Privacy Policy

1.Who looks after your data

The data controller is Bussolo Gabriel (ditta individuale), P.IVA IT02788660203, Porto Mantovano (MN), Italy. Data Protection Officer (DPO): Gabriel Bussolo, contact@socialnetworktrader.com.

This policy applies to the website and the Android and iOS apps, and follows the LGPD (Brazil), the GDPR (European Union and United Kingdom) and other applicable laws.

2.What data we collect

Sign-up: name, username, email, password (stored encrypted), date of birth, country and language.

Verification: the date of birth given at sign-up; in teen mode, the guardian's e-mail and authorisation; in a badge request, the form data and the document you attach (PDF or image), stored in a private space that only administrators open. When partner checks are in place, document photos and the selfie will stay with the partner, and the Network will only receive the result and the legal name.

Connected accounts: trades, results and, if you allow it, balance, read from MT4/MT5 with the investor password, which is kept encrypted by the connection provider.

Content: posts, analyses, TradingView images, comments, scraps, messages, reactions, votes and courses.

Usage and device: IP address, device type, operating system, language, access and error logs.

Course purchases: course, amount, commission, date, status and refund deadline. Card details go straight to Stripe; the Network never receives them. From sellers: the Stripe account ID and whether it can charge and receive payouts; ID, tax and bank details stay with Stripe.

Youth mode: the guardian's email and link, and the settings they choose.

Encrypted chat: your public key, a copy of your private key locked with your PIN and a PIN check code. Never the PIN or the content of new messages.

Invitations: the e-mail you type to invite someone is only used to send that invitation.

Suggestions and bug reports: the text you send, the page you were on and your browser type, to fix the problem.

Blocks and mutes: who you blocked or muted and when. Only you see your list; people you block or mute aren't notified.

"Report a bug" attachments (up to 3 files of 10 MB: images, videos, PDF or text) are kept in private storage that only the administration can open. Applications through the "Work with us" page: name, email, phone and link (optional), message, chosen position and CV as a PDF (up to 5 MB), also in private storage and seen only by the administration. Legal basis: your consent and pre-contractual steps taken at your request.

3.What we use it for and on what legal basis

Providing the service (creating the account, showing the feed, Journal and Calendar, delivering messages): performance of the contract.

Confirming age and identity, keeping access logs and responding to authorities: legal obligation.

Security, preventing scams, spam and fake accounts: legitimate interest.

Push notifications, news emails and non-essential cookies: consent, which you can withdraw at any time.

Payments and payouts to creators: performance of the contract and tax obligations.

Emails: account notices (sign-up, password, verification) and important notices about the Terms and Privacy are mandatory. The newsletter and new-follower notices only with your consent, and you can turn them off in Settings or via the link in the email itself.

Location sticker: consent (your device's location permission, asked at that moment). You can refuse and search the place by name.

Read and play receipts, story tags and message reports: performance of the contract and legitimate interest (community safety).

Blocking and muting: performance of the contract (carrying out your choice) and legitimate interest (community safety).

4.What is public

Name, @, photo, cover, bio and the posts on your profile, if it is public.

The Journal, Calendar and results, according to what you turn on in Settings. The cash balance is hidden by default.

Published analyses are locked and remain visible while the account exists. When you delete the account, they may be anonymised.

5.Who we share it with

We do not sell your data.

We only share what is necessary with providers working for us: hosting and database, login, MT4/MT5 connection, e-mail delivery (Resend), notifications, live streaming, course storage, place-name search and course payments (Stripe). When switched on: age and identity checks by a partner and AI translation.

Authorities and courts, when there is an order or legal obligation, and to protect users against fraud.

For people who buy a course, the creator's seller details are shown, as required by law.

6.Companies and services we use

Supabase (Supabase Inc.): database, sign-in, files (photos, videos, audio) and real-time features. Data is stored on servers in the European Union (Ireland).

Vercel (Vercel Inc.): hosting for the website and apps; requests go through Vercel's global network and are processed in the European Union.

Resend (Resend Inc., USA): sending account emails and alerts.

MetaApi (Agilium Labs): read-only connection to MT4/MT5 using the investor password, only for those who connect an account.

Google: Sign in with Google, YouTube thumbnails and videos in posts, and alerts in Chrome and on Android (Firebase Cloud Messaging).

Apple: Sign in with Apple and alerts in Safari, on iPhone and iPad (Apple Push Notification service).

Mozilla: alerts in Firefox.

