Back to Synnectra

Privacy Policy

Last updated: April 2026

1. Introduction

Synnectra A/S ("we", "us", "our", or the "Company"), a company registered in Denmark, is committed to protecting and respecting your privacy and the personal data you entrust to us. This Privacy Policy describes how we collect, use, store, disclose, and otherwise process your personal data when you use the Synnectra platform and all associated services (collectively, the "Service").

We are the data controller for the personal data we process in connection with the Service. This means we are responsible for deciding how and why your personal data is processed.

Data Controller: Synnectra A/S, Egernvej 1, 4760 Vordingborg, Denmark. CVR: Pending registration.

Contact for privacy matters: [email protected]

Data Protection Officer (DPO): You may reach our Data Protection Officer at [email protected] for any questions, requests, or complaints relating to the processing of your personal data.

Supervisory Authority: In Denmark, the competent supervisory authority is the Danish Data Protection Agency (Datatilsynet), Borgergade 28, 5., 1300 København K, Denmark. You have the right to lodge a complaint with Datatilsynet at any time if you consider that the processing of your personal data infringes applicable data protection law.

This Privacy Policy is issued in accordance with the following legislation and regulatory frameworks:

• Regulation (EU) 2016/679 of the European Parliament and of the Council — the General Data Protection Regulation ("GDPR").
• The Danish Data Protection Act (Databeskyttelsesloven, Act No. 289 of 25 April 2024) — the national implementing legislation supplementing the GDPR in Denmark.
• The Danish Cookie Order (Cookiebekendtgørelsen) — implementing the ePrivacy Directive (Directive 2002/58/EC, as amended by Directive 2009/136/EC) in Denmark.
• The ePrivacy Directive (Directive 2002/58/EC) — governing the use of cookies and electronic communications data.

By accessing or using the Service, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with any part of this policy, you must discontinue use of the Service.

2. Data We Collect

We collect and process the following categories of personal data in connection with your use of the Service. The specific data items collected depend on how you interact with the platform:

3. Special Categories of Data and Children

3.1 Special Category Data

We do not collect, process, or store any special categories of personal data as defined by Article 9 of the GDPR. This includes, but is not limited to: racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health, or data concerning a natural person's sex life or sexual orientation.

If you voluntarily submit any such data to us through any communication channel, we will delete it promptly upon becoming aware of it, unless we are required by law to retain it.

3.2 Children's Privacy

The Service is not intended for use by individuals under the age of 18. We do not knowingly collect personal data from children or minors under the age of 18. If we become aware that we have inadvertently collected personal data from a person under the age of 18, we will take immediate steps to delete such data from our systems. If you are a parent or guardian and become aware that a child under 18 has provided personal data to us, please contact us at [email protected] and we will take appropriate action.

4. What We Do NOT Collect

We believe in data minimisation and transparency. The following is an explicit statement of data we do not collect or process:

• Payment card data: We never collect, process, or store credit card numbers, CVV codes, or bank account details. All payment processing is handled by Stripe, Inc., which is PCI DSS compliant. We only receive a tokenized reference and confirmation of successful payment.
• Plaintext passwords: Passwords are hashed using bcrypt with a cost factor of 12 before storage. At no point do we store, log, or have access to your plaintext password.
• Tracking pixels or third-party trackers: We do not embed tracking pixels, social media tracking scripts, advertising pixels, or any third-party analytics trackers (such as Google Analytics, Facebook Pixel, or similar tools) on our platform.
• Automated decision-making with legal effects: We do not engage in automated decision-making that produces legal effects concerning you or similarly significantly affects you, as described in Article 22 of the GDPR. Signal automation constitutes the performance of our contract with you and does not constitute automated decision-making within the meaning of Article 22.

5. Lawful Basis for Processing

Under Article 6 of the GDPR, we must have a lawful basis for processing your personal data. The table below sets out the lawful basis we rely on for each processing activity:

Where we rely on contract performance (Article 6(1)(b)), the processing is necessary for the performance of the contract between you and Synnectra, namely the provision of the Service as described in our Terms of Service.

Where we rely on legitimate interest (Article 6(1)(f)), we have conducted a balancing test to ensure that our interests do not override your rights and freedoms. Our legitimate interests include: maintaining the security and integrity of the Service, preventing fraud and abuse, operating and improving the platform, and administering the referral program.

