Privacy Policy

This policy explains what personal data we process at AlexandraFX, what we use it for, whom we share it with and what you can do about it. It is written to be understood: if anything is unclear, write to us at patinomarysable@gmail.com.

Who processes your data

AlexandraFX is a trade name of Revelio LLC, a company incorporated in the state of Wyoming (United States) and registered under number 2023-001349274, which you can check in the public registry of the Secretary of State of Wyoming. Its registered address is 30 N Gould St Ste N, Sheridan, WY 82801, United States.

Revelio LLC is the data controller. You can contact us at patinomarysable@gmail.com.

What data we process and why

• Waiting list. Your email address and, if you arrive through a tagged link, the channel through which you arrived. They are used to notify you on the day we open enrolment and to know which channel works. Legal basis: your consent, which you give by submitting the form.
• Account and access. Name, email address and credentials, managed by our identity provider. They are used to create your account and let you sign in. Legal basis: the performance of the contract.
• Use of the training. Lessons viewed, progress, test attempts, results and certificates issued, with their serial number. They are used so that you can pick up where you left off, to mark the tests and to issue and verify certificates. Legal basis: the performance of the contract. We also record on which days you enter the student area, without recording which pages you open, for our internal usage statistics. Legal basis: our legitimate interest in knowing how the service is used. When you play a recording of a live session we record that you watched it and when, so that the trainer knows which recordings are watched and by whom. Legal basis: the same legitimate interest.
• Visits to the public pages. On the home page, the courses, the waiting list and the legal pages we count visits with Vercel Web Analytics: page opened, referring site, country, device type, operating system and browser, always in aggregate. No cookies, no storing of your IP address and no identifier lasting more than 24 hours, so it cannot be used to recognise you. It is not enabled in the student area. Legal basis: our legitimate interest in knowing how many people visit the website and where they come from.
• Advertising with the Meta pixel, only if you accept it. On the public pages, if you accept advertising cookies in the banner, the Meta pixel is loaded: it receives the page you open, your IP address, data about your browser and device, the identifiers in its cookies (_fbp and, if you arrive from an ad, _fbc) and two actions: having left your email on the waiting list and having subscribed, without the email or the amount. It is used to measure whether our advertising works and to show it to people with similar interests. Legal basis: your consent, which you can withdraw at any time from “Cookie settings” in the footer of every page. It is not enabled in the student area. Which cookies it sets and how long they last is explained in the cookie policy.
• Ideas and reports. The ideas you propose, signed with your nickname, and your votes. The problems you report to us, with the page from which you write, the browser you use and the screenshot if you attach one: only we see them, in order to resolve them. Legal basis: the performance of the contract.
• Your trading journal. The trades you record manually or import from the file exported by your broker: instrument, dates, size, prices and result. They are used for your own tracking and, if you decide to take part, to calculate the leaderboard. Legal basis: the performance of the contract. The file you upload is read and not retained: we store the trades, never the original document.
• Connection with cTrader, only if you enable it. If you connect your cTrader account, you authorise it on the cTrader website with a read-only permission: we can read your accounts and their history, never open or close trades. We store the identifier of each account you connect, whether it is live or demo, and the access keys cTrader gives us, encrypted. Every hour we read new closed trades and add them to your journal. Legal basis: the performance of the contract, at your request.
• Leaderboard, only if you sign up. A nickname chosen by you and the capital you declare. It is the only processing in which any of your data becomes visible to other students, and that is why it is never automatic: you have to request it. What others see is the nickname, the number of trades and the percentage return — never your name, your email, your capital or your result in money. You can leave whenever you wish, and when you do, your rows in leaderboards already closed are also deleted. Legal basis: your consent.
• Your subscription. The identifier of your subscription and of your customer record at Stripe, its current status, the identifier of the price you subscribed to, which also tells your plan (Esencial or Completo), and the dates: end of the paid period, first failed payment if any, and cancellation date if you cancel. They are used to know whether your access is open and to assist you when something goes wrong with the charge. Legal basis: the performance of the contract. We do not process your card details: you enter them on Stripe's payment page and they do not pass through our servers.
• Gifted access. If we give you access without payment, we store the plan, from when and until when it is valid, who granted it and why. We use it to open the platform for you and to cancel your paid subscription in time, if you had one. Legal basis: performance of the contract.
• Your waiver of the right of withdrawal. Before paying, you expressly agree that access begins immediately. We store the date and time of that acceptance and the version of the text you accepted — not the text as rewritten later, but the one you read — and we confirm it to you by email at that moment. It is the proof that the waiver existed, and for that reason it is not modified or deleted along with the rest: it remains recorded even if the confirmation email is never sent. Legal basis: the performance of the contract and our legitimate interest in being able to prove it.
• Emails we send you. Service notices and, where appropriate, confirmations — including the one for your waiver of the right of withdrawal. We do not send third-party advertising. In the notices we send to everyone (new recordings, new live sessions, campaigns) we measure whether the email arrives and whether it is opened, using an invisible image. We only look at the totals for each send, never at who opens what, to learn which notices are useful. Legal basis: our legitimate interest in improving what we send you. If your email program does not load images, nothing is measured.
• Push notifications. If you turn them on, we store the address your browser gives us for sending you alerts (a link to Google's, Apple's, Microsoft's or Mozilla's notification service, depending on the browser), two keys to encrypt them, and which alerts you want. We use them only to send you those alerts. The content travels encrypted: the browser's service delivers it but cannot read it. Legal basis: your consent, which you withdraw by turning them off.
• Technical data. Server logs, error reports and a reduced sample of performance measurements, generated when you use the platform. Legal basis: our legitimate interest in keeping the service running and protected from abuse.

