Privacy Policy
Operator: HotkeyBridge is operated by ECOV-HOLDING LTD, a company registered in England & Wales (company no. 15842807). Registered office: 6 Ascension Gardens, Bletchley, Milton Keynes, England, MK3 5PB. VAT no. 479240075. Contact: support@hotkeybridge.com.
1. Who We Are
HotkeyBridge is operated by ECOV-HOLDING LTD, a company registered in England & Wales (company no. 15842807).
Contact: support@hotkeybridge.com
Website: hotkeybridge.com
2. What Data We Collect
- Email address (account login and communication)
- Hardware ID (CPU and motherboard hash for license binding)
- Trading statistics (daily P&L, trade count, win rate)
- Download timestamps and version information
- Subscription and payment status (via Stripe)
- If you connect an AI assistant (section 6): which trading accounts you chose to share, when you connected or disconnected, and usage records of the connector (which statistics were requested, not their content)
- If you apply to our affiliate programme: your name, email, country, the channels you promote on, how you would promote HotkeyBridge, whether you apply as a business and whether you are VAT-registered; once approved, your affiliate code, the commission records and statements, and the payout method and payout email you give us (PayPal or Wise). We store no bank details.
- If you subscribe with an affiliate's code: that the code was used, so the affiliate can be credited with a commission on your payments
3. How We Use Your Data
- To provide, manage and validate your subscription and license
- To display your trading statistics on your personal dashboard
- To enforce hardware binding of your license
- To provide the AI connector when you turn it on, so an AI assistant of your choice can read your statistics at your request (section 6)
- To send important service and account notifications
- To comply with legal obligations
4. Legal Basis for Processing (GDPR)
We process your data on the following legal bases:
- Contract performance (providing the service you subscribed to, including optional features you turn on and off yourself, such as the AI connector)
- Legitimate interests (security, fraud prevention, license enforcement)
- Consent (website analytics and affiliate tracking, only if you accept them in the cookie banner; you can withdraw at any time, see section 10)
- Legal obligation (compliance with applicable law)
5. Data Sharing
We share data only with:
- Firebase (Google) — authentication and secure database storage
- Stripe — payment processing and subscription management
- Resend — delivery of our account and service emails: welcome and trial emails, password reset and email verification links, security alerts (for example a login from a new device, or two-factor authentication being turned off) and confirmations of feedback you send us. Resend receives your email address and the content of those emails, which can include your subscription plan, the approximate location, device and browser of a new login, and the text of your feedback together with your account number, app version and browser. Resend is operated by Resend, Inc. (USA) and sends our emails from its EU region (Ireland). Click and open tracking are turned off.
- Twilio SendGrid — backup email delivery while we move our emails to Resend: if Resend cannot send an email, the same email is sent through SendGrid instead, with the same data as above. SendGrid is operated by Twilio Inc. and processes this data in the United States. Click and open tracking are turned off.
- WorkOS Inc. (USA) — the sign-in step when you connect an AI assistant, only if you use the AI connector (section 6)
- Google Analytics (Google) — website usage statistics, only if you accept Analytics cookies (section 10)
When you connect your own AI assistant (for example ChatGPT by OpenAI or Claude by Anthropic), we send the statistics it requests to that assistant at your request (section 6).
Affiliate programme: an affiliate never receives your name, email or any other identifying detail. On their dashboard they see only an anonymised row per customer who used their code: a number, the plan (monthly / annual), the month the subscription started, its status (trial / active / cancelled) and the commission earned. Affiliate payouts are sent through PayPal or Wise to the payout email the affiliate gave us.
We do not sell, rent, or share your personal data with any other third parties for marketing or commercial purposes.
6. AI Connector (Connecting Your Own AI Assistant)
The AI connector is optional and off unless you connect it. It lets an AI assistant you use — for example ChatGPT or Claude — read your HotkeyBridge statistics when you ask it to. It is read-only: it can never place, change or close trades or change your account. Setup and details: Connect your AI.
- What is shared with your AI assistant: pre-calculated statistics of the accounts you choose (results, win rate, sessions, discipline and risk statistics) and, when asked, up to 20 recent trades (date, time, instrument, side, size, result). Accounts are shown as A, B, C.
- What is never shared: your name, email, account numbers, broker or server, prices, stop levels, tickets, comments and journal notes.
- Your consent when you connect: on our sign-in page you choose which trading accounts to share; on the consent screen of our sign-in provider you choose whether money is shown as amounts or as percentages only, and allow access.
- Sign-in provider: WorkOS Inc. (USA) handles the sign-in step between your AI assistant and HotkeyBridge. It receives only an internal user ID and your email address — never your trading data.
- Where it runs: the connector service is hosted on Google Cloud in London (europe-west2).
