Privacy Policy

1. Who we are and what this covers

Tradeord LLC operates this website and is responsible for the processing described here. You can contact us at legal@tradeord.com or at the mailing address below. This Policy covers our website and portal; an underlying account provider or an external platform may handle information under its own privacy notice.

2. Information we collect and receive

• Contact and client information. Your email address, Tradeord-managed legal name and optional cropped profile photo, interface preferences, permanent six-character Client ID, internal user identifier, account assignment, role, access status, and related timestamps. An administrator may provide your email address and assign an account before your first visit.
• Identity documents. Before assigning an account, an administrator records the client’s first and last name, date of birth, nationality, passport number and expiry date, residential address (address lines, city, state or province, country and postal code), a passport image or PDF, and a separate proof-of-address document. These records support account onboarding and administrative identity review. Identity details and documents are encrypted in storage. Full identity records and documents are accessible only through authorized administrative access; your own legal name also appears in your Account Settings and profile menu, and your legal name, Client ID and residential address appear on your downloaded trading statements. Tradeord does not send these collected identity details, residential address or documents to the trading provider. Document collection does not itself certify authenticity.
• Account information. Account identifiers, names, currency, status, balances, available funds, positions, orders, execution confirmations, account adjustments, and profit or loss information received from a connected account-data provider. Clients are shown information for their assigned account; authorized administrators can view connected accounts and manage assignments.
• Sign-in and security information. Session records, hashed sign-in tokens and email-change verification codes, pending email addresses, expiry times, records of sign-ins and administrative changes, and information used to limit abusive requests. Client access also requires Google Authenticator. We store encrypted authenticator secrets, verification timestamps and replay-prevention records, short-lived setup or verification challenges, and support requests and administrative verification notes for 2FA resets. Setup QR codes are generated on our servers. The website does not ask clients to create a password.
• Technical information. Our servers receive IP addresses, request times, requested addresses, browser or user-agent information, response status, and related diagnostic data. Server and security logs may retain this information.
• Correspondence. If you contact us, we receive your email address, message, and information you choose to provide. Please do not email passwords, sign-in links, full payment-card details, or unnecessary sensitive documents.

The current website does not collect payment-card details, precise device location, or biometric templates. Uploaded profile photos and passport images are not used for automated facial recognition through this service. Trade instructions are transmitted to the connected execution provider. The website records opening deposits, account deposits, withdrawal requests and approvals, and account-activity notifications. Withdrawal records include the amount, reference, recipient email, approval time, IP address, browser information, and an audit trail of administrative actions and balance-adjustment outcomes. Approval tokens are stored as hashes. External payments are handled separately.

3. How we use information

We use information to provide the portal, authenticate invited users, display assigned account data, manage access and onboarding identity records, respond to requests, maintain and troubleshoot the service, prevent abuse, investigate security issues, and meet applicable legal obligations or establish and defend legal claims.

Where applicable law requires a legal basis, the basis depends on the purpose: providing a service you request, our legitimate interests in operating and securing the service, compliance with legal obligations, or consent where required. We do not treat acceptance of this Policy as blanket consent to unrelated processing.

4. Access and disclosures

Personal information may be accessible to:

• Authorized Tradeord administrators. They manage invitations, assignments, and access, and can view connected account information and collected identity documents needed to operate the service. Access to identity records, passport downloads and proof-of-address downloads is recorded.
• Infrastructure and service providers. Hosting and technical providers process information needed to run and secure the website. The current hosting platform is Vultr. When email sign-in delivery is enabled, Resend processes recipient addresses, sign-in, email-verification, withdrawal-approval, and 2FA-reset support message contents, and delivery information. The Capital.com integration supplies market and account information, receives authorized trading instructions, and processes account adjustments. Order and reconciliation records are retained to operate and audit the service.
• Legal and professional recipients. We may disclose information where reasonably necessary to comply with lawful requests, obtain professional advice, investigate abuse, protect rights or safety, or establish or defend legal claims.
• A successor to the business. Information may be transferred as part of a merger, acquisition, or similar transaction, subject to applicable law and appropriate notice of material changes in its use.

We do not sell personal information collected through this website or share it for cross-context behavioral advertising. Other clients cannot use the portal to view your assigned account. External social-media links do not embed social tracking widgets; if you follow a link, the destination's own privacy practices apply.

