Privacy policy
This page explains what RiskBrake stores, why, for how long, and who else sees it. It is written for Article 13 GDPR. Last updated: 16 September 2026.
Controller
Marco Lange, c/o Block Services, Stuttgarter Str. 106, 70736 Fellbach, Germany ·
support@riskbrake.com
There is no data protection officer, as none is required for an operation of this size.
What we store
| Account | Your email address, a salted hash of your password (PBKDF2-HMAC-SHA256, we never store the password itself), your API key and your sign-up date. Purpose: running your account. Legal basis: Art. 6(1)(b) GDPR, performance of a contract. |
| Your rules and locks | Your limits, your trading sessions, your trades, profit and loss, your trading account names as reported by ATAS, and any active lock. Purpose: this is the service itself, the lock cannot work without it. Legal basis: Art. 6(1)(b) GDPR. |
| Computer identifier | A one-way hash derived from your Windows installation ID and system drive. We never receive the raw values and cannot reverse the hash. Purpose: preventing a running lock from being bypassed by creating a second account, and allowing only one free trial per computer. Legal basis: Art. 6(1)(f) GDPR, legitimate interest in an enforcement tool that actually enforces and in preventing repeated free trials. |
| Subscription | Your subscription status and end date, the membership and customer IDs Whop sends us, the email and answer you gave at Whop checkout, and the payment events Whop reports (for example trial started, payment succeeded). We never receive your card or bank details. Purpose: knowing whether your protection is paid for. Legal basis: Art. 6(1)(b) GDPR. |
| Technical data | IP address, page path and time spent on a page, your time zone offset, the version of the installed guardian and its last error message. Purpose: security, rate limiting against abuse, ending your lock at your local midnight, and support. Legal basis: Art. 6(1)(f) GDPR. |
| Diagnostic logs | The log files of the RiskBrake guardian and strategy and your RiskBrake order log for today. They are uploaded when support requests them for your account, when a day lock is triggered and when RiskBrake is removed. When support requests them, the guardian also uploads ATAS's own log files from the last 3 days. ATAS logs can contain your ATAS or broker login email, your account numbers, your orders and the servers you connect to. Only we can see these files. We keep only the last few uploads of each file, and ATAS logs for at most 14 days. Purpose: finding and fixing errors on your computer. Legal basis: Art. 6(1)(b) and (f) GDPR. |
| Journal screenshots | If you use the journal with auto screenshots (on by default, can be switched off in the RiskBrake strategy settings inside ATAS), the guardian captures images of your ATAS windows only, never your full screen or other programs, at the moment you enter and exit a trade, and uploads them to your journal. These images can show whatever your ATAS windows show, including account balances and positions. Only you can see them after logging in, you can delete any image individually in the trade view, and we keep your images for as long as your account exists; older ones are not deleted automatically. Purpose: your own trade journal. Legal basis: Art. 6(1)(b) GDPR; you control the feature entirely. |
| Messages | Anything you send us through the contact form or by email, so we can answer. Legal basis: Art. 6(1)(b) and (f) GDPR. |
What we do not do
No advertising, no advertising cookies, no analytics services, no tracking pixels, no profiling, no automated decision-making with legal effect, and no selling or sharing of your data with anyone for their own purposes. We never see your broker password and we cannot place trades. RiskBrake only ever sends close orders through your own platform.
Cookies
One single cookie, named sid. It keeps you logged in and is strictly necessary for the service, so it needs no consent banner. It contains a random session token, nothing else. Deleting it logs you out.
Who else processes your data
| Railway | Hosting of the application and the database. Railway Corporation, USA. Data may therefore be processed outside the EU, on the basis of the EU standard contractual clauses. |
| Brevo | Sending transactional email, for example your verification link and important notices about your protection. Brevo SA, France, inside the EU. |
| Cloudflare | Domain routing and protection against attacks. Cloudflare Inc., USA, on the basis of the EU standard contractual clauses. |
Each of them acts as a processor under Art. 28 GDPR and only on our instructions.
Payments: if you subscribe, checkout, payment and billing run through Whop, Inc., USA (whop.com). Whop processes your payment data under its own privacy policy and tells us only what is listed under Subscription above.
How long we keep it
Account data for as long as your account exists. Trades and locks for the current period plus a short history so you can see your own record. Technical logs are shortened automatically and are not kept as a long-term archive. Delete your account and we delete the personal data belonging to it, unless a legal retention duty applies. Two things stay: the computer identifier with the date it was first used, so that a new account on the same computer gets no second free trial and cannot escape a running lock, and payment records we are legally required to keep.
Your rights
You may request access, correction, deletion, restriction of processing, and a copy of your data in a portable format. You may object to processing based on legitimate interest. You may withdraw consent at any time where processing is based on it. Write to support@riskbrake.com and we will answer within one month. Under Art. 77 GDPR you also have the right to lodge a complaint with a data protection supervisory authority.
One thing worth knowing
RiskBrake is built so that a lock cannot be removed on your own machine. That means some of your data, in particular an active lock, deliberately survives a reinstall and a new sign-up on the same computer. That is not a bug, it is the entire point of the product, and it is why the computer identifier exists. If you want to stop using RiskBrake, the dashboard has a proper way out that unlocks the next morning.
See also Legal notice and Terms of use.