Privacy Policy

Kolatrade Inc. ("Kolatrade," "we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, store, share, and safeguard your information when you use the Kolatrade browser extension and our associated web application at https://kolatrade.com (collectively, the "Service").

Kolatrade operates as an automated "tilt firewall" designed exclusively to enforce trader risk management controls and protect futures traders from exceeding pre-configured loss limits on supported trading broker platforms (currently Tradovate and NinjaTrader). We process user data strictly for the single purpose of providing, operating, maintaining, and securing the Kolatrade risk management service. We do not use data for advertising, analytics for sale, or any purpose unrelated to the Service.

By using the Service, you acknowledge that you have read and understood this Privacy Policy. Your use of the Service is also governed by our Terms of Service.

We collect only the minimum data strictly necessary to provide the Service:

• Kolatrade Account Credentials (Email & Password): When you register or log in to Kolatrade via the browser extension or web application, we collect your email address and the password you create specifically for your Kolatrade account. This is transmitted via HTTPS and used exclusively for authenticating you into the Kolatrade service.
  The Kolatrade browser extension does NOT intercept, capture, read, monitor, or transmit any password you type on your broker's website (Tradovate or NinjaTrader). The only password Kolatrade collects is the password you create for your Kolatrade account.
• Broker Session Tokens: We collect temporary authentication and session tokens from your broker platform (Tradovate / NinjaTrader) that are available in the browser environment when you are logged into your broker. These are used exclusively to allow our backend to execute automated position liquidation ("flatten-all") orders when your pre-configured risk limits are breached.
• Real-Time Trading Metrics: We monitor real-time PnL, account balance metrics, open position counts, and order activity on supported broker platforms, strictly to evaluate your configured risk rules. This data is processed ephemerally and is not retained beyond the active session.
• Extension Host Permissions (Browser Access): The browser extension requests permissions restricted exclusively to supported broker domains (*://trader.tradovate.com/*, *://web.ninjatrader.com/*, and *://kolatrade.com/*). Content scripts run strictly to identify active trading tabs and inject the risk monitoring script. Kolatrade does NOT collect, read, track, store, or transmit any browsing history, web content, URLs, keystrokes, or user data on any non-broker websites.
• Technical & Diagnostic Logs: We collect minimal operational metrics (e.g., connection status, extension version, API response latency, error codes) to maintain software stability, troubleshoot errors, and detect bypass attempts. These logs do not contain trading financial data.
• Account Information: Name (if provided), email address, subscription status, and configured risk rule settings.
• Payment Information: We do not directly store your payment card details. Payments are processed by our third-party payment processor. We may receive and retain transaction IDs, subscription status, and billing history.

For users located in the European Economic Area (EEA), United Kingdom, or other jurisdictions where a legal basis for processing is required, Kolatrade processes your personal data under the following lawful bases under Article 6 of the GDPR:

• Performance of a Contract (Art. 6(1)(b)): Processing your account credentials and broker session tokens is necessary to provide the Service you contracted for.
• Legitimate Interests (Art. 6(1)(f)): Processing diagnostic logs and monitoring for security and bypass prevention, where our legitimate interest in operating and securing the Service does not override your rights.
• Compliance with Legal Obligations (Art. 6(1)(c)): Retaining records as required by applicable law.
• Consent (Art. 6(1)(a)): Where we request consent for any specific processing not covered above, you may withdraw consent at any time by contacting us.

We use your data solely for the following purposes:

• User Authentication: Email and password are processed to verify your identity and grant authorized access to the Service.
• Risk Rule Enforcement: Real-time trading metrics are evaluated against your pre-configured daily loss or trailing drawdown limits.
• Automated Order Execution: Broker session tokens are used exclusively to submit flatten/liquidation orders when risk limits are breached.
• Security & Bypass Prevention: Technical logs are processed to detect connection failures and prevent unauthorized bypass of active lockout timers.
• Service Communications: Your email address is used to send account-related notices (e.g., subscription renewal, policy updates, security alerts). We do not send marketing emails without your consent.
• Legal Compliance: Data may be retained or disclosed as required by applicable law.

We do not use your data for advertising, behavioral profiling, sale to third parties, creditworthiness evaluation, or any purpose unrelated to providing the Service.

• Password Security: Account passwords are transmitted over TLS 1.3 / HTTPS encryption and stored using bcrypt password hashing with a unique salt. We never store plaintext passwords.
• Broker Passwords: We do NOT request, collect, or store your broker account passwords.
• Broker Session Tokens: Processed temporarily in-memory during active service sessions. Automatically purged upon token expiration or user logout. Not persisted to disk in plaintext.
• Diagnostic Logs: Retained for up to 30 days for system maintenance and then automatically deleted, unless a longer retention period is required by applicable law or for ongoing security incident investigation.
• Account Data: Retained while your account is active. Upon account deletion, data is purged from active databases within 30 days, subject to legal hold obligations described below.
• Inactive Accounts: Accounts with no activity for 24 consecutive months may be deleted. We will attempt to provide 30 days' advance email notice.
• Browser Local Storage: The extension uses chrome.storage.local strictly to retain your authenticated session state and display preferences locally on your device.

We maintain strict confidentiality over user data. We share data only as follows:

• No Sale: We do NOT sell, rent, trade, or otherwise transfer your personal data to any third party for commercial purposes.
• Broker API Communication: Broker session tokens are transmitted directly to your broker's official API solely to execute authorized risk enforcement actions.
• Infrastructure Sub-Processors: We use the following vetted cloud service providers to operate the Service, each bound by applicable data processing agreements and confidentiality obligations:
  • Render — backend hosting and compute
  • Vercel — frontend hosting and CDN
  • Supabase — database and authentication
  • Payment Processor — subscription billing (payment card data not accessible to Kolatrade)

  We will update this list if sub-processors change. No additional sub-processors are used beyond those listed above.

