Privacy Policy
Last updated: 29 October 2026 · Version 2026-10-29
In short. We collect what we need to run your subscription, deliver signals and, if you choose, act on your trading account. We do not sell your data or use your trading data for advertising. API keys and access tokens are encrypted and deleted when you disconnect. Analytics on our website run only with your consent. You can ask for a copy of your data, correct it, delete it or object at support@longshortpro.io.
This policy explains how we process personal data when you use the LongShort PRO website (longshortpro.io), the dashboard (your personal account), our Telegram bots and channels, and our support. It meets our information duties under Articles 13 and 14 of the General Data Protection Regulation (EU) 2016/679 (GDPR).
1. Who we are
The controller of your personal data is Palina Keda, a sole proprietor entered in the Polish business register (CEIDG), trading as LongShort PRO, NIP 9512640397, REGON 543931063, ul. Sarmacka 21 lok. 35, 02-972 Warszawa, Poland, email support@longshortpro.io.
We have not appointed a data protection officer, because our core activities do not involve large-scale regular and systematic monitoring or large-scale processing of special categories of data. For any privacy question, write to support@longshortpro.io.
2. Data you give us
- Account data: email address, password (stored only as a hash by our authentication provider), or your Google or Telegram identity when you sign in with them.
- Telegram data: Telegram ID, username, first and last name, language and profile photo, and messages you send to our bots or support.
- TradingView username, so that we can give you access to the indicator.
- Payment data: name, email, billing country and address, plan, amounts and dates. Card details are entered on Stripe's page; we see only the card brand and last four digits. For crypto payments: the network, your wallet address and the transaction ID.
- Dashboard settings: risk per trade, order type, exchange for prices, watched signals, your trade journal and demo account.
- Trading Features (only if you use them): your country of residence and your confirmations when you accept the Trading Terms; the Automation parameters you approve; exchange API keys; your Bybit UID for copy trading or for paying with Bybit commissions.
- Support and complaints: what you write to us and our answers.
- Referral programme: your referral code, referred purchases, earnings and, for payouts, your wallet address and network.
Account data, Telegram ID and payment data are needed to conclude and perform the contract; without them we cannot provide the Service. Trading Feature data is needed only if you use those features. Everything else is optional.
3. Data we receive from others
| Source | What we receive | When |
|---|---|---|
| Telegram | Telegram ID, username, name, language, photo | When you sign in or use our bots |
| Google account ID, name, email, photo | When you sign in with Google | |
| Stripe and Link | Payment and subscription status, billing country, card brand and last four digits | When you pay on the website |
| Bybit | Your account's balances, positions, orders and executions, using the API key you give us; for your Bybit UID linked to our affiliate account: your trading fees and commissions, trading volumes, deposits and whether your account is verified | When you connect Bybit, start copy trading, or join Bybit through our link |
| Spotware (cTrader) and your broker | Access tokens, account numbers, broker, balances, positions, orders and deal history for the accounts you select | When you connect cTrader |
| Vercel (our hosting) | The country associated with your IP address | With each request; we store it only in the consent log, when you accept or withdraw the Trading Terms and when you switch Automation on or off |
4. Why we use your data and on what legal basis
| Purpose | Data | Legal basis (GDPR Art. 6(1)) |
|---|---|---|
| Your account and sign-in | Account and Telegram data | (b) contract |
| Delivering the Service: signals, bots, dashboard, indicator access | Telegram ID, TradingView username, settings | (b) contract |
| Payments, invoices, taxes | Payment data | (b) contract; (c) legal obligation (tax and accounting law) |
| Trading Features: placing orders, Automation, copy trading | API keys and tokens, account data, Bybit UID, parameters | (b) contract |
| Proving what you accepted and instructed; handling complaints and claims | Records of acceptances, consents and orders, with time, version, IP address, country by IP and browser | (f) legitimate interest in establishing and defending legal claims |
| Applying the restricted-jurisdiction rules of the Trading Terms and sanctions law | Declared country, confirmations, country by IP (recorded only) | (b) contract; (f) legitimate interest in complying with sanctions and partner rules; (c) where sanctions law requires it |
| Paying your subscription with Bybit commissions, at your request | Bybit UID, commissions | (b) contract |
| Referral programme | Codes, purchases, earnings, payout details | (b) contract; (c) for payout records |
| Support and complaints | Messages | (b) contract; (c) for consumer complaints |
| Security and abuse prevention | IP address, browser, server logs | (f) legitimate interest in keeping the Service secure |
| Website analytics | Cookie identifiers, pages, clicks, session recordings | (a) consent |
| Marketing messages | Email, Telegram ID | (a) consent |
Our legitimate interests are named in the table. You can object to processing based on them (section 9).
