Version: tgct-2026-11-13-v1. Draft for review; customer purchases remain closed.
Controller and privacy contact
Telegram Copy Trade, the trading name of a Maltese sole proprietorship, is responsible for its customer account and billing processing. Send privacy correspondence to info@telegram-copytrade.com or care of Capsule Technologies at Business House Suite 7, Triq l-arcisqof Pietru Pace, Victoria, Gozo, VCT2504, Malta. This business-office contact does not represent a transfer of the payment account or a claim that an unrelated company is the seller. A separately appointed processor or representative must be identified according to its actual agreement and role.
Data used and purposes
Account data includes the sign-in identity, contact email, workspace membership, selected plan and enabled devices. Billing data includes payment-provider references, subscription and invoice status, the applicable policy version and consent records. Trading configuration includes platform, broker server, account number, selected sources, symbol mappings, risk settings and runtime acknowledgements. Operational records include received-signal decisions, command state, connectivity, security and recovery events needed for the service.
Private Telegram setup creates a dedicated authorised session. Telegram may make more account information technically accessible to that session than the sources selected for monitoring. The connector must retain monitored events only from the configured sources. A private session file can grant access to the account and must be protected. The website heartbeat does not require a broker password, raw Telegram session, raw signal text or arbitrary terminal log. Customer Managed credential processing remains unreleased and must have its secure setup, access controls and exit procedure disclosed and qualified before it is supplied.
Legal bases and choices
We use necessary account, configuration, billing and service records to perform the requested contract or take steps at your request before a contract. Required tax and accounting records are processed for legal obligations. Proportionate security, fraud prevention, reconciliation, incident handling and legal-claim retention rely on legitimate interests, subject to applicable rights and safeguards. Optional marketing requires its applicable permission and controls; an account, broker connection or purchase alone is not permission for every promotional purpose. Optional AI processing must be separately described before it is enabled.
Providers, access and international processing
The current development service uses OpenAI Sites/ChatGPT authentication and hosting, Cloudflare storage, private VPS services, Stripe for payments and Infomaniak for the support mailbox. Authorised personnel and contracted infrastructure providers may process the records needed for their role. Stripe receives payment details through its own payment interface; do not send card data in support correspondence. Telegram and the chosen broker separately process the data sent to their services.
Infrastructure may process relevant data outside the European Economic Area. The final processor inventory must identify the applicable contracts, locations and transfer safeguards before the commercial service opens; this draft does not claim that every record stays in the EEA or that an unverified agreement is in force. We may disclose information where lawfully required or necessary to address a security incident or legal claim.
Retention and service exit
Account and billing records are retained while needed for the contract, reconciliation, applicable accounting/tax obligations and legal claims, then removed or minimised under the approved retention schedule. Private research examples, support records, operational logs and backups have distinct purposes and retention controls. Evidence for an unresolved execution, incident or qualification case may be held for review rather than deleted automatically. Cancelling renewal does not immediately erase records required for these purposes or close broker positions.
You may request an export, deletion or retention review using the privacy contact. An exit procedure must cover device revocation, Telegram authorisation, credentials, retained evidence and backups without removing information needed to reconcile open exposure. Managed delivery and its exit procedure remain subject to acceptance before commercial availability.
Your rights and complaints
Depending on the applicable law, you may request access, correction, erasure, restriction or portability, and object to processing based on legitimate interests. Consent may be withdrawn where it is the basis without affecting earlier lawful processing. We may need proportionate identity verification before disclosing or changing account records. Some records must remain for legal obligations or claims. You can complain to the competent supervisory authority, including Malta's Information and Data Protection Commissioner at https://idpc.org.mt.
Security and limitations
Use the private setup for credentials and protect your computer, phone and VPS. Never include a password, Telegram login code, session file or private key in a support case. No system can guarantee uninterrupted access or eliminate the risk of a security incident. Material changes to this notice will be dated and communicated where required; the applicable version is retained with the relevant acceptance record.