Cloudflare (Cloudflare Inc.): live streaming (Cloudflare Realtime) and private storage of course videos and PDFs (Cloudflare R2).

Age and identity verification and AI translation providers will be listed here by name before each feature is switched on. [review]

Each company only receives what its service needs and is contractually bound to protect the data.

OpenStreetMap (OpenStreetMap Foundation, United Kingdom, Nominatim service): only when you use the location sticker, it receives the text you search or your device's approximate position, to return place names. The Network does not store the position.

TradingView: only when you open a shared chart, which opens on the TradingView website. The Network keeps a copy of the snapshot and does not send your data to TradingView.

Stripe (Stripe Payments Europe Ltd., Ireland, and Stripe, Inc., USA): processes course payments, stores buyers' card details and sellers' registration (identity, tax and bank details). For this data, Stripe is also responsible under its own privacy policy.

Cloudflare Turnstile (Cloudflare Inc.): anti-bot check at login, sign-up and password recovery. It analyses technical signals from the browser and device (such as IP address and browser characteristics) to tell people from bots; the Network only receives the result. Legal basis: legitimate interest in security. [review]

Since version 0.54, Cloudflare R2 (Cloudflare Inc.) also stores videos posted to the feed and their covers (public, like the post) and story photos and videos (private, opened only through temporary links for people allowed to see them, and deleted when the story ends). Files uploaded earlier remain on Supabase.

Payments inside the site: the payment form and the creator's sales dashboard are Stripe components shown on the Network's pages. Card details, documents and bank details are typed directly into these components and go to Stripe; the Network neither sees nor stores them. The Network receives from Stripe only the result (paid, refunded, disputed), the amounts and the transaction identifiers.

7.Each feature and the data it uses

Stories: the photo, the video (up to 30 s), the text and the position/rotation you choose; who viewed and when. They stay up for 24 hours and only signed-in people see them, through temporary links. Files and the viewer list are deleted within 48 hours after they expire.

Story camera: photos, videos, PiP (front and back) and Boomerang are made on your device. Only the final result is uploaded; nothing is recorded until you tap the button.

Story replies: they become a message in your conversation with the author, linked to the story, and follow the chat rules.

Chat and groups: texts, photos, videos, voice messages, shared posts, replies, the trend up (double tap), when each person read and, for voice messages and videos, when each person played them. Only people in the conversation see them. Files are kept in a private space and open via temporary links; new ones are encrypted (see Encrypted chat).

Online: while the website or app is open, others can see you are online. This is not stored in the database. You can turn it off in Settings; when off, you won't see others either.

Device alerts (push): we store your browser's or device's technical address to deliver alerts while they are on. The alert text passes through Google's, Apple's or Mozilla's push service, depending on your browser.

Signed-in devices and security: we store browser, system, country (from the network) and a device identifier to show where your account is open, warn you of new sign-ins and let you sign out remotely.

Two-step verification: the authenticator app key is stored, encrypted, by the sign-in service (Supabase Auth). We never see your codes.

Notifications: what happened, who did it and when, to build the bell and the alerts.

Calendar and trade sheet: asset, prices, times, result, the TradingView snapshot (we keep a copy), up to 3 images, thesis and execution are shown to people who see your calendar (if it is public). The day plan is shown with it; the day review and each trade's review (emotions, mistakes, discipline, lessons) stay private unless you share them. Images are kept in a private space and open through temporary links. Deleting a trade deletes its images.

Lives: the streamer's video and audio pass through Cloudflare (Cloudflare Realtime) to viewers and are not recorded. We keep the title, who streamed, where, start and end, and the comments (deleted 1 day after it ends). Who is watching right now is counted in real time and not stored. For the OBS key we keep only an encrypted version (hash).

Courses: course details (title, description, cover, modules, lessons), who enrolled, progress in each lesson, reviews and reports. Lesson videos and PDFs are stored on Cloudflare R2 in a private space and only open through temporary links for enrolled students. The author sees how many students they have; the sales team sees the content to approve it.

Ranking and achievements: only MT4/MT5-verified results of adults (18+) with a public journal; positions are recalculated every hour.

Moderation and appeals: reports, decisions (with the reason and an excerpt of the removed content) and appeals, to guarantee your right to contest.

Communities: name, description, category and rules are public inside the network and go through a prohibited-terms filter.