We do not process special categories of data, we do not carry out profiling with legal effects and we do not take automated decisions about you.

Public verification of certificates

Each certificate carries a serial number with which anyone can check that it is authentic. The verification page shows only what is necessary for that check and is never indexable from your name or your email: the serial number is required, and only you and whoever you give it to have it.

Whom we share it with

We do not sell personal data. We share it with the providers that make the service work, each under a data processing agreement and with access limited to what it needs:

• Clerk — accounts, passwords and sessions.
• Supabase — database and files, served through short-lived signed links.
• Bunny.net — hosting and playback of the videos.
• Resend — sending of the service emails.
• Google, Apple, Microsoft and Mozilla — deliver push notifications to your browser, if you turn them on. They receive the alert encrypted and cannot read it.
• Vercel — running and delivering the website, and counting visits to the public pages.
• Sentry — error reports, so that we find out something has broken without waiting for you to tell us. It receives the internal identifier of your account and nothing else: not your name, not your email, not your IP address, not the content of what you send, and no recordings of your screen. That filter is not a configuration option we could forget: it is written in our code and checked by automated tests.

There are also three companies that do not work on our behalf: they decide themselves what they do with the data they receive and are answerable for it under their own policies. One receives data from our servers, and the other two are ones your browser or your account connects to:

• Stripe — Sold through Link, LLC and the other companies of the Stripe group —, which is the party that sells you the subscription and charges for it. It is not our data processor: as the seller, it processes your payment data as a controller in its own right, under its privacy policies, that of Link and that of Stripe. It receives the billing details you provide — name, country and address, when it asks for them — your card details and your IP address, together with the technical data of your browser and whatever it needs to calculate the tax of your country and prevent fraud. You give all of that directly on its payment page: your card details never pass through our servers and we do not see them. What we send it is your verified email address, the price you have chosen and, as a reference, the internal identifier of your account and that of your waiver of the right of withdrawal, so that we can recognise your purchase when it notifies us of it. Stripe processes data in the United States, with the safeguards described in its privacy policy. Link allows you to ask it to delete your data; bear in mind that doing so cancels the subscriptions it has sold you, including this one.
• cTrader, by Spotware Systems, only if you connect your account. You give the authorisation on its website, under its own terms and its privacy policy, and you can withdraw it from there or by disconnecting the account in your study area.
• Binance, which provides us with the live gold price. For the price to move on screen, your browser connects directly to its market data service while you have a page with the chart open — the home page or the study area. As with any connection, Binance receives your IP address and the technical data of your browser. We send it no data from your account: not your name, not your email, not your trades. Legal basis: our legitimate interest in showing the live price, which is part of the training.
• Meta (Meta Platforms Ireland Limited), only if you accept advertising cookies. Its pixel is loaded in your browser and sends it what is described above. It is not a processor working on our behalf: for this data Meta and we jointly decide what it is used for, and Meta also processes it under its own data policy. If you reject, nothing from Meta is loaded.

Some of these services are established outside the European Economic Area or process data on servers located outside it. In those cases the transfer relies on the European Commission's standard contractual clauses or on an equivalent adequacy framework. We may also disclose data to authorities when a law obliges us to.

How long we keep it

• Waiting list: until we open enrolment and notify you, or until you ask us to delete you. If you do not register when we open, we delete your address.
• Account and progress: while the account is active. When it is closed we delete or anonymise the data, except what we must keep by legal obligation.
• Certificates: we keep them for as long as the certificate must remain verifiable, because a certificate that cannot be checked is of no use.
• Trading journal: while the account is active. It is yours: you can delete trades one by one whenever you wish.
• Connection with cTrader: for as long as you keep it. When you disconnect an account we delete its access keys and stop reading it; trades already imported remain in your journal until you delete them.
• Closed leaderboards: kept as a historical record while you take part. If you leave the leaderboard, your rows are also deleted from past ones.
• Subscription: while it is active and, afterwards, for the period required by the tax and commercial regulations of United States. The invoices for your payments are issued and kept by Link, under its own retention periods.
• Waiver of the right of withdrawal: we keep it as proof for as long as the purchase it relates to may be disputed. We do not delete it when the account is closed: without it we could not prove that you accepted it, which is precisely what protects both you and us.
• Push notifications: the notification address, until you turn notifications off on that device, the browser revokes it, or you delete your account.

Your rights

You may ask us for access to your data, for its rectification or erasure, restrict or object to its processing, and receive it in a portable format. Where the processing is based on your consent, you may withdraw it at any time, without affecting what was done before. Write to patinomarysable@gmail.com: we respond within the legal time limit, and within one month at most.

If you believe we have not handled your request properly, you may lodge a complaint with the supervisory authority of your country of residence. If you reside in Spain, it is the Agencia Española de Protección de Datos (aepd.es). The fact that we are incorporated in United States does not take that right away from you: when we offer the service to people who are in the European Union, the General Data Protection Regulation applies to us all the same.

Security

Passwords are held by our identity provider and we never see them. Files are not public: they are served through signed links that expire within a few minutes. Access to the database is limited to the service itself.

Minors

The platform is intended for adults. We do not knowingly create accounts for minors; if we detect one, we close it and delete the data.

Changes to this policy

If what we do with your data changes, this page and its update date change. When the change is significant, we will notify you by email before it takes effect.

This is an English translation provided for convenience. In case of any discrepancy, the Spanish version prevails.