1. Summary
- We collect the data you give us when you create and use an account: your email address, a display name, an optional profile picture, your sign-in method, your onboarding answers and the settings, layouts, watchlists and alerts you save in the Terminal.
- We collect technical data needed to run and secure the Services: IP address, approximate country derived from it, browser and device information, request logs, session identifiers and API usage counts.
- Payments are processed by Stripe. We never see or store your full card number, CVC or bank credentials. We keep the Stripe customer and subscription identifiers, plan, billing status and invoice references needed to grant access.
- Transactional email (verification codes, password resets, billing notices, alerts you configure) is delivered by Resend.
- We do not sell personal data, we do not share it for cross-context behavioural advertising, and the Website does not use advertising or analytics cookies.
- In-app notifications are deleted automatically after 7 days. Sessions expire, and other data is kept only as long as described in section 9.
- You can access, correct, export or delete your data and object to certain uses. Write to privacy@ordermap.si; section 11 explains how.
2. Who is responsible for your data
OrderMap is the controller of the personal data described in this policy, meaning we decide why and how it is processed. Where this policy says that a service provider processes data "on our behalf", that provider acts as our processor (or service provider, in the terminology of US state privacy laws) and may use the data only to provide its service to us, under a written agreement.
Contact for all privacy matters, including requests to exercise your rights: privacy@ordermap.si. Contact for legal notices: legal@ordermap.si.
Stripe acts as an independent controller for some data it collects during checkout (for example to meet its own anti-fraud, anti-money-laundering and financial reporting obligations). Google acts as an independent controller for the data it handles when you choose "Sign in with Google". Their own privacy policies govern that processing.
3. Scope
This policy applies to personal data processed through the Services and through our communications with you, including email and the support channels we operate.
It does not apply to third-party websites, platforms or services that you reach through links in the Services, including our profiles on X, Instagram and TikTok, to your brokerage or trading platform, or to services you connect to the API yourself. When you interact with our social media profiles, the platform operator processes your data under its own policy, and we see only what the platform makes visible to account holders (for example your public handle and any message you send us).
The Services are intended for business and individual users who are at least 18 years old. Section 14 describes our approach to children's data.
4. The personal data we collect
We collect personal data in three ways: you provide it directly, it is generated automatically when you use the Services, and a limited amount comes from third parties you choose to use (Google sign-in, Stripe). Each category is described below.
| Category | What exactly we collect |
|---|---|
| Account identity | Email address (required, used as your sign-in identifier and contact address), display name, account identifier, account creation date and account status (for example active, suspended or closed). Your email address is read-only in account settings once verified, to protect against account takeover; changing it requires contacting us. |
| Profile picture | An image you choose to upload, which we crop to a circle and store in a Google Cloud Storage bucket that is configured for public read. Anyone who has the image URL can view it, so do not upload an image you want to keep private. When you replace or remove your picture, the previous image file is deleted. |
| Sign-in credentials | If you use a password: a salted Argon2id hash of the password (never the password itself). If you use a passkey: the passkey's public key, credential identifier, sign-in counter and device-type flags provided by your authenticator; the private key never leaves your device. If you use Google: your Google account identifier, verified email address, name and profile picture URL as returned by Google. |
| Verification and recovery | One-time email verification codes, password reset tokens and passkey-removal codes. We store only a hash of each token, together with its expiry. Reset links expire after 30 minutes and six-digit codes after 10 minutes, and each can be used once. |
| Sessions | Session identifiers, the short-lived access credential and the rotating refresh credential that keep you signed in, the time they were issued and last used, and the IP address and user agent at sign-in. Access credentials expire after 15 minutes; refresh credentials expire 30 days after issuance and rotate on use. |
| Onboarding answers | The asset classes you trade (for example options, futures or stocks), the features you are interested in, the dashboard proposal you accepted, your chosen colour palette and the market sessions you follow (including whether you trade overnight). We use these only to configure your Terminal. |
