us your trading account password, your balance or equity, your trades, positions, history or settings. We do not use advertising trackers or sell your data.
4. Legal reasons for using your data
Where data protection law requires a legal reason (for example the GDPR):
- contract: to deliver the licence, updates and support you bought;
- legal duty: for example keeping invoices and tax records;
- legitimate interest: to protect our website, licence system and Software against misuse and attacks, and to improve the Software. You can object to this (section 11);
- consent: where we ask for it, for example for marketing e-mails or non-essential cookies. You can withdraw consent at any time.
5. Who receives your data
We share data only with service providers who need it to do their work for us, under contracts that protect it:
- our website host and network provider (Cloudflare);
- the provider of the server that runs our licence system;
- the Reseller, which sells the licence, takes payment, sends invoices and handles tax. For the payment it acts as a separate controller under its own privacy policy;
- our e-mail provider, which stores and delivers our e-mails;
- professional advisers (for example accountants and lawyers) and authorities, when the law requires it.
If the business or the Software is sold, the buyer may receive the data needed to continue your licence, under the same protection.
6. Transfers to other countries
Our service providers may process data in other countries, including the United States. Where the law requires it, we use recognised safeguards such as adequacy decisions, the European Commission's Standard Contractual Clauses or the UK International Data Transfer Addendum.
7. How long we keep data
- website server logs: a few days to 30 days, as set by our hosting company;
- the list of licence checks: 180 days;
- licence and account records: while your licence exists and up to 6 years afterwards, as tax and accounting law and the defence of legal claims require;
- support messages: 3 years after the last message;
- Partner Program records: while you take part and up to 6 years afterwards.
8. Security
Data is sent over encrypted connections (HTTPS). Licence keys are stored encrypted, and access to our systems is limited and protected. The answers of our licence server are signed so they cannot be forged. No system is perfectly secure. If a data breach is likely to harm you, we will tell you and the authorities as the law requires.
9. Automated decisions
We make no decisions about you that are based only on automated processing and that have legal or similarly significant effects. The licence system counts accounts and checks keys automatically; if you think it made a mistake, contact us and a person will check it.
10. Children
Our products are for adults. We do not knowingly collect data from anyone under 18.
11. Your rights
Depending on where you live, you can ask us to: tell you what data we hold about you and give you a copy; correct it; delete it; limit its use; send it to you or another company in a common format; stop using it for a legitimate interest or for marketing; and withdraw a consent. Write to support@positionboss.com. We may need to confirm your identity. We answer within the time the law sets (usually one month; 45 days in California). Deleting licence data ends the licence, because the licence cannot be checked without it. You will not be treated worse for using your rights.
12. Regional information
- European Union, EEA and Switzerland (GDPR, Swiss FADP): you have all rights in section 11 and may complain to the data protection authority where you live or work. We have not appointed a representative in the EU; you can reach us directly at support@positionboss.com.
- United Kingdom (UK GDPR): the same rights; you may complain to the Information Commissioner's Office (ICO). We have not appointed a representative in the UK; you can reach us directly at support@positionboss.com.
- United States (including California CCPA/CPRA and other state laws): in the last 12 months we collected the categories in section 2: identifiers (name, e-mail, account numbers, internet address code), commercial information (purchases), internet activity (website logs) and, for partners, payout information held by the Reseller. We use them only for the purposes in section 2. We do not sell or share personal information for cross-context behavioural advertising, and we do not use sensitive personal information to infer characteristics. You have the right to know, delete and correct, the right to opt out of sale or sharing (which we do not do), and the right not to be discriminated against for using your rights. You may use an authorised agent. If we refuse a request, you may appeal by replying to our answer.
- Canada (PIPEDA and provincial laws): you may access and correct your data and complain to the Office of the Privacy Commissioner of Canada.
- Australia (Privacy Act 1988) and New Zealand (Privacy Act 2020): you may access and correct your data and complain to the OAIC (Australia) or the Privacy Commissioner (New Zealand). Your data may be disclosed to providers in the countries named in section 5.
- Asia: where laws such as Singapore's PDPA, India's Digital Personal Data Protection Act 2023, Japan's APPI, South Korea's PIPA, Malaysia's PDPA, the Philippines' Data Privacy Act, Thailand's PDPA, Indonesia's PDP Law or Hong Kong's PDPO apply, you have the rights they give you, including access, correction, withdrawal of consent and, where provided, erasure and a grievance process. Write to support@positionboss.com (subject "Privacy"); we act as your contact for grievances.
- Africa: where laws such as South Africa's POPIA, Nigeria's Data Protection Act 2023, Kenya's Data Protection Act 2019 or Ghana's Data Protection Act apply, you have the rights they give you and may complain to the regulator (for example the Information Regulator in South Africa, the NDPC in Nigeria or the ODPC in Kenya). Our information officer can be reached at support@positionboss.com.
- Latin America (for example Brazil's LGPD): you have the rights your law gives you and may contact the national authority.
13. Cookies
See the Cookie Policy.
14. Changes
When this policy changes, the date at the top changes. We tell you about important changes by e-mail or on the website.