Where we rely on consent (Article 6(1)(a)), you may withdraw your consent at any time by contacting us at [email protected] or by adjusting your cookie preferences. Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal.

Where we rely on legal obligation (Article 6(1)(c)), the processing is necessary for compliance with a legal obligation to which we are subject, such as obligations under the GDPR and the Danish Data Protection Act.

6. How We Use Your Data

We use the personal data we collect for the following purposes:

• Service delivery: To provide, operate, maintain, and improve the core functionality of the Service, including the TradingView-to-MetaTrader signal bridge, multi-account execution, symbol mapping, position sizing, and news protection features.
• Account management: To create and manage your account, process registration, authenticate your identity, manage your License ID, store your account settings and preferences, and handle account deletion requests.
• Security: To protect the Service and our users from unauthorised access, fraud, abuse, and other security threats. This includes IP-based rate limiting, account lockout mechanisms, security logging, CSRF protection, and admin audit logging.
• Billing and payments: To process subscription payments, manage billing cycles, handle payment failures, issue refunds, and maintain financial records as required by applicable law.
• Analytics and improvement: To analyse aggregate usage patterns, monitor Service performance, identify and resolve technical issues, and improve the quality and reliability of the platform. All analytics are based on aggregated, anonymised data and do not involve profiling of individual users.
• Notifications: To send you service-related notifications, including trade execution confirmations, error alerts, account status changes, security alerts, and important administrative notices regarding changes to the Service or this Privacy Policy.
• Referral program: To operate the affiliate and referral program, including tracking referral link usage, calculating commissions, and managing referral statistics.
• Legal compliance: To comply with applicable laws, regulations, court orders, and lawful requests from public authorities, including data protection legislation, financial regulations, and tax obligations.

7. Automated Processing

The Service includes automated signal processing and trade execution functionality. When a trading signal is received from TradingView, our system automatically processes and routes it to your connected MetaTrader account(s) for execution without manual intervention. This automated processing constitutes the performance of the contract between you and Synnectra as described in our Terms of Service.

This automated processing does not constitute automated decision-making within the meaning of Article 22 of the GDPR, as it does not produce legal effects concerning you or similarly significantly affect you. The trading decisions and strategies that generate signals are made by you (or by TradingView scripts and indicators you have configured). Synnectra acts solely as a technical conduit for the relay and execution of your trading instructions.

We do not use automated profiling, artificial intelligence, or machine learning algorithms to make decisions about you that have legal or similarly significant effects.

8. Data Sharing and Recipients

We may share your personal data with the following categories of recipients. We do not sell, rent, trade, or otherwise monetise your personal data by providing it to third parties for their own marketing or commercial purposes.

8.1 No Sale of Data

We do not sell, rent, lease, trade, or otherwise provide your personal data to any third party for their own commercial or marketing purposes. Your data is processed solely for the purposes described in this Privacy Policy.

8.2 Disclosure for Legal Requirements

We may disclose your personal data to law enforcement agencies, regulatory authorities, courts, or other governmental bodies if such disclosure is required by law, regulation, court order, or legal process, or if we believe in good faith that such disclosure is necessary to: (a) comply with a legal obligation; (b) protect and defend our rights or property; (c) prevent or investigate possible wrongdoing in connection with the Service; (d) protect the personal safety of our users or the public; or (e) respond to a valid legal request from a competent authority.

9. Sub-Processors

We engage the following sub-processors to process personal data on our behalf. Each sub-processor is bound by a written data processing agreement that provides adequate safeguards for the protection of your personal data in compliance with Article 28 of the GDPR:

We will notify you of any changes to our sub-processor arrangements by updating this Privacy Policy. If you object to a new sub-processor, you may contact us at [email protected] to discuss your concerns.

10. International Data Transfers

Your personal data is primarily processed and stored within the European Union / European Economic Area (EU/EEA). However, certain processing activities may involve the transfer of personal data to countries outside the EU/EEA. The following transfers may occur:

10.1 Stripe (United States)

When you make a payment, your name and email address are transmitted to Stripe, Inc., which processes payment data in the United States. Stripe participates in the EU-U.S. Data Privacy Framework (DPF), which has been recognised by the European Commission as providing an adequate level of data protection. Additionally, Stripe has implemented Standard Contractual Clauses (SCCs) as adopted by the European Commission, and maintains a comprehensive data processing agreement with Synnectra.