- Your AI provider: what your AI assistant does with the statistics it reads is governed by your agreement with that provider (for example OpenAI or Anthropic), not by this policy. Please read their privacy policy.
- Disconnect any time: Security → Connected AI apps → Disconnect all AI apps, on hotkeybridge.com/security.html. Access stops at once. You can also remove the connector in your AI assistant.
7. Data Security
Your data is stored securely in Google Firebase with industry standard encryption. Payment data is processed entirely by Stripe and we never store your card details. Your subscription status is cached locally on your device using Windows DPAPI encryption.
8. Your Rights (GDPR / UK GDPR)
As a UK or EU resident you have the right to:
- Access your personal data
- Correct inaccurate data
- Request deletion of your account and associated data
- Restrict or object to processing
- Data portability
- Withdraw consent at any time
To exercise any of these rights contact support@hotkeybridge.com. We will respond within 30 days.
9. Data Retention
We retain your personal data for as long as your account is active plus 90 days after account closure for legal and accounting purposes. Trading statistics are retained for the duration of your account.
Affiliate programme: applications are kept while your account exists, and you can ask us to delete a rejected or withdrawn application at any time. Commission records and payout statements are accounting records and are kept for 6 years after the end of the financial year they relate to.
AI connector: the connection record (which accounts you shared, when you last connected or disconnected) is kept while your account exists — after you disconnect it is what keeps AI apps blocked — and is deleted with your account. Deleting your account also removes all connector data and your user at WorkOS, our sign-in provider for AI connections. Connector usage logs are kept for 30 days; they record which statistics were requested, never the content of the answers, and identify you only by a hashed ID.
10. Cookies and Similar Storage
We use storage on your device in two ways. Strictly necessary storage is needed to run the site and keep your account secure, so it is always on. Optional cookies (Google Analytics and affiliate tracking) are only used if you accept them. Nothing optional runs before you choose, and "Reject all" is as easy as "Accept all". We do not use advertising cookies.
You can change or withdraw your choice at any time with the Cookie settings link at the bottom of every page. Withdrawing Analytics stops Google Analytics immediately and deletes its cookies from your browser. We ask again after 6 months, or sooner if we change what we use.
Strictly necessary (always on)
| Name | Set by | Purpose | Kept for |
|---|---|---|---|
Firebase Authentication storage (browser storage, names starting with firebase:) | hotkeybridge.com (Google Firebase) | Keeps you signed in to your account and the dashboard | Until you sign out |
__session | hotkeybridge.com | Trusted-device cookie, only if you choose "trust this device" when signing in with two-step authentication. Lets this browser skip the code. Secure, HttpOnly. | 30 days, or until you revoke the device |
hkb_consent | hotkeybridge.com | Remembers your cookie choice (which categories, version and date) | 6 months |
Site and dashboard preferences (browser storage: names starting with hkb_, and redirectAfterLogin) | hotkeybridge.com | Settings you choose in the dashboard (for example the selected trading account, chart type, time zone, the $ / % privacy view and which help tips you have seen) and which page to return to after signing in | Until you clear them |
| Stripe cookies | Stripe (checkout.stripe.com) | Secure payment and fraud prevention, only on Stripe's checkout page when you subscribe. See Stripe's own cookie policy. | Set by Stripe |
Optional (only with your consent)
| Name | Set by | Purpose | Kept for |
|---|---|---|---|
_ga, _ga_WWNYXGLTHQ | Google Analytics (Google), on hotkeybridge.com | Analytics: counts visits and clicks on our website pages (for example which page leads to a download or a subscription) so we can improve the site. Google Analytics is not loaded at all until you accept Analytics. | Up to 2 years, or until you withdraw consent |
hkb_ref (not in use yet) | hotkeybridge.com | Affiliate tracking: if you arrive through a partner's link (?ref=...), remembers that partner so they can be credited if you subscribe | 30 days |
Our desktop app does not use cookies. Video thumbnails on the download page are images from YouTube; the videos open on YouTube, which applies its own cookie policy.
11. International Transfers
Your data may be processed by Google Firebase servers located outside the UK. Google maintains appropriate safeguards in accordance with UK GDPR requirements.
Our emails are sent by Resend, Inc. (USA) from its EU region (Ireland), and, only as a backup while we move to Resend, by Twilio Inc. (SendGrid) in the USA, under appropriate safeguards.
If you use the AI connector, the connector service runs on Google Cloud in London (europe-west2), and the sign-in step is processed by WorkOS Inc. in the USA (internal user ID and email address only) under appropriate safeguards. The AI assistant you choose may process data outside the UK under your own agreement with its provider.
12. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of significant changes by email. Continued use of the Software constitutes acceptance of the updated Policy.
13. Contact and Complaints
You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at ico.org.uk if you believe your data rights have been violated.