We do not use your trading data or keys for analytics, advertising or anything other than the Trading Features.
5. Automated decisions
Automation places orders on your account automatically, but only because you instructed it to, within the parameters you approved. It is the performance of your instruction, not a decision about you. Access to the Trading Features depends on the country you declare and your confirmations under the Trading Terms. You can ask us to review any restriction manually at support@longshortpro.io. We do not profile you, except for website analytics run with your consent.
6. Who we share data with
We do not sell personal data. We share it only with the following recipients, and with authorities and courts when the law requires.
| Recipient | Role | Data | Location | Transfer safeguard |
|---|---|---|---|---|
| Vercel Inc. (USA) — website and dashboard hosting | Processor | All data passing through the website and dashboard | Dashboard functions in Frankfurt; global network | EU-US Data Privacy Framework (DPF); Standard Contractual Clauses (SCC) |
| Railway Corporation (USA) — databases and servers | Processor | Account, dashboard, subscription and trading data | Databases in Amsterdam; some services in the USA | DPF; SCC |
| Supabase Pte. Ltd. (Singapore) — website accounts | Processor | Email, password hash, sign-in identities, purchases, support threads | Stockholm and Frankfurt | SCC |
| Stripe and Link — website payments (merchant of record: Sold through Link, LLC, USA; processing: Stripe Technology Europe, Limited, Ireland) | Independent controllers | Name, email, billing country and address, payment method, order and subscription | EEA and USA | Link collects payment data directly at checkout under its own privacy policy; for data we share: DPF (Stripe, LLC); SCC |
| Cloudflare, Inc. (USA) — DNS, CDN, security and email forwarding for longshortpro.io | Processor | IP address, request data, security events; emails sent to our addresses | Global network | DPF; SCC |
| Plus Five Five, Inc. (Resend, USA) — emails | Processor | Email address and email content | USA | DPF; SCC |
| Google Ireland Limited (Google Analytics) — website analytics, only with consent | Processor | Cookie identifiers, pages, clicks, device type, approximate location | EEA and USA | DPF; SCC |
| Air Smart Advertising Solutions FZ-LLC (Yandex Metrica, UAE) — website analytics, only with consent | Processor | Cookie identifiers, pages, clicks, session recordings | UAE and affiliated data centres outside the EEA | SCC |
| Hosting provider of our trading server (EEA) | Processor | API keys in use, orders, logs | EEA | — |
| Our accountant | Processor | Invoices and payment records | Poland | — |
| Telegram Messenger Inc. | Independent controller | What you exchange with our bots and channels, and website support-chat messages, which we handle in a Telegram group | EEA user data stored in the Netherlands | — |
| TradingView, Inc. (USA) | Independent controller | Your TradingView username | USA | Necessary to perform your contract (Art. 49(1)(b)) |
| Google Ireland Limited | Independent controller | Sign-in with Google | EEA and USA | DPF |
| Bybit (Bybit EU GmbH for EEA users) | Independent controller | Orders and API calls with your key; your UID | Austria; outside the EEA for non-EEA users | Within the EEA none needed; otherwise necessary to perform your contract (Art. 49(1)(b)) |
| Your broker, and Spotware Systems Ltd (Cyprus, HE 301668), which runs cTrader and the Open API for your broker | Your broker is an independent controller; Spotware acts for your broker | Orders, account access and account data through the cTrader Open API | Cyprus; your broker's country | Within the EEA none needed; for a broker outside the EEA, necessary to perform your contract (Art. 49(1)(b)) |
| Discord, Notion, GitHub (USA) — only for products that give access through them | Independent controllers | Discord ID or email used for the invitation | USA | DPF |
Our team members and contractors access data only as far as their tasks require and are bound to confidentiality.