10.2 Google Fonts (Removed)

We have previously used Google Fonts (served from servers operated by Google LLC in the United States) for web font delivery. We no longer use Google Fonts. All fonts are now self-hosted on our own servers. No requests are made to Google's servers when you visit our website, and no data (including your IP address) is transmitted to Google in connection with font loading.

10.3 Tradovate (United States)

If you connect a Tradovate account, OAuth tokens and account identifiers may be transmitted to Tradovate's servers in the United States. We apply the minimum data principle, sharing only the tokens strictly necessary for authentication and trade execution. Transfers are protected by the data processing safeguards described below.

10.4 Safeguards for International Transfers

For all international transfers of personal data, we rely on one or more of the following safeguards to ensure that your data receives an adequate level of protection:

• EU-U.S. Data Privacy Framework (DPF): Where a recipient in the United States has certified its participation in the Data Privacy Framework, we rely on this adequacy determination as a basis for the transfer.
• Standard Contractual Clauses (SCCs): We enter into Standard Contractual Clauses (as adopted by the European Commission in Implementing Decision 2021/914) with recipients outside the EU/EEA, ensuring contractual guarantees of an adequate level of data protection.
• Data Processing Agreements (DPAs): All sub-processors and third-party recipients are bound by written data processing agreements that include obligations regarding confidentiality, security measures, data subject rights, and breach notification, in accordance with Article 28 of the GDPR.
• Encryption in transit and at rest: All data transferred to third-party recipients is protected by TLS (Transport Layer Security) encryption during transmission and AES-256-GCM encryption at rest, ensuring that data is unreadable to unauthorised parties even in the event of interception or unauthorised access.

11. Data Retention

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, including satisfying any legal, accounting, or reporting requirements. The table below specifies the retention periods applicable to each category of data:

Upon expiry of the applicable retention period, your personal data will be securely deleted or anonymised so that it can no longer be associated with you, unless we are required to retain it for a longer period by applicable law (e.g., tax or accounting legislation).

12. Your Rights Under the GDPR

Under the GDPR and the Danish Data Protection Act, you have the following rights with respect to your personal data:

12.1 Right of Access (Article 15)

You have the right to obtain confirmation from us as to whether or not personal data concerning you is being processed, and if so, to obtain access to that data along with a copy of it. You are entitled to information about the purposes of processing, the categories of data concerned, the recipients or categories of recipients, the retention periods, and your rights regarding the data.

12.2 Right to Rectification (Article 16)

You have the right to request the correction of inaccurate personal data concerning you, and the right to have incomplete personal data completed. You can update your name, email address, and account settings directly through the Dashboard at any time.

12.3 Right to Erasure (Article 17)

You have the right to request the deletion of your personal data ("right to be forgotten") in the following circumstances: (a) the data is no longer necessary for the purpose for which it was collected; (b) you withdraw your consent and there is no other lawful basis for processing; (c) you object to the processing and there are no overriding legitimate grounds; or (d) the data has been unlawfully processed. We will comply with erasure requests without undue delay and in any event within 30 days, subject to any legal obligations requiring us to retain certain data.

12.4 Right to Restriction of Processing (Article 18)

You have the right to request the restriction of processing of your personal data in the following circumstances: (a) you contest the accuracy of the data (pending verification); (b) the processing is unlawful but you prefer restriction over erasure; (c) we no longer need the data but you need it for the establishment, exercise, or defence of legal claims; or (d) you have objected to processing pending the verification of our legitimate grounds.

12.5 Right to Data Portability (Article 20)

You have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to transmit that data to another controller without hindrance. Your data export is available at /api/user/export through the Dashboard. This right applies to data you have provided to us, where the processing is based on consent or contract, and the processing is carried out by automated means.

12.6 Right to Object (Article 21)

You have the right to object to the processing of your personal data at any time on grounds relating to your particular situation, where the processing is based on legitimate interest (Article 6(1)(f)). If you object, we will cease processing your data unless we demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or for the establishment, exercise, or defence of legal claims.