| Terminal content and preferences | Workspaces and widget layouts, watchlists, saved symbols, alert rules and thresholds, notification preferences, theme and display settings, keyboard and chart preferences, and replay positions. This content is stored so the Terminal looks the same on every device you sign in from. |
| Notifications | The in-app notifications we generate for you (for example alert triggers, billing notices and product messages), whether you have read them, and your delivery preferences. Inbox notifications are deleted automatically after 7 days and at most the 200 most recent are kept per account. |
| Subscription and billing | Your plan (for example Terminal Pro, Terminal Elite, the Overnight add-on, API Developer or API Pro), trial dates, subscription status, current period and paid-through dates, the Stripe customer and subscription identifiers, invoice and payment identifiers, amounts, currency, tax location as calculated by Stripe, refund and dispute events, and the billing email. Stripe collects your card or payment method details directly; we receive only the brand, last four digits and expiry month and year to display them back to you. |
| Developer API | API project names, API keys (we store a one-way hash of each key and its first characters so you can recognise it; the full key is shown only once, at creation), key scopes and revocation status, request counts, quota consumption, export reservations, rate-limit events and the timestamps of these events. |
| Usage and diagnostic data | Requests to our servers, including the URL path, method, response status, response size, timing, referrer, user agent and the IP address the request came from. When traffic passes through Cloudflare we also receive the country Cloudflare derives from the IP address and a request identifier. We use aggregate counters of data delivered to clients to operate capacity; these counters are not tied to an individual. |
| Security and audit records | Records of security-relevant actions such as sign-ins, failed sign-in attempts, password and passkey changes, key creation and revocation, plan changes and administrative actions on an account, with the time, account and originating IP address. |
| Communications | Messages you send us by email or through support channels, and the delivery status of the emails we send you (sent, delivered, bounced, complained), which Resend reports back to us. |
We do not intentionally collect special categories of personal data (such as health, biometric, racial or ethnic origin, political opinions, religious beliefs or sexual orientation), government identification numbers, or precise geolocation. Passkeys may be unlocked on your device with a fingerprint or face scan, but that biometric check happens entirely on your device and we never receive biometric data.
Market data shown in the Services (prices, quotes, trades, order book depth, options flow, gamma exposure and similar figures) comes from exchanges and data vendors and is not personal data. The trades highlighted on the Website under "Trades spotted" are hypothetical examples generated from market data after the close; they are not anyone's real trades.
5. Website visits, cookies and similar technologies
The marketing Website at ordermap.si and orderflow.sh does not set advertising cookies, does not load third-party analytics or tracking scripts, does not use tracking pixels, and does not fingerprint your browser. It is served by Netlify, which records standard server logs (IP address, requested URL, user agent, time and response status) to deliver and protect the site.
The Terminal and the API use only cookies and browser storage that are strictly necessary to provide the service you asked for:
| Name or purpose | Details |
|---|---|
| Access cookie | Keeps you signed in for the next 15 minutes. HttpOnly, Secure, SameSite. Expires after 15 minutes. |
| Refresh cookie | Obtains a new access cookie without asking you to sign in again. HttpOnly, Secure, SameSite. Expires 30 days after issuance and rotates on use; replaying an old refresh credential revokes the session. |
| Sign-in flow cookies | Bind a passkey or Google sign-in attempt to your browser so it cannot be completed from somewhere else. Expire within minutes (Google sign-in challenges after five minutes) and are single-use. |
| Local storage | Remembers interface state on your device, such as the last open workspace, panel sizes and theme, so the Terminal loads quickly. It stays in your browser and you can clear it at any time. |
Because these technologies are strictly necessary, they do not require consent under the ePrivacy rules that apply in the European Economic Area and the United Kingdom. If you block them, you will not be able to sign in. We do not respond to "Do Not Track" signals because we do not track you across sites; we do honour Global Privacy Control signals as a request to opt out of any sale or sharing, which we do not do in any case.
6. How and why we use personal data
We use personal data only for the purposes below. For visitors and users in the EEA, the United Kingdom and Switzerland, each purpose lists the legal basis we rely on under the GDPR and UK GDPR.
