1. Who we are (data controller)

This service is operated by UseBullion Trading Technologies ("UseBullion", "we", "us"), trading as "UseBullion". UseBullion Trading Technologies is the data controller for personal data processed through this website and the UseBullion platform, and determines the purposes and means of that processing.

For all privacy questions, requests, or complaints, contact hello@usebullion.com.

2. What we collect

Account data: email, display name, plan and role.
Usage data: pages viewed, settings changes, polling preferences.
Risk-configuration data: the limits you set, notification settings, audit findings.
Billing-related data: when you purchase a paid plan, our payment processor Flutterwave collects your name, billing email, and payment method details directly from you. UseBullion receives only a transaction reference and subscription status — we do not see or store your full card number.

We do not collect or store your brokerage credentials, account balances, or personal financial information. Your funds remain entirely with your broker.

3. How we use it, and our legal basis

For users in the UK, EEA, and other jurisdictions with equivalent laws, we rely on the following legal bases under Article 6 of the UK/EU GDPR:

Performance of a contract (Art. 6(1)(b)) — to create and operate your account, provide the risk-control dashboard and API, deliver paid subscription features, and process payments via Flutterwave.
Legitimate interests (Art. 6(1)(f)) — to secure the service, prevent fraud and abuse, monitor reliability and performance, and improve the product. We balance these interests against your rights.
Legal obligation (Art. 6(1)(c)) — to keep tax, invoicing, and accounting records, and to respond to lawful requests from authorities.
Consent (Art. 6(1)(a)) — for optional analytics cookies and marketing emails. You can withdraw consent at any time from the Cookie preferences page.

4. What we do not do

We do not sell your personal data.
We do not share trading behaviour with third parties for marketing.
We do not access, hold, or manage your funds in any way.

5. Data storage and security

Data is encrypted in transit and at rest. Database access is governed by row-level security so users only see their own records. Admins can view aggregate usage and broadcast notifications, never your private credentials.

5a. Retention

Account and usage data is retained for the life of your account. When you delete your account, personal data is removed within 30 days except where we must keep records to meet legal obligations (for example, billing and tax records are typically retained for 6–10 years depending on jurisdiction). Consent audit entries are kept for 24 months. Analytics events (if you opt in) are retained by Google Analytics 4 for 14 months at event level; aggregated reports may be kept indefinitely. Local session identifiers are cleared when you close the tab.

5b. Third-party sharing & subprocessors

We share personal data only with the processors and recipients required to run the service:

Flutterwave — payment processor. When you buy a paid plan, Flutterwave processes the transaction on our behalf. It collects your billing name, email, payment method, IP address, and transaction details in order to take payment, prevent fraud, issue receipts, and process refunds and chargebacks. Flutterwave is an independent data controller for the payment transaction. See Flutterwave's Privacy Policy and Terms of Use.
Supabase — managed database, authentication, and storage backend (processor).
Google Analytics 4 (Google LLC) — usage analytics, loaded only after you opt in via the cookie banner. IP addresses are anonymised and data is transferred under Standard Contractual Clauses.
Transactional email provider — delivery of security and account notifications.
Professional advisers and authorities — legal, accounting, and tax advisers, and government or regulatory bodies where required by law.

We do not sell personal data, do not share it for third-party advertising, and do not enable cross-site tracking or session replay.

5c. International transfers

Some of the processors above (including Flutterwave and Google) may process personal data outside your country of residence, including in the United States and the United Kingdom. Where required, transfers are protected by Standard Contractual Clauses, the UK International Data Transfer Addendum, adequacy decisions, or equivalent safeguards.

6. Your rights

Subject to applicable law (including the UK/EU GDPR and the CCPA), you have the right to access, rectify, erase, restrict, port, and object to processing of your personal data, and to withdraw consent where processing is based on consent. You may exercise these rights from Account Settings or by emailing hello@usebullion.com. We will respond within 30 days. If you are in the UK or EEA, you also have the right to lodge a complaint with your local supervisory authority.

For billing-related requests (invoice corrections, refunds, VAT/tax IDs), contact us at hello@usebullion.com.

7. Cookies

We use only essential cookies and local storage required to keep you signed in and remember your settings. Optional analytics cookies are loaded only after you opt in. Manage your choice on the Cookie preferences page.

8. Contact

UseBullion Trading Technologies — privacy questions: hello@usebullion.com. Billing and payment questions: hello@usebullion.com.

Privacy Policy