12.7 Right to Withdraw Consent (Article 7(3))

Where the processing of your personal data is based on your consent, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out prior to the withdrawal. You may withdraw your consent by contacting us at [email protected] or by adjusting your cookie preferences through the Service.

12.8 Right Not to Be Subject to Automated Decision-Making (Article 22)

You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. As explained in Section 7 (Automated Processing), our automated signal processing constitutes contract performance and does not constitute automated decision-making within the meaning of Article 22. We do not engage in profiling or automated decision-making that would invoke Article 22 protections.

12.9 How to Exercise Your Rights

You may exercise any of the rights described above through any of the following channels:

• Via the Dashboard: You can access, update, and export your personal data, manage your cookie preferences, and request account deletion directly through the Synnectra Dashboard.
• Via email: Send a written request to [email protected], clearly identifying yourself and specifying the right(s) you wish to exercise. We will respond to your request without undue delay and in any event within 30 days. If we require additional information to verify your identity, we will contact you.
• Via postal mail: You may send a written, signed request to Synnectra A/S, Egernvej 1, 4760 Vordingborg, Denmark.

We will not charge a fee for processing your request unless it is manifestly unfounded, excessive, or repetitive, in which case we may charge a reasonable administrative fee or refuse to act on the request.

12.10 Right to Complain to the Supervisory Authority

If you consider that the processing of your personal data infringes the GDPR or the Danish Data Protection Act, you have the right to lodge a complaint with the Danish Data Protection Agency (Datatilsynet):

13. Data Security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. The following table summarises the key security measures we have implemented:

We regularly review and update our security measures to address emerging threats and vulnerabilities. However, no system connected to the internet can be completely secure, and we cannot guarantee the absolute security of your data. We encourage you to use strong, unique passwords and to enable two-factor authentication to enhance the security of your account.

14. Data Breach Notification

We take the security of your personal data seriously and have implemented robust measures to prevent data breaches. However, in the event of a personal data breach (as defined in Article 4(12) of the GDPR), we will take the following actions:

14.1 Notification to the Supervisory Authority

In accordance with Article 33 of the GDPR, we will notify the Danish Data Protection Agency (Datatilsynet) of any personal data breach without undue delay and, where feasible, within 72 hours of becoming aware of the breach, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons. The notification will include the nature of the breach, the categories and approximate number of data subjects and records affected, the likely consequences, and the measures we have taken or propose to take to address the breach.

14.2 Notification to Affected Individuals

In accordance with Article 34 of the GDPR, where a personal data breach is likely to result in a high risk to the rights and freedoms of natural persons, we will communicate the breach to you directly without undue delay. This notification will describe the nature of the breach, provide recommendations for protecting yourself from potential adverse effects, and describe the remedial actions we are taking. We will use email as the primary communication channel for such notifications.

14.3 Documentation

In accordance with Article 33(5) of the GDPR, we will document all personal data breaches, including the facts relating to the breach, its effects, and the remedial actions taken. This documentation will be made available to Datatilsynet upon request.

15. Children's Privacy

The Service is not directed at individuals under the age of 18 and we do not knowingly collect personal data from children or minors. By using the Service, you represent and warrant that you are at least 18 years of age.

If we discover that we have inadvertently collected personal data from a person under the age of 18, we will take immediate steps to delete such data from our systems. If you are a parent or guardian and become aware that a child under 18 has provided personal data to us, please contact us immediately at [email protected] and we will take prompt action to remove the information.

16. Changes to This Privacy Policy

We may update or modify this Privacy Policy from time to time to reflect changes in our data processing practices, the features of the Service, legal or regulatory requirements, or other operational reasons.

In the event of any material changes to this Privacy Policy, we will provide you with at least 30 days' advance notice by sending an email to the address associated with your account and/or by displaying a prominent notice within the Dashboard. The notice will describe the nature of the changes and the date on which they will take effect.

Your continued use of the Service after the effective date of any changes constitutes your acceptance of the updated Privacy Policy. If you do not agree with the revised policy, you must discontinue use of the Service and request the deletion of your account before the changes take effect.

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your personal data. The "Last updated" date at the top of this page indicates when this policy was last revised.

17. Contact Information

If you have any questions, concerns, or requests regarding this Privacy Policy or our data processing practices, please contact us using the information below:

This Privacy Policy was last updated: April 2026