Privacy Policy

1. Data Controller & General Principle

The Data Controller for information collected directly through this website is XTFlow Indicators. For inquiries concerning data protection, personal data rectification, or deletion requests, our dedicated privacy desk can be reached at [email protected].

We process all personal data strictly in compliance with Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation - GDPR), the UK Data Protection Act, and applicable international privacy directives.

2. Data Collection & Processing via Merchant of Record (Whop.com)

When purchasing a subscription or software license, your transaction is processed by Whop, Inc. (Whop.com), acting as Merchant of Record. In connection with these transactions, the following categories of data are collected and shared with XTFlow for fulfillment:

• Account & Contact Identifiers: Name, email address, billing country, and subscription plan tier.
• Platform-Specific Licensing Data: TradingView usernames (for invite-only script binding), NinjaTrader Machine IDs, ATAS Hardware IDs, and Telegram handles (for community access authorization).
• Financial & Payment Data: XTFlow does not collect, receive, or store your credit card numbers, CVVs, or bank account details. All payment processing is conducted within Whop’s PCI-DSS Level 1 compliant infrastructure and verified payment processors (Stripe).

3. Cookies, Web Analytics & Google Consent Mode v2

Our website uses technical and analytical cookies to ensure stability and analyze aggregate visitor trends:

• Essential Technical Cookies: Necessary for the proper functioning of the site, caching security preferences, and storing your cookie consent decision.
• Google Analytics 4 (GA4): We utilize GA4 configured with Google Consent Mode v2 and IP Anonymization. Performance cookies are deployed only after you grant explicit consent via our cookie banner. If you choose "Essential Only", analytics storage remains disabled.

For detailed instructions on managing or withdrawing cookie permissions, refer to our dedicated Cookie Policy.

4. Purposes and Legal Bases for Data Processing

We process personal data solely on legitimate legal grounds recognized under Article 6 of the GDPR:

• Contract Performance (Art. 6(1)(b) GDPR): Enabling software activation, verifying hardware machine IDs, granting invite-only TradingView access, sending critical software release notices, and providing technical support.
• Legitimate Interests (Art. 6(1)(f) GDPR): Monitoring unauthorized concurrent logins, preventing piracy and code decompilation, maintaining network stability, and protecting against fraudulent chargebacks.
• Legal Obligations (Art. 6(1)(c) GDPR): Retaining transaction history and dispute records for tax compliance, accounting, and regulatory defense.

5. Third-Party Data Processors & Service Providers

XTFlow does not sell, lease, or monetize your personal data. Data is transferred strictly to technical infrastructure providers essential to service delivery:

• Whop, Inc. (USA): Merchant of Record, subscription billing, and license access management.
• Google LLC (USA): Aggregate traffic analytics via Google Analytics 4 (subject to user consent).
• Telegram FZ-LLC: Platform provider for the private community channel (only if you choose to join via your Telegram handle).

6. Data Retention, Storage & Security Safeguards

We implement industry-standard administrative, technical, and physical safeguards—including SSL/TLS 256-bit encryption for all browser transmissions, access control restrictions, and hardware authorization databases.

Technical licensing data is retained for the duration of your active subscription and up to the statutory period required to resolve billing inquiries, enforce our Terms of Service, or fulfill legal obligations.

7. Your Data Protection Rights Under GDPR

Under Articles 15 to 22 of the GDPR and equivalent international privacy legislations, you are entitled to:

• Right of Access: Request confirmation of whether your data is being processed and obtain a copy.
• Right to Rectification: Request correction of inaccurate or incomplete licensing identifiers.
• Right to Erasure ("Right to be Forgotten"): Request deletion of your personal information, subject to statutory retention requirements.
• Right to Restrict or Object: Object to processing based on legitimate interests or request restriction of processing.
• Right to Data Portability: Receive your data in a structured, commonly used format.

To exercise any of these rights, submit your request to [email protected]. We respond to all verified inquiries within 30 days.