| Purpose | What we do and the legal basis |
|---|---|
| Create and run your account | Register you, verify your email address, sign you in with a password, passkey or Google, keep you signed in, let you manage your profile, and show your saved layouts, watchlists, alerts and settings. Legal basis: performance of our contract with you. |
| Deliver market data and features | Stream market data to the Terminal and the API, evaluate the alerts you configure, deliver notifications, run replay and historical queries, and apply the entitlements of your plan. Legal basis: performance of contract. |
| Billing and trials | Start and track trials, take payment through Stripe, issue invoices and receipts, apply upgrades, downgrades and cancellations, handle refunds and disputes, and calculate taxes. Legal basis: performance of contract and compliance with legal obligations (tax and accounting). |
| Developer API access | Issue and authenticate API keys, enforce plan quotas, history limits and rate limits, reserve and settle data exports, and show you your usage. Legal basis: performance of contract. |
| Transactional communication | Send verification codes, password reset links, security alerts (for example a new passkey or a removed sign-in method), billing notices, alert emails you configure and important changes to the Services or these policies. Legal basis: performance of contract and our legitimate interest in keeping accounts secure. |
| Security, fraud and abuse prevention | Detect and block credential stuffing, brute-force attempts, scraping, key sharing, redistribution of market data and other abuse; throttle and rate-limit requests; investigate incidents; keep audit records. Legal basis: legitimate interests (protecting users, the Services and the exchanges whose data we license) and, where applicable, legal obligation. |
| Exchange and vendor compliance | Exchanges and market data vendors require us to know who receives their data, to classify subscribers (for example professional or non-professional), to count users and devices and to report usage. We use account and usage data to meet those obligations. Legal basis: legal obligation and legitimate interests (keeping our data licenses). |
| Operate, maintain and improve the Services | Monitor performance and capacity, debug errors, measure which features are used in aggregate and plan improvements. Legal basis: legitimate interests. We use aggregated or de-identified data where we can. |
| Support | Answer your questions and requests and keep a record of them. Legal basis: performance of contract and legitimate interests. |
| Product news | Occasionally tell existing customers about new features of the Services. Legal basis: legitimate interests or, where the law requires it, your consent. Every such email has an unsubscribe link, and opting out does not affect transactional email. |
| Legal compliance and enforcement | Comply with applicable law, respond to lawful requests from public authorities, enforce our Terms of Service and establish, exercise or defend legal claims. Legal basis: legal obligation and legitimate interests. |
Where we rely on legitimate interests, we have weighed those interests against your rights and expectations, and you can object as described in section 11. Where we rely on consent, you can withdraw it at any time without affecting processing that happened before.
We do not use personal data to make decisions that produce legal or similarly significant effects about you solely by automated means. Automated rate limits and abuse checks can temporarily block requests; if you believe a block is wrong, contact us and a person will review it.
We do not use the content of your account (your layouts, watchlists, alerts or API requests) to train machine learning models, and we do not provide it to third parties for that purpose.
8. International transfers
Our infrastructure and most of our service providers are located in the United States. If you use the Services from outside the United States, your personal data will be transferred to, stored in and processed in the United States and other countries where our providers operate, which may not have the same data protection laws as your country.
When we transfer personal data from the EEA, the United Kingdom or Switzerland, we rely on an adequacy decision where one exists (including the EU-US Data Privacy Framework, the UK Extension and the Swiss-US framework for providers certified under them) or on the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum, together with additional safeguards where appropriate. You can request a copy of the relevant safeguards by writing to us.
9. How long we keep personal data
We keep personal data only for as long as we need it for the purposes in section 6, and then delete or irreversibly anonymise it. The specific periods are:
| Data | Retention |
|---|---|
| In-app notifications | 7 days from creation, deleted hourly by an automatic job; at most the 200 most recent per account. |
| Access and refresh credentials | 15 minutes (access) and 30 days from issuance (refresh), or earlier if you sign out, revoke the session or change your password. |
| Verification codes and reset tokens | 10 minutes (codes) and 30 minutes (password reset links), single use. |
| Account, profile and Terminal content | For as long as your account is open. When you close your account, deleted within 30 days, except as noted in this table. |
| Profile picture | Until you replace or remove it, or close your account; the previous file is deleted when replaced. |
| API keys | Until you revoke them or close your account. Revoked key records (hash and prefix only) are kept for up to 12 months for security investigation. |
| Billing records and invoices | For the period required by tax and accounting law, generally up to 10 years after the transaction. Refund and dispute events are retained as part of the billing record. |
| Security and audit records | Up to 24 months, unless needed longer to investigate or defend against a specific incident or claim. |
| Server and request logs | Up to 90 days, then deleted or aggregated. |
| Support communications | Up to 3 years after the conversation ends. |
| Backups | Encrypted backups are overwritten on a rolling schedule of up to 35 days; deleted data disappears from backups when the backup that contains it expires. |
We may keep data longer when the law requires it, when it is needed to establish, exercise or defend legal claims, or when you ask us to preserve it. Aggregated statistics that cannot identify you may be kept indefinitely.
10. How we protect personal data
We use technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure and access, including:
- encryption in transit with TLS for every connection to the Services, and encryption at rest by our hosting and database providers;
- passwords stored only as salted Argon2id hashes, API keys and one-time tokens stored only as one-way hashes, and support for phishing-resistant passkeys;
- short-lived access credentials, rotating refresh credentials with replay detection, HttpOnly and Secure cookies, origin checks and throttling on sign-in, reset and verification endpoints;
- separate service roles with least-privilege credentials, private networking between internal services, and service tokens for internal calls;
- rate limiting, abuse detection and blocking at the edge and in the application;
- access to production data restricted to personnel who need it, with administrative actions recorded in audit logs;
- dependency updates, code review and automated testing before changes are deployed.