7. Transfers outside the EEA
Some recipients are in the USA, Singapore or the UAE. Where a recipient is certified under the EU-US Data Privacy Framework, we rely on the European Commission's adequacy decision of 10 July 2023. Otherwise, and in addition, we use the Standard Contractual Clauses approved by the Commission (Decision (EU) 2021/914). Where you ask us to send data to a service outside the EEA, such as TradingView or your exchange, the transfer is necessary to perform your contract. You can request a copy of the safeguards at support@longshortpro.io.
8. How long we keep data
| Data | How long |
|---|---|
| Account, settings, Telegram and TradingView identifiers | While your account is active; deleted or anonymised within 30 days after it is closed |
| API keys and access tokens | Deleted within 24 hours after you disconnect or withdraw your acceptance of the Trading Terms, and no later than 30 days after your subscription ends |
| Records of acceptances, consents, orders, complaints and our answers | Until the end of the sixth calendar year after the event (the limitation period for consumer claims under Article 118 of the Polish Civil Code), longer if a dispute is pending |
| Payment, invoice and payout records | Five years from the end of the year in which the related tax was due (Polish Tax Ordinance, Articles 70 and 86); ten years for EU One-Stop-Shop VAT records, if they apply |
| Support messages | Three years after the case is closed |
| Server logs | Up to 90 days |
| Referral click data | 12 months |
| Analytics cookies | As described in the Cookie Policy |
| Marketing consent | Until you withdraw it |
Backups are overwritten within 30 days.
9. Your rights
You have the right to:
- access your data and get a copy;
- have inaccurate data corrected;
- have your data deleted, where there is no longer a reason to keep it;
- restrict processing in certain cases;
- receive the data you gave us under the contract or your consent in a machine-readable format, or have it sent to another controller;
- withdraw consent at any time, without affecting what we did before;
- lodge a complaint with a supervisory authority.
Right to object. You can object at any time, on grounds relating to your particular situation, to processing based on our legitimate interests. We will stop unless we have compelling legitimate grounds or need the data to establish or defend legal claims. You can object to direct marketing at any time, without giving reasons.
To use your rights, write to support@longshortpro.io from the email of your account or message @longshortpro_support in Telegram from the account you use with us, so that we can confirm it is you. We respond within one month. If a request is complex, we may extend this by two more months and will tell you why within the first month. Exercising your rights is free.
Supervisory authority. In Poland: President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stanisława Moniuszki 1A, 00-014 Warszawa, https://uodo.gov.pl. You can also complain to the authority of the EU country where you live or work.
10. Children
The Service is not intended for anyone under 18. We do not knowingly collect their data. If we learn that a user is under 18, we close the account and delete the data.
11. Security
We protect data with measures appropriate to the risk:
- API keys and access tokens are encrypted at rest, and the encryption key is kept separately from the database;
- we accept only API keys without withdrawal or transfer permissions;
- connections use HTTPS;
- access to production systems is limited to the people who operate the Service.
If a personal data breach is likely to put you at risk, we notify the supervisory authority within 72 hours. If the risk is high, we also tell you without undue delay, for example to revoke a key.
12. Cookies
See the Cookie Policy.
13. Changes to this policy
If we change this policy, we publish the new version here with a new date. If we want to use your data for a new purpose, we will tell you in advance. Changes that need your consent apply only after you give it.