Ordertune Platform — Privacy Policy

Version: privacy-v1 Effective from: 2026-10-01 Binding language: English. Any translation is provided for convenience only.

1. What this covers

This policy describes how we process personal data on the Ordertune trading platform at t1.ordertune.com.

Our public website ordertune.com and our documentation at docs.ordertune.com have their own privacy notice, which also covers cookies, analytics and the newsletter. You will find it at https://ordertune.com/imprint-terms-privacy/#privacy.

Controller within the meaning of Art. 4 (7) GDPR is Order Dynamics GmbH, Geschwister-Scholl-Strasse 109, 20251 Hamburg, Germany. The full company details are in the Legal Notice at https://ordertune.com/imprint-terms-privacy/#imprint. Contact for all data-protection matters: legal@ordertune.com.

2. The short version

The Platform holds three kinds of data about you: who you are, what your brokerage account looks like, and what you did on the Platform. The second kind is the most sensitive, and it exists because the Platform cannot size a position without knowing the size of your account.

We never receive your broker credentials. The connection runs through the Ordertune Bridge, software that runs on your own machine and logs in to your broker on your behalf. Your username, password and broker second factor never reach us.

You can see everything we hold, category by category with its retention period, inside your account under *Settings — Your data*, and export it there.

3. Account and access data

To give you an account we process your email address, your password in hashed form, your display name, and your account state.

If you enable two-factor authentication we store the secret for your authenticator app, or the public key of your passkey, together with your recovery codes in hashed form. We store session records, the time of your last sign-in, and the IP address and user agent of sign-in attempts.

*Purpose:* providing the account, and protecting it. *Legal basis:* Art. 6 (1) (b) GDPR for the contract; Art. 6 (1) (f) GDPR for security, our legitimate interest being the prevention of unauthorised access.

4. Your brokerage account and your trading

This is the part that goes beyond an ordinary web service, so we set it out in full. When you connect a brokerage account, the Platform processes:

• the account identifier your broker reports, its base currency and its

type;

• the identifiers of every brokerage account your broker login manages, as

the Bridge last reported them. Most logins manage one account, and then this is the same figure as above. Where a login manages several — a margin and a retirement account, a joint account, or an adviser login holding client accounts — we store the whole list. We use it to size your orders against the right account and to check that your use of the Services matches your plan. Where such a list contains accounts belonging to other people, you are the one who connected that login, and section 7a of the Terms of Use tells you what to do before you do that;

• account equity and cash balances, kept over time as a history, because

position sizing is calculated from them;

• positions reported by your broker, including instruments, quantities and

entry prices — also those you opened yourself before joining, and those unrelated to our signals;

• orders and executions arising from signals you released, including

quantity, price, timestamps and broker references;

• your position-sizing configuration;
• which signals you released, skipped or confirmed, and when;
• exchange rates applied when your account is not denominated in the

currency of an instrument.

*Purpose:* delivering the Services — sizing positions, attributing entries and exits, presenting your holdings and their performance. *Legal basis:* Art. 6 (1) (b) GDPR. Without these data the Services cannot be provided.

We do not use these data to profile you for advertising, we do not sell them, and we do not pass them to any third party except the processors named in section 8.

5. The Ordertune Bridge

The Bridge is software you install and run. It connects to your broker locally and to the Platform over an authenticated channel. For that connection we process:

• a hash of the Bridge access token, never the token itself, together with

its first characters so that you can recognise the installation in the interface;

• a hardware fingerprint — a hash your Bridge computes from the hostname,

the CPU identifier and the first network address of the machine it runs on. It is bound to your connection so that a stolen token cannot be used from a different machine;

• the IP address your Bridge last connected from;
• a connection log recording when your Bridge was reachable, which version it

runs and on which platform;

• the pairing record linking an installation to your account. Pairing codes

are short-lived and are removed automatically within minutes, or the moment your Bridge collects its credentials;

• for each signal your Bridge collects,

the fingerprint of the installation that collected it, so that an order can be traced to the machine that placed it.

*Purpose:* operating the connection, and preventing account sharing and token theft. *Legal basis:* Art. 6 (1) (b) GDPR for the connection itself; Art. 6 (1) (f) GDPR for the fingerprint and the IP address, our legitimate interest being the prevention of misuse of credentials.