Support conversations and notifications

When you create a support ticket, we record its reference, category, subject, messages, account association, participants, status, read markers and timestamps. Authorized administrators can read and reply to your tickets. Identity profile updates and document access are recorded for administration and security.

After account activation we send a welcome email with the recorded initial deposit and a sign-in link. When support replies, Resend sends an email notification with the ticket reference and a link; the reply itself stays inside the authenticated dashboard. These messages come from noreply@tradeord.com. Email replies are not monitored or imported into the ticket system. Ticket and delivery records are retained under the retention practices below.

5. Cookies and browser controls

The website uses browser storage to remember whether your sidebar is expanded or collapsed, and separate essential first-party session cookies, __Host-tradeord for clients and __Host-tradeord-admin for administrators, to support sign-in and protection against forged requests. These cookies may be set when you open a sign-in form or use authenticated features. Verified client access expires after 30 days and administrator access after eight hours; pre-sign-in session cookies generally last for the browser session, subject to your browser's restore settings.

The current website does not use advertising cookies, analytics trackers, tracking pixels, or third-party embedded social widgets. Fonts and visual assets are served from our website. We do not use browser storage for advertising profiles.

You can clear or block cookies through your browser. Blocking the essential cookie can prevent sign-in and other protected actions. The website does not currently change its essential-cookie behavior in response to Do Not Track or Global Privacy Control signals; it does not engage in the sale or targeted-advertising activities those opt-out signals address.

6. Retention and deletion

Retention depends on the type of record, whether it is needed to provide access, investigate or prevent abuse, resolve a request or dispute, or satisfy a legal obligation. Account records, collected identity documents, and administrative audit history remain in the service until removed through an administrative review or a verified request, subject to those needs. Revoking portal access does not automatically erase all related records.

Sign-in links and incomplete Authenticator challenges expire after 15 minutes. Verified client sessions expire after 30 days and administrator sessions after eight hours. Signing out or an administrative reset can revoke sessions earlier. Expiration prevents further use; it does not mean every associated database record or log entry is immediately deleted. Logs and backups are held separately and may remain until rotation or deletion, or longer where needed for security, recovery, or legal obligations.

To request deletion or ask about retention of your information, contact legal@tradeord.com. If information must be retained despite a request, we will explain the applicable reason where permitted by law. Deleting portal records does not necessarily delete information held independently by an underlying account provider.

7. Security

We use safeguards including encrypted HTTPS connections, restricted administrative access, account-level access controls, hashed sign-in tokens, and security monitoring. Sign-in links are single use. No internet service or security measure can guarantee complete protection. You may replace or remove your profile photo in Account Settings; older copies may remain in backups until rotation. Protect your email account and device, and contact us promptly if you suspect unauthorized access.

8. Your choices and privacy requests

You can choose not to provide information, although some information is necessary for client access. You can stop using the service, ask for access to be revoked, and change your sign-in email in Account Settings after verifying the new address, or request correction of a legal name or assignment.

Depending on your location and which laws apply, you may have rights to access or obtain a copy of personal information, correct it, request deletion, restrict or object to processing, withdraw consent for processing that relies on consent, or appeal a decision on a request. Withdrawal of consent does not affect processing that was lawful before withdrawal. You may also have the right to complain to a competent privacy regulator.

Send requests, or an appeal of our response, to legal@tradeord.com with enough detail to identify the relevant account and request. We may need proportionate verification of your identity or an authorized agent's authority before disclosing or changing information. Do not send a sign-in link or password. We will respond within the period required by applicable law and will not unlawfully discriminate against you for exercising a privacy right.

9. International processing

Tradeord LLC is based in the United States. Hosting, account-data, and communications providers may process information in other countries where they operate, and local privacy protections may differ. Contact us for information about processing locations and any safeguards applicable to your information. Nothing in this Policy waives protections or transfer requirements provided by applicable law.

10. Children

The client service is intended for adults aged 18 and over and is not directed to children. If you believe a child has provided personal information through the service, contact us so we can investigate and take appropriate steps, including deleting information where required.

11. Changes to this Policy

We will post updates here with a revised effective date. If our practices materially change, we will provide a prominent website notice or other appropriate notice, and obtain consent where required before using information for a new purpose. Please review this Policy periodically.