No method of transmission or storage is completely secure. If we become aware of a breach of security affecting your personal data, we will notify you and the relevant authorities where and as required by law. You are responsible for keeping your password, passkeys, devices and API keys secure; tell us immediately at the address in section 2 if you suspect unauthorised access.
11. Your rights and choices
Depending on where you live, you may have some or all of the following rights over your personal data:
- Access: confirm whether we process your data and receive a copy of it.
- Correction: correct inaccurate or incomplete data. You can update your display name, profile picture, sign-in methods, notification preferences and Terminal settings yourself in the Terminal.
- Deletion: ask us to delete your data, including by closing your account, subject to the retention exceptions in section 9.
- Portability: receive the data you provided to us in a structured, commonly used, machine-readable format, and have it transmitted to another controller where technically feasible.
- Objection: object to processing based on legitimate interests, and object at any time to direct marketing.
- Restriction: ask us to limit processing while a request or dispute is resolved.
- Withdraw consent: where processing is based on consent, withdraw it at any time.
- Opt out of sale, sharing and targeted advertising: we do not sell or share personal data or use it for targeted advertising, so there is nothing to opt out of, but you may still send us the request.
- Non-discrimination: we will not deny you service, charge different prices or provide a different quality of service because you exercised a privacy right.
To exercise a right, email privacy@ordermap.si from the email address on your account, or tell us which account the request concerns. We will verify your identity before acting, normally by confirming control of the account email address, and we may ask for more information where a request concerns sensitive data or comes from someone other than the account holder. An authorised agent may make a request on your behalf with your signed permission, and we may still ask you to verify your identity directly.
We respond within one month (GDPR and UK GDPR) or 45 days (US state laws), and we will tell you if we need more time as the law permits. If we decline a request, we will explain why, and where the law provides it you can appeal our decision by replying to our response; we will answer an appeal within the period the law requires.
If you are in the EEA, the United Kingdom or Switzerland, you also have the right to lodge a complaint with your local data protection authority. We would appreciate the chance to address your concern first.
You can unsubscribe from product news with the link in any such email. You cannot opt out of transactional and security emails while your account is open, because they are needed to provide and protect the Services.
12. Additional information for US residents
California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon and other US states give residents specific rights. In the preceding 12 months we have collected the following categories of personal information as defined by the California Consumer Privacy Act, for the business purposes described in section 6, from the sources described in section 4: identifiers (email address, account identifier, IP address); customer records (name, billing information); commercial information (plans purchased and billing history); internet or other electronic network activity information (request logs and usage of the Services); approximate geolocation derived from IP address; and inferences limited to configuring your Terminal from your onboarding answers.
We disclose these categories for business purposes to the service providers listed in section 7. We have not sold or shared personal information, and we do not knowingly sell or share the personal information of consumers under 16. We do not collect or use sensitive personal information to infer characteristics about you; the account credentials we process are used only to sign you in and secure your account.
13. Data you send through the API
When you use the API, we process your API key, the requests you make and their metadata to authenticate you, apply your plan's quotas and history limits, prevent abuse and bill you. We do not inspect or retain the content of your own systems. If you build an application on the API that processes personal data of your own users, you are the controller of that data and are responsible for your own privacy notices and compliance; the API returns market data, not personal data about third parties.
If you connect an AI assistant or agent to the OrderMap MCP server, the assistant's provider processes your prompts and the data the MCP server returns under that provider's own terms. We receive only the MCP requests authenticated with your API key.
14. Children
The Services are not directed to children and may only be used by people who are at least 18 years old. We do not knowingly collect personal data from anyone under 18. If you believe a minor has provided us with personal data, contact privacy@ordermap.si and we will delete it and close the account.
15. Changes to this policy
We may update this policy when the Services, our providers or the law change. We will post the updated policy on this page with a new effective date. If a change materially affects how we use personal data you have already given us, we will notify you by email or in the Terminal before the change takes effect and, where the law requires, ask for your consent.
16. Contact
Questions, requests and complaints about this policy or your personal data: privacy@ordermap.si. Legal notices: legal@ordermap.si. We aim to acknowledge every privacy request within five business days.