The Bridge runs on your machine and logs in to your broker with credentials you enter locally. Those credentials never reach us.

6. Payments

Payments are processed under Stripe's Managed Payments programme, with Stripe as merchant of record. The checkout and subscription-management surfaces are operated under the Link brand.

When you subscribe, you enter your name, billing address, email address and payment details directly with Stripe. We do not receive or store your card or bank details.

Stripe returns to us the subscription metadata we need to grant access: a customer and subscription identifier, the plan, the status, the current period and the currency. We store an identifier that links your Ordertune account to your Stripe customer record, so that a later change to your subscription can be matched to your account without relying on an email address.

*Legal basis:* Art. 6 (1) (b) GDPR.

7. Email

We send transactional email — account and security notices, daily summaries and service messages — through Resend. For that purpose your email address and the content of the message are processed by Resend.

You can configure which non-essential messages you receive under *Settings*. Security and billing notices cannot be switched off while your account exists.

*Legal basis:* Art. 6 (1) (b) GDPR for service messages; Art. 6 (1) (f) GDPR for security notices.

The newsletter is a separate service run from our website and is described in the website privacy notice.

8. Who processes data for us

Each acts on our instructions under a data-processing agreement. Where personal data reaches a country outside the EEA, the transfer is covered by the European Commission's Standard Contractual Clauses or another lawful transfer mechanism.

We do not use analytics, advertising or tracking technologies on the Platform. The Platform sets only the cookies required to keep you signed in and to protect the session.

9. Records we keep for security and proof

Audit events. State-changing actions on the Platform are recorded with the acting account, the action and the time. This lets us reconstruct what happened to an account, including access by our staff, which is itself recorded.

Rate-limit counters. Short-lived counters that protect sign-in, checkout and other sensitive paths from abuse. Removed automatically after 24 hours.

Consent records. When you accept the Terms of Use, this Privacy Policy, the Risk Disclosure or the Bridge Terms, we record which document, which version and when. These records are what allow us — and you — to establish later what you agreed to.

*Legal basis:* Art. 6 (1) (f) GDPR for security; Art. 6 (1) (c) GDPR where we must be able to demonstrate compliance.

10. Client classification

We record whether your account is classified as a retail or a professional client. The classification affects which functions are available to your account. It is recorded with its reason and the time it was set.

*Legal basis:* Art. 6 (1) (b) and (c) GDPR.

11. How long we keep data

Retention differs by category, and the Platform shows you the applicable period for every category under *Settings — Your data*. In outline:

• Account and connection data — until you delete your account.
• Trading records — subject to statutory retention periods, currently up to

six years, because they document a business transaction.

• Consent records, audit events and staff-access records — retained after

account deletion, stripped of IP address and device information, because their purpose is to establish what happened.

• Short-lived technical records — pairing codes, rate-limit counters, pending

email confirmations — removed automatically, within minutes or hours.

Deleting your account. You can request deletion in the Platform. The request starts a grace period during which you can reverse it. After that, personal data is erased or pseudonymised, except where we must keep it to meet a legal obligation or to defend a legal claim. Any active subscription is cancelled as part of the process.

12. Your rights

Under the GDPR you have the right to access your data, to have inaccurate data corrected, to erasure, to restriction of processing, to data portability, and to object to processing based on legitimate interests. Where processing rests on consent, you may withdraw it at any time with effect for the future.

The Platform provides access and portability directly: *Settings — Your data* gives you the full catalogue and an export.

To exercise any other right, write to legal@ordertune.com. You also have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your residence or place of work.

13. Security

Traffic between your device and the Platform is encrypted in transit. Credentials are stored hashed, and secrets are encrypted at rest. Access by our staff to a customer account is restricted, requires re-authentication and is recorded.

No method of transmission or storage is completely secure, and we do not claim otherwise.

14. Changes

We may update this policy. A new version is published at /legal/privacy with a new version identifier, and the version you accepted remains retrievable at /legal/privacy/v/<version>. Where a change is material, we will tell you before it takes effect.

Contact: legal@ordertune.com