Instant story: each person can view it once, after which the story and its file no longer open for them. To discourage captures, we show the viewer's @ over the image and hide the content when the app loses focus. Mobile browsers don't allow blocking system screenshots; in the Android and iOS apps, capture is blocked where the system allows. Capturing or sharing an Instant story without permission breaks the Terms.

Encrypted chat: new texts and files are encrypted on your device before they leave it; we only store the encrypted version, which we cannot read. We can still see who talks to whom, when, and the type of attachment (photo, video or voice). We store your public key and a copy of your private key locked with your PIN, which we cannot open. Your PIN is never sent: only a check code derived from it, to limit attempts (10 wrong tries lock the vault).

Reports: who reported, who was reported, the reason, the written details and a copy of the reported content (comment or story text, and the story file until the decision; for a profile, the name, @, bio and photo address as they were at that moment). For a message report, the up to 20 messages the reporter's device sends unencrypted. Only the moderators see this; the reported person doesn't learn who reported them.

Stories: stickers (time, location, @ and trading) and drawings are stored with the story and disappear with it. The location sticker uses your device's location only at that moment, to find the place name on OpenStreetMap (which receives the approximate position); we only store the name you choose. People you tag get a notification and can reshare your story; a reshare keeps a copy of the original (photo or video and text) while it's live and shows "Reshared from @…". The reshare notification can be turned off in settings.

Chat camera, editor and HD: photos and videos taken with the app camera and edits (crop, rotate, trim, sound, drawing, text and stickers) are done on your device; only the result is sent. Without HD, photos and videos are reduced on the device before sending; with HD, they go in original size. Saving a received photo or video copies the file to your device.

Remember the account on this device: the browser keeps how you last signed in (name, photo, e-mail and method) to show "Continue as…". You remove it on the sign-in screen, under "Not you?".

Verification request: the form data and attached document are kept in a private space; only you and the administrators open them, to review the request.

Activity on the Network: we keep the date of your last visit (updated at most twice a day) to pause MT4/MT5 account syncing for people who haven't opened the Network in over 14 days. New followers: if you turn on the email notice, you get one summary a day (it is off by default for new accounts). Course purchases: students and creators get in-app notices about purchases, refunds, disputes and lesson unlocks.

Affiliate referrals: when you open an affiliate's link, we keep for 30 days which affiliate referred which course (in an snt_ref cookie in your browser and, if you're signed in, linked to your account), to credit the commission if you buy. On purchase, we record the affiliate, the percentage, the commission amount and its payout status. Affiliates see how many people opened their link and their sales, without the buyer's name or details; creators see which affiliates sold and how much. The snt_ref cookie is only stored if you accept affiliate cookies in the cookie notice; without it, the referral only counts while you're signed in.

Purchase emails: besides the in-app notice, students, creators and affiliates get the purchase receipt and notices of sales, refunds, disputes, lesson unlocks and commissions by email. These are transactional emails, sent through Resend to the account's email address, and can't be turned off while there are purchases or sales.

Course price history: we keep every price a published course has had, with the date it started to apply and, when the change was approved by the sales team, which team member approved it. Prices and dates are public course information (shown to buyers for 30 days after each change); who approved is visible only to the Network's team. We also keep the creator's price change request until it is decided, and the notice with the decision and reason stays in the creator's notifications. We use this data to show the previous price as the law requires, for auditing and to handle buyer complaints.

Partial refunds and disputes: for each purchase we also keep the total amount refunded, the dispute status (open, won or lost) and the dates, received from Stripe. Students see this data in their purchases; creators see it in their sales and sales report (no card data); affiliates see only their own commission. We use this data to keep course access correct, calculate commissions, send notices and for accounting.

Story likes and reaction lists: we keep who liked each story and when, for as long as the story exists (24 hours) or until it is deleted. The count is shown to anyone viewing the story; the names only to the author. On posts, who reacted and when are kept for as long as the post exists, and the list is visible to signed-in people. We also count how many times each post was sent by message and reposted to stories; we keep only the total, never who it was sent to. Attachments on analysis updates (image and TradingView snapshot, with the copy's hash) are kept for as long as the analysis exists.

Permanent account deletion: when you request deletion you confirm by typing your @ and are signed out of all devices immediately. When the team completes it, we delete the account and the data linked to it; published analyses may remain in anonymised form. To prevent the same account from being created again, we keep only a scrambled marker (SHA-256, with a secret that never leaves our database) of the deleted email and @. That marker lets us check whether an email has been deleted, but cannot be turned back into the email; no other data is kept. The legal basis is our legitimate interest in carrying the deletion through and preventing closed accounts from returning. If you believe this is a mistake, write to contact@socialnetworktrader.com.

