Who is responsible for your data
Nathan Hilliar is the data controller for personal data processed through TradeMirror and decides how and why that data is used. Paddle.com acts as Merchant of Record for purchases and is an independent controller of the payment data it collects at checkout.
Data collected
- Account identity data: email address and authentication identifiers.
- Trading account metadata: label, platform, account type, base currency, connection status.
- Raw platform payloads: the immutable records received from your connected platforms.
- Normalised trade events: entries, stop and target modifications, partial closes, exits, with timestamps and prices.
- Derived analytics: R multiples, realised and hypothetical results, behavioural pattern tags.
- Your self-defined trading rules and any context you add to a finding.
Behavioural profiling
TradeMirror analyses trading-event data to build a behavioural profile of how you manage positions. Patterns analysed include stop modification, early exits, break-even timing, re-entry timing, risk changes after wins or losses, and intra-session risk changes.
Findings are produced by deterministic calculations over your recorded events. Where AI is used, it summarises and explains those calculations; it does not produce the financial figures. Behavioural interpretations are hypotheses about recorded actions, not psychological diagnoses, and trading-event data alone cannot establish your emotional state.
Retention, access and control
- Retention: raw payloads, events and derived analytics are retained for the life of your licence unless you delete them. Retention periods to be confirmed by legal counsel.
- Access: only you can see your data.
- Correction: you may mark any interpretation as accurate, partly accurate, inaccurate or missing context, and add your own context. This never alters the immutable raw trading record.
- Export: you may export your recorded data and reports.
- Deletion: you may delete accounts, connections and recorded data.
- Revocation: you may revoke a platform connection at any time in Connections.
Why we process it, and on what legal basis
- Creating your account and providing the recording, replay and analytics features — performance of our contract with you.
- Taking payment, managing your subscription, tax compliance and invoicing — performance of our contract, carried out through Paddle as Merchant of Record.
- Security, fraud prevention and service reliability — our legitimate interests.
- Customer support and service communications — performance of our contract.
- Product improvement, aggregated research, model evaluation and anonymised benchmarking — only with your separate, optional and revocable consent in Settings.
Who we share it with
- Service providers and sub-processors: hosting, database, authentication, AI summarisation and support tooling.
- Paddle.com, our Merchant of Record, for sale of the product, subscription management, payments, tax compliance and invoicing.
- Professional advisers such as legal and accounting where necessary.
- Authorities or regulators where we are required to do so by law.
- Individual behavioural scores and findings are not shared with prop firms, brokers, employers or funding providers unless you have given clear, explicit and granular consent. A behavioural score is never used to automatically create a significant negative consequence for you.
Security and international transfers
We apply appropriate technical and organisational measures, including encryption in transit, access controls and row-level isolation so that your records are readable only by your own account.
Where data is transferred outside the UK or EEA, we rely on adequacy decisions or standard contractual clauses. The full transfer inventory is to be confirmed by legal counsel before launch.
Your rights
Subject to local law, you may request access, rectification, erasure, restriction, portability, object to processing, and withdraw consent at any time. You can also exercise most of these directly in the product through export and deletion. We aim to respond within one month, and you may complain to your data protection supervisory authority.
This document is a drafting placeholder produced inside the product for internal review. It is not legal advice and is not final. It must be reviewed, completed and approved by qualified legal counsel in each launch jurisdiction before public launch.