Privacy Policy

1. Controller

Marcel Huy, trading as Huy Digital, Mittelstrasse 5, 3414 Oberburg, Switzerland, is responsible for the processing described here. Privacy requests may be sent to support@huymarkets.com.

2. Scope and principles

This Policy covers huymarkets.com, the HuyMarkets web app, desktop terminal, connectors, notifications and support contacts. We process data under the Swiss Federal Act on Data Protection and, where applicable, the EU General Data Protection Regulation.

We limit processing to what is needed for each purpose, use technical and organisational safeguards and do not sell personal advertising profiles.

3. Account and contract data

Purposes are registration, performance of the contract, billing, support and abuse prevention. Legal bases are the contract or pre-contractual steps, legal obligations and legitimate interests in secure operation.

• email address, optional name, password hash, language, plan and account status;
• registration, verification, login, cancellation and legal-confirmation timestamps;
• subscription, invoice and payment status plus Stripe customer and transaction identifiers; we do not receive full card details;
• support requests and necessary correspondence;
• tester waiting list (without an account): name, email, stated trading platforms, optional details (experience, computer, motivation, interest in the partner programme), confirmation time, personal invite code and – if you came via an invite link – the inviting person's code. Purpose: ordering tester invitations and contacting you about them; never shared for third-party advertising.

4. Technical usage and security data

Approximate geolocation is performed server-side using a local database (IP geolocation by DB-IP, db-ip.com, licence CC BY 4.0); the IP is not sent to a geolocation service. The full IP address and browser string of page views are deleted after 90 days; only country, page and time remain for statistics. Optional product analytics are used only according to the browser's analytics setting. Security and contract logs may still be necessary.

• IP address, time, user agent, session and device information, browser time zone and language;
• page views, feature use, referrer, approximate country or region and technical errors;
• audit and security events such as login, key issue, configuration changes and order results.

5. Broker, exchange and trading data

MT4/MT5 credentials remain on the user's device for a local connection and are not transmitted to HuyMarkets. Keys for supported cloud exchanges may be stored encrypted for server-side functions. Plain-text keys are not displayed in the account or used for unrelated purposes.

Processing is necessary for the requested service and initiated by the user. Brokers and exchanges process data under their own terms and privacy notices.

• connected provider, account or pseudonymous identifier, connection status and last activity;
• market, price, position, order, execution, fee, account and risk data required for the selected function;
• watchlists, alerts, strategies, DCA plans, automation settings and results.

6. AI features and quality logs

When an AI feature is used, the question and the market, chart, account or trading context required for the answer are sent to the currently configured AI provider. We currently use DeepSeek and, as a configuration-dependent fallback, OpenRouter and model providers available through it. Users should not include unnecessary personal data or secrets.

For quality improvement, HuyMarkets may log AI questions, context and responses. User identifiers are pseudonymised, while email patterns and recognisable personal monetary amounts are automatically redacted. Complete anonymity cannot be guaranteed for free text. These logs are not treated as binding trading decisions.

AI providers may process data outside Switzerland or the EEA. Where required, we use appropriate contractual safeguards and limit transfers to the feature purpose. AI logging can be disabled system-wide; a per-user control will be provided before broad public use.

7. Recipients and service providers

Providers receive only the data needed for their task and act, depending on their role, as processors, subprocessors or independent controllers.

• Hetzner Online GmbH for hosting and infrastructure in Germany;
• Infomaniak Network SA for email services in Switzerland or Europe;
• Stripe group companies for checkout, payment, invoices and subscription management;
• DeepSeek, OpenRouter and any selected model provider for requested AI functions;
• Telegram for operational, security and payment notifications to the operator; only a pseudonymous user identifier (no name, no email address), the event and, for payment events, plan or payment status and amount are transmitted;
• the broker, exchange and data providers selected by the user;
• authorities, courts or advisers where legally required or necessary to establish legal claims.

8. Cookies and local storage

We use necessary cookies for login, security, language and, where applicable, referral attribution. The browser may also store the analytics preference and a random session identifier. Necessary storage supports the requested function; optional analytics are not used for personalised advertising and may be refused or withdrawn in settings.

9. Retention

Where retention, evidence or security duties apply, affected data are restricted from other use. Deletion first takes effect in the production system; copies in rolling backups expire with the applicable backup rotation.

• account data: until account deletion unless legal or contractual grounds require longer storage;
• waiting list: until the tester invitation and at most until the official launch plus 6 months, or earlier on request (email support@huymarkets.com);
• session data: until the session expires or is revoked;
• detailed product analytics: generally 90 days, then erased or aggregated;
• pseudonymised AI interaction logs: while required for quality, security and traceability of AI functions; necessity is reviewed periodically;
• support and general security logs: while required for handling the request, system security, abuse prevention or evidence;
• order, execution and audit evidence: as long as required for contract, disputes, security or legal evidence;
• accounting, invoice and payment records: generally 10 years after the relevant financial year.

10. Security

Safeguards include transport encryption, password hashing, encrypted storage of supported API keys, role-based access, logging, rate limits and backups. No system is risk-free. Users must also protect their devices, broker accounts, API permissions and credentials.

11. Automated decisions

HuyMarkets may generate warnings, analyses and technical execution checks automatically. An economically or legally significant trading action is processed only within a function activated by the user and its defined rules. Users may disable automation and request human review through support where such a decision significantly affects them.

12. Individual rights

Within applicable law, individuals may request access, rectification, erasure, restriction, disclosure or portability and may object to processing or withdraw consent for the future. We may request proof of identity to prevent unauthorised disclosure.

Requests should be sent to support@huymarkets.com. Individuals may also complain to the Swiss Federal Data Protection and Information Commissioner or, where the GDPR applies, a competent EU supervisory authority.

13. Changes

We update this Policy when features, providers or law change. The current version and date are published here. Material changes affecting registered users will be communicated appropriately.