Sales team: team members see, for the cases that reach the queue, the course or request in question, who the creator or buyer involved is, and that case's history. We keep who took each case, when they took it and what they decided. This exists so you know who you are dealing with, so the team does not work twice on the same case, and so we can answer for every decision. The legal basis is our legitimate interest in running the marketplace responsibly. The team panel only opens with two-step verification.

MT4/MT5 account deposits and withdrawals (how much came in and out each day): we use them to work out each day's balance and, from that, the correct % result. They stay hidden from other people until you switch the option on in Customise journal — a separate choice from showing the money amount, and both start off. The legal basis is performance of the contract (the Journal is the service) and, for showing them to others, your consent, which you can withdraw at any time.

MT4/MT5 account balance and currency: we keep the balance read at the last update and the account currency. The currency is used to show the right symbol on amounts; the balance is visible only to you unless you switch on the option to show it (it starts off). Snapshot capture attempts: when detected, we keep who tried, on which snapshot and when, and notify the poster — that record disappears with the snapshot. The legal basis is our legitimate interest in protecting posters' content.

Extra MT4/MT5 accounts subscription: we keep the Stripe customer and subscription identifiers, the number of slots, the payment status and the renewal and cut-off dates. Card details and billing address stay with Stripe, not with us. The legal basis is performance of the contract and, for invoices, our tax legal obligation; tax records are kept for the period the law requires.

Support and sales team: help requests keep the topic, the messages exchanged, who on the team handled it and when. The team also writes internal notes on the request, which you don't see. The sales team (authorised people, with two-step verification) accesses the course purchase and MT slot subscription data needed to assist, refund and cancel; each of their actions is kept in an internal log with who, for whom, when and why. Cards: we only show the brand, last 4 digits and expiry, read from Stripe. The legal basis is performance of the contract and our legitimate interest in good support and abuse prevention. When the account is deleted, the link between the requests and logs and you is removed.

In the iPhone and Android app, choosing a photo or video opens the device's photo library directly, and only the file you pick is uploaded. In the stories camera, the iPhone app shows a thumbnail of your most recent photo as a shortcut to the library: it is read only on the device and is never uploaded or stored by the Network. You can remove photo access at any time in the device settings.

Chat attachments: the file, the trade, profile or course card and the poll text go inside the encrypted message; the server only keeps that an attachment exists, the size of the encrypted file and, for polls, the number of the option each member chose. Video ads: the Network counts, per day, how many times each ad was shown and clicked, without recording who saw or clicked it, and does not share your data with advertisers. For advertisers, the sales team keeps the company name, the contact and what was agreed.

Video views: when you watch a post video for a few seconds, the Network records that you saw it, only once, to show the view count. Nobody, not even the author, sees who watched: only the total is shown.

Creator Partnership Program: if you apply, we store what you submitted in the form (niche, audience, format, links, motivation and example posts) and the team sees figures from your Network account (followers, posts, views, reactions, comments and communities over the last 90 days) to review the application. The decision, the level, the quality rating and who decided are recorded. If you join the program, we also store the campaigns you take part in, the content you submit for approval and your wallet's earnings and payouts; payment is made through Stripe to your connected account.

Videos and Clips: to split videos, we store the width, height and length of each posted video, read from the file itself at upload. Videos posted before this feature were measured once in the same way, only by reading the file; nothing else in the post changed. Views are still counted once per person, without showing who watched. Legal basis: performance of the contract (Art. 6(1)(b) GDPR). [review]

8.Artificial intelligence

The Network does not currently use artificial intelligence to process your data. If we start doing so (for example, to translate posts or help detect scams and spam), it will always be labelled and this policy will be updated beforehand.

We do not use private messages to train AI models. New messages are encrypted and not even the Network can read them.

9.Minors

Data of people aged 13 to 17 is processed with the guardian's consent and in the young person's best interest.

There is no behaviour-based advertising for minors, and their data is kept out of general administration dashboards.

10.Transfers to other countries

Some providers process data outside your country, such as Vercel, Resend and Cloudflare (United States) and OpenStreetMap (United Kingdom). When this happens, we use the safeguards provided by law, such as adequacy decisions and standard contractual clauses. [review]

11.How long we keep it

While your account exists: profile, posts, comments, messages, communities, journal, achievements and preferences.

Stories: up for 24 hours; files and views deleted within 48 hours after that.