• Legal Disclosure: We may disclose your data if required by law, court order, subpoena, regulatory demand, or to protect the rights, property, or safety of Kolatrade, our users, or the public.
• Business Transfer: In the event of a merger, acquisition, or sale of all or substantially all of Kolatrade's assets, your data may be transferred to the successor entity, subject to the same privacy protections. We will notify you via email or prominent website notice before your data is transferred and becomes subject to a different privacy policy.

Subject to applicable law, you have the following rights regarding your personal data. To exercise any of these rights, email us at support@kolatrade.com.

• Access: Request a copy of the personal data we hold about you.
• Correction: Request correction of inaccurate or incomplete data. You can also update most information directly via your account dashboard.
• Erasure (Right to be Forgotten): Request deletion of your account and personal data. Upon a valid request, we will permanently erase your personal data from our active databases within 30 days, except where retention is required by applicable law or necessary for the establishment, exercise, or defense of legal claims ("legal hold"). Backups may retain data for up to an additional 90 days before automated deletion.
• Portability: Request your personal data in a structured, commonly used, machine-readable format (where technically feasible).
• Restriction: Request that we restrict processing of your data in certain circumstances (e.g., while the accuracy of data is contested).
• Objection: Object to processing based on legitimate interests where your particular situation warrants it.
• Withdrawal of Consent: Where processing is based on consent, withdraw that consent at any time without affecting the lawfulness of prior processing.

We will respond to verified rights requests within 30 days (or as required by applicable law). We may need to verify your identity before processing your request.

If you are located in the European Economic Area (EEA) or the United Kingdom, the following additional terms apply:

• Data Controller: Kolatrade Inc. is the data controller for personal data collected through the Service. Contact: support@kolatrade.com.
• International Data Transfers: Our infrastructure providers (Render, Vercel, Supabase) may process data in the United States or other countries outside the EEA/UK. Where required, we rely on Standard Contractual Clauses (SCCs) or other approved transfer mechanisms to ensure appropriate safeguards.
• Supervisory Authority: You have the right to lodge a complaint with your local data protection supervisory authority. A list of EU supervisory authorities is available at edpb.europa.eu.
• Retention: We retain personal data only for as long as necessary for the purposes outlined in this Policy, or as required by applicable law.

If you are a California resident, the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA) grant you additional rights:

• Categories of Personal Information Collected: Identifiers (email address); commercial information (subscription data); internet or other network activity (extension diagnostic logs); financial information (trading metrics processed in-memory).
• Do Not Sell or Share: We do not sell or share personal information as defined under CCPA/CPRA. You may submit a request confirming this by emailing support@kolatrade.com.
• Right to Know: You may request disclosure of the categories and specific pieces of personal information we have collected about you, and the purposes for collection.
• Right to Delete: You may request deletion of personal information we have collected, subject to certain exceptions under CCPA.
• Right to Correct: You may request correction of inaccurate personal information.
• Right to Limit Sensitive Personal Information: To the extent account passwords or trading data qualify as "sensitive personal information" under CPRA, we use such information only as necessary to provide the Service.
• Non-Discrimination: We will not discriminate against you for exercising your CCPA/CPRA rights.

To exercise California rights, contact us at support@kolatrade.com with "California Privacy Request" in the subject line. We will respond within 45 days.

In the event of a data breach that affects your personal information, Kolatrade will:

• Notify you via email to your registered Kolatrade account email address without undue delay, and in any event within the timeframe required by applicable law (e.g., within 72 hours for GDPR supervisory authority notification; within applicable state law deadlines for consumer notification);
• Provide information about the nature of the breach, the types of data affected, and the steps we are taking to remediate it;
• Cooperate with applicable regulatory authorities as required by law.

You are responsible for keeping your registered email address current and accurate so that breach notifications can reach you.

In full compliance with the Chrome Web Store Developer Program Policies:

• Limited Use Statement: Kolatrade's use and transfer of information received from Chrome APIs to any other app adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements.
• User data is not used or transferred for purposes unrelated to Kolatrade's single purpose of trader risk management enforcement.
• User data is not used or transferred to determine creditworthiness or for lending purposes.
• User data is never sold to third parties or data brokers.
• The extension does not inject advertisements or track users across websites.

The Kolatrade web application may use browser cookies or local storage for the following limited purposes:

• Session Authentication: To keep you logged into your Kolatrade account across page loads (strictly necessary).
• User Preferences: To remember display settings you have configured.

We do not use tracking cookies, advertising cookies, or third-party analytics cookies. The browser extension uses chrome.storage.local for authenticated session state and preferences. This data is stored locally on your device only and is not transmitted to Kolatrade's servers except as part of normal API authentication.

Kolatrade is intended exclusively for adult traders who are at least 18 years of age. We do not knowingly collect or solicit personal information from individuals under the age of 18. If we become aware that we have collected personal information from a minor under 18, we will delete that information promptly. If you believe we may have inadvertently collected information from a minor, please contact us immediately at support@kolatrade.com.

We may update this Privacy Policy periodically to reflect changes in the Service, applicable law, or Chrome Web Store policies. For material changes — including any new purposes for data processing, new categories of data collected, or new data sharing arrangements — we will provide at least 30 days' advance notice by email to your registered account email address and by posting the updated Policy at https://kolatrade.com/privacy with a revised "Last Updated" date.

For non-material changes, posting the updated Policy with a revised date constitutes sufficient notice. Your continued use of the Service after the effective date of any modification constitutes your acceptance of the updated Policy. If you do not agree to the updated Policy, you must discontinue use of the Service.

Where required by applicable law (e.g., GDPR), we will seek your affirmative consent before processing your data for any new purpose not covered by this Policy.