Privacy Policy

1. Controller

The controller responsible for data processing on this website is Tom Löbel (see the Imprint for the full address).
Email: contact@tlfx.trading

2. Hosting & Server Logs

The website is hosted on Netlify (Netlify, Inc., USA). When you visit, your browser transmits technical data (IP address, date and time, requested page, referrer, user agent) which is processed to deliver the site securely. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in a functioning, secure website).

3. The Statistics Tool & Data Delivery

The interactive tool runs in your browser. The free Nasdaq dataset is served as static files. Paid datasets and the account features are served by a Cloudflare Worker with object storage (R2), a key-value store (KV) and a database (D1) (Cloudflare, Inc., USA). Requests to the Worker process your IP address and the email/identifier associated with your session to deliver the data you are entitled to. Legal basis: Art. 6(1)(b) and (f) GDPR.

Live statistics requested by the ORBit Indicator for NinjaTrader 8 are computed by a query engine hosted by Fly.io, Inc. (USA). The request passes through our Worker first; the engine receives only the question itself (market, time window and the conditions you chose) — not your IP address, licence key or email.

4. Account & Passwordless Sign In

To access paid features you sign in with your email address using a one-time “magic link”. The link email is sent via Resend (Resend, Inc., USA). We store your email address, sign-in and subscription status. A login token is stored in your browser’s local storage to keep you signed in; you can remove it by logging out or clearing site data. Legal basis: Art. 6(1)(b) GDPR (performance of the contract) and Art. 6(1)(f) GDPR.

Optional notification emails. In your account (Notifications) you can switch on two emails: ORBit Releases — one email per release of the site and the tool with what is new — and New software versions — a notice when a new version of the ORBit software (the EA, the algo or a chart indicator) is released. Both are off by default, contain only release notes, are sent via Resend, and every message carries a one-click unsubscribe link; we store each switch and the time you set it. Legal basis: Art. 6(1)(a) GDPR (consent), which you can withdraw at any time via the switch or the link, with effect for the future.

5. Payments & Subscriptions

Subscriptions are processed by Stripe (Stripe, Inc., USA). When you subscribe, Stripe processes your payment and billing data directly under its own privacy policy; we receive only your email, subscription status and the plan you hold, which we store to grant access. Legal basis: Art. 6(1)(b) GDPR.

6. Device & Sharing Protection

To protect paid subscriptions against account sharing, the Worker records a coarse, non-identifying device fingerprint (derived from your browser and device characteristics) together with the IP, country, city and approximate location (an approximate latitude and longitude) of your requests, for a limited time. This is used only to detect and review unusual access patterns (for example the same account being used from far-apart places at once). Legal basis: Art. 6(1)(f) GDPR (legitimate interest in preventing abuse).

6a. ORBit Plan: Licence & Live Monitor

If you use the ORBit plan, the software in your trading terminal sends our Worker your licence key, your trading account number, the broker and server name, a pseudonymous identifier of the computer it runs on and, while it runs, a status report about once a minute: balance, equity, margin, open positions, today's result and closed trades. We also record the country and time of each licence check. We use this to verify the licence and the three-computer limit, and to show you the EA Monitor dashboard (including its halt command). Names you give accounts or computers are stored with it. Legal basis: Art. 6(1)(b) GDPR (providing the ORBit plan you subscribed to). This data is kept while your account exists; you can delete an account's monitor history from the dashboard at any time, or ask us to delete it.

The software also keeps its own log of today and yesterday on your computer. It is sent to us only when you press Send Logs in the EA Monitor: each running EA or Algo on that account then uploads that log, together with its settings and the account number, so we can investigate a problem you report. The log holds what the software printed (its decisions, orders and errors), never your licence key or balance. Legal basis: Art. 6(1)(b) GDPR (support for the ORBit plan, at your request). Uploaded logs are deleted automatically after 30 days.

7. Discord (Optional)

If you choose to connect your Discord account to receive a subscriber role, we process your Discord user ID and an OAuth token to apply and update that role via Discord’s Linked Roles feature (Discord Inc., USA). This happens only if you click “Connect Discord”. Legal basis: Art. 6(1)(a) GDPR (consent), withdrawable at any time by disconnecting.

8. Analytics

We use Pirsch (Pirsch Analytics, Germany), a privacy-friendly, cookieless analytics service that measures aggregate traffic without tracking individuals across sites. Legal basis: Art. 6(1)(f) GDPR.

9. Affiliate Links & Referral Program

This site may contain affiliate links (e.g. to prop firms, brokers or tools). If you click one and sign up, the third party may set cookies or use tracking parameters to attribute the referral, under its own privacy policy. ORBit Analytics does not receive your personal trading data from these partners.

We also run our own referral / affiliate program through Endorsely (Endorsely, USA). If you arrive through a referral link, Endorsely stores a referral identifier (for example in a cookie) so that a later subscription can be credited to the referrer; that identifier is passed to Stripe with your checkout. It is used only to attribute and pay referral commissions. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in operating the program) and, where a non-essential cookie is set, Art. 6(1)(a) GDPR (consent).

10. Reviews & Testimonials

If you submit a review, we process the review text, your chosen display name, any screenshot you upload and your account email (the email is used only to verify eligibility and prevent duplicate submissions). Once approved, the review text, display name and screenshot may be published on the Service; your email address is never shown publicly. Screenshots are stored in object storage (Cloudflare R2). Legal basis: Art. 6(1)(a) GDPR (consent, given when you submit) and Art. 6(1)(f) GDPR. You can withdraw consent and have your review removed at any time at contact@tlfx.trading.

11. International Transfers

Several processors above (Netlify, Cloudflare, Fly.io, Stripe, Resend, Discord, Endorsely) are based in the USA. Transfers are safeguarded by the EU-US Data Privacy Framework and/or the EU Standard Contractual Clauses, as applicable.

12. Retention

Account and subscription data is kept for as long as your account exists and as required by tax and commercial law thereafter. Server logs and sharing-protection records are kept only for a short period. Analytics data is aggregated.

13. Your Rights

You have the right to access, rectification, erasure, restriction, data portability and objection under the GDPR, and the right to lodge a complaint with a supervisory authority. To exercise any of these, contact contact@tlfx.trading.