Chat files: while the message exists; when an account is deleted, its messages are deleted and the files disappear within 2 days.

Alert delivery logs: 90 days. Read notifications: 180 days. Security events and unused devices: 1 year.

Moderation decisions and appeals: while the account exists, to allow appeals and evidence in case of abuse.

Access logs: for the period required by law (in Brazil, at least 6 months).

After you delete your account, we delete or anonymise data within [PERIOD] days, except what the law requires us to keep, such as tax data from sales.

Reports and what comes with them (including messages sent with a chat report): while the decision can be appealed and for up to [PERIOD] afterwards, to prove the decision and prevent abuse. A reported story is deleted after the decision.

Encrypted chat keys: while the account exists; when you create a new PIN, the old copy is replaced. Read and play receipts: while the message exists. Live comments: 1 day after the end. Story tags and reshares: while the story exists (24 hours live).

Verification request document: while the request is under review and for up to 30 days after the decision; after that, the file is deleted automatically and only the request record remains. Uploaded files that didn't become a request are deleted the next day.

Blocks and mutes: until you undo them or delete your account.

Course purchases: for the period required by tax law (10 years in Italy), even after the account is deleted; in that case they are no longer linked to the profile. [review]

Applications and CVs: up to 12 months after submission, then deleted automatically; you can ask for earlier deletion. "Report a bug" attachments: deleted automatically 6 months after submission once the report has been resolved or dismissed.

Stripe notice log (event identifier, type, creator account, dates and error, no card data): up to 24 months, for payment auditing and reconciliation; then deleted automatically. Date of last visit: as long as the account exists.

Referrals (affiliates): 30 days after opening the link if no purchase is made; then deleted. Commission data on a purchase: as long as we keep the purchase, for accounting.

Course price history: as long as the course exists; deleted together with the course. Purchases keep the amount paid in each one, for the purchase retention period.

Deleted-account marker (scrambled email and @): kept indefinitely, because it is what prevents the account from returning. It is the only data left after deletion.

Case record (who took the case, when and what they decided): kept for 5 years after the case is closed, together with the decision history, so we can answer for it.

Creator Partnership Program: the application and its review are kept while you're in the program and for up to 2 years after a rejection or leaving. The financial history (earnings and payouts) is kept for the period required by tax law; if you delete your account, those records are kept without your name.

12.Your rights

You can request access, correction, a copy (portability), deletion, restriction or objection to the use of your data, and withdraw consents.

Almost everything can be done in Settings › Your data. The rest via the DPO's email.

You can also complain to the data protection authority: the ANPD in Brazil or your country's authority in Europe (in Italy, the Garante; in the UK, the ICO).

13.Security

We use encryption, two-step verification, role-based access and audit logs. No system is 100% secure: if an incident affects you, we will tell you as required by law.

To prevent abuse, we briefly record how many actions each account performs (posting, commenting, messaging, reporting and others), without the content. These records are deleted automatically within 2 days. We also apply security headers on the site and file-size limits.

14.Cookies and similar technologies

Essential: to sign in and keep the session. Always on.

Preferences: language and theme.

Usage analytics: only with your consent in the European Union and the United Kingdom.

On your device we also store: the encrypted chat key (in browser storage, deleted when you sign out), whether you dismissed some notices (such as enabling notifications) and the account for faster sign-in. None of this is used for advertising.

15.Cookies

We use few cookies, in two categories. On your first visit a notice lets you accept all, reject or customise; closing the notice counts as rejecting. Your choice is kept for 6 months and can be changed at any time through the "Cookies" link in the footer or in Settings.

Necessary (always on, because the site doesn't work without them): Supabase login session (while the session lasts, up to 400 days); lang, your chosen language (1 year); pais, the detected country suggested at sign-up (30 days); dv, a device identifier used to warn about new sign-ins (400 days); convite, a community invite opened before signing in (14 days); snt_consent, your cookie choice (6 months); and security cookies from Cloudflare Turnstile and Stripe when you use sign-in or payment.

Affiliates (optional, only with your consent): snt_ref, which keeps for 30 days the affiliate link you opened, so the commission goes to whoever referred the course if you buy.

We don't use analytics, advertising or third-party social media cookies. The site also stores on your device (local storage) notices you've dismissed and the last sign-in method used, only for its own operation.

16.Changes and contact

We will announce important changes in the app and by email.

Questions: contact@socialnetworktrader.com · DPO: Gabriel Bussolo, contact@socialnetworktrader.com.