Privacy Policy

The data controller is GhostPips. Contact us about privacy at Ghostpipsacademy@gmail.com.

• Account details: email address, display name, password (stored only in hashed form by our authentication provider) and sign-in records.
• Trading records: trades, prices, P&L, fees, sessions, setups, tags, emotions, notes, trading accounts (name, broker, platform, account number if you enter it), trading plans, checklists, goals and journal entries.
• MT5 imports: the report file you upload and the rows parsed from it, including broker, account number, currency and deal history.
• Screenshots: chart images you upload, and any annotations and reviews created from them.
• Ghost AI data: your Coach conversations, AI reviews and reports, and AI Memory observations about your trading behaviour (which you can view, correct, delete or switch off).
• Subscription data: plan, subscription status, renewal dates and Stripe customer and subscription IDs. Card details are handled by Stripe, not us.
• Usage data: monthly counts of AI features used, to apply plan allowances.
• Support messages: your name, email and message when you contact us.

• To provide GhostPips (account, journal, analytics, imports, Ghost AI): performance of our contract with you.
• To take payments and manage subscriptions: contract, and legal obligation for tax and accounting records.
• To keep the service secure, prevent abuse and enforce allowances: our legitimate interests.
• To answer support requests: legitimate interests (or contract, where it concerns your account).
• AI Memory personalisation: contract; you can switch it off at any time in Ghost AI Memory.

We do not sell your personal data and do not use it for advertising.

When you use the Coach, a chart review, annotations or a report, we send the relevant data to our AI provider to produce a response: your message, a summary of your journal statistics, linked trade details, active plan rules, saved memory observations (Pro, if enabled) and any screenshots you attach, shared through short-lived private links. Ghost AI does not act on its own; it only runs when you ask it to.

AI requests are sent through the Lovable AI Gateway to the model provider OpenAI. Requests are made with provider-side response storage turned off. [confirm the AI provider's data retention and model-training terms — to be added]

• Lovable (Lovable Cloud): app hosting, database, authentication and private file storage, and the AI gateway.
• OpenAI: AI model provider for Ghost AI features.
• Stripe: payment processing, subscriptions, tax calculation and the customer billing portal.
• Cloudflare: network delivery for the hosted application.

These providers act on our instructions under data processing terms. We may also disclose data where required by law.

Some providers may process data outside the UK, including in the United States. Where they do, we rely on safeguards recognised under UK law, such as the UK Extension to the EU-US Data Privacy Framework or the International Data Transfer Addendum to standard contractual clauses. [confirm each provider's transfer mechanism and data locations — to be added]

We keep your account and journal data for as long as your account is open, so your history is available if you cancel Pro or return later. When you ask us to delete your account, we delete your account data, trades, screenshots and AI history, except records we must keep by law (such as payment and tax records, generally kept for 6 years). Support messages are kept for as long as needed to resolve your request. [confirm backup deletion timescales — to be added]

Data is encrypted in transit. Every database record is locked to its owner so users cannot see each other's data. Screenshots are stored in a private bucket and shown only through short-lived links. Server-side keys are never exposed in the browser. No system is perfectly secure, and we will notify you and the ICO of a serious breach where the law requires.

You have the right to access, correct, delete, restrict or object to processing of your data, and to receive a copy in a portable format. You can also withdraw consent where we rely on it. Email Ghostpipsacademy@gmail.com or use the contact form. We will reply within one month.

Send a deletion request from the email address on your account. If you have Pro, cancel it first in Settings → Billing so you are not charged again. You can delete individual trades, screenshots and AI Memory observations yourself at any time.

GhostPips uses only strictly necessary browser storage: your sign-in session and your display preferences (such as theme colours) are saved in your browser's local storage. Stripe sets its own cookies during checkout for fraud prevention. We do not use advertising or tracking cookies. [confirm whether hosting analytics are enabled — to be added]

Please contact us first so we can try to help. You also have the right to complain to the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint, telephone 0303 123 1113.

GhostPips
Email: Ghostpipsacademy@gmail.com