Privacy Policy

This policy explains how PropExecutor (“we”, “us”) handles personal data on propexecutor.com, in the organization admin panel, and in the trading executor we host for a firm.

If you are a trader using a terminal branded by a prop firm, that firm - not us - decides what happens to your data and is your first point of contact. We process it on their instructions as part of running their platform.

• Account data: the email address used to sign in to the admin panel, your organization's name, slug and the role of each panel user.
• Purchase data: the email address that paid, the product and quantity bought, amount, currency, status and the payment identifiers we need to fulfil and reconcile an order. We never receive or store card numbers.
• Branding you upload: logo and favicon files, colours, terminal theme and login-screen copy.
• Operational data: trading accounts, trader records you create (name and email), rule sets, simulated trades and the rule-engine decisions attached to them.
• Consultation bookings: the name, email, company, phone, message, requested slot and timezone you enter on the consultation form.
• Technical data: IP address, browser and device information, and server logs kept for security and debugging.
• Analytics on this marketing site only: page views and, through session recording and heatmaps, how the page is used. The panels and the executor carry no analytics tags.

• To give you access to the Platform and to keep a session signed in.
• To take a payment, grant what it bought, and answer questions about it.
• To run the product you bought: provisioning accounts, evaluating rules, sending the notifications those produce.
• To reply to a consultation request and, if you ask, to follow up about it.
• To keep the Platform secure, detect abuse and diagnose faults.
• To understand how this marketing site is used so it can be made clearer.

We do not sell personal data, we do not share it with data brokers, and we do not use your operational data to train models.

Where the GDPR or a similar law applies, we rely on: performance of a contract (running the Platform you bought), legitimate interests (security, fault diagnosis, understanding site usage, replying to an enquiry), consent where it is asked for (analytics cookies where required), and legal obligation (tax and accounting records).

• Dodo Payments - merchant of record for purchases. Card details are collected by them, not by us.
• Google Analytics - aggregate traffic measurement on this marketing site.
• Microsoft Clarity - session recordings and heatmaps on this marketing site.
• Google Cloud Storage - hosting for branding assets (logos, favicons).
• Our email provider - delivery of sign-in codes, booking confirmations and service notices.
• Our hosting and infrastructure providers - running the application, the database and the market-data pipeline.

Each one receives only what it needs for that job. Some of them process data outside your country; where that happens we rely on the transfer mechanisms those providers offer, such as standard contractual clauses.

• Strictly necessary: the session and refresh-token cookies that keep you signed in to the admin panel and the executor. These are http-only and cannot be read by page scripts.
• Analytics: cookies set by Google Analytics and Microsoft Clarity on this marketing site. They are not set in the panels or the executor.

You can block or clear cookies in your browser. Blocking the strictly necessary ones will sign you out and keep you out.

Account, organization and operational data is kept while your organization exists and for as long afterwards as we need it to meet legal and accounting obligations. Purchase records are kept for the period tax law requires. Server logs are kept for a short operational window. Consultation bookings are kept while the enquiry is open and for a reasonable period after, so we can pick up the conversation.

When you ask us to delete an organization we remove its data on the schedule above, except for records we are required to keep.

Each organization's data is isolated at the database level: every tenant-scoped table carries its organization and the database enforces the boundary on every query, rather than relying on application code to remember. Cross-tenant access used by our own operator console runs through a separate, audited database role.

Traffic is encrypted in transit. Sign-in to the panel is by emailed one-time code or Google sign-in; we do not store panel passwords. Trading-account credentials exist so a terminal can be handed to a trader, and rotating one immediately revokes every live session for that account.

No system is perfectly secure. If a breach affects your personal data we will notify you and, where required, the relevant authority, without undue delay.

Depending on where you live you may have the right to access, correct, delete, export or restrict the processing of your personal data, to object to processing based on legitimate interests, and to withdraw consent where processing is based on it.

Write to info@propexecutor.com and we will answer within thirty days. If you are a trader on a firm's branded terminal, contact that firm first - they decide what happens to that data.

If you are in the EEA or the UK you also have the right to complain to your local data protection authority.

The Platform is sold to businesses and is not intended for anyone under 18. We do not knowingly collect data from children; if you believe we have, write to us and we will remove it.

We may update this policy. The date at the top of this page always shows the current version, and material changes will be announced in the admin panel or by email before they take effect.

Questions, requests or complaints: info@propexecutor.com.