Privacy policy

1. Who we are

PropTector ("PropTector", "we", "us") is registered in the Netherlands, Chamber of Commerce number 94494037, VAT number NL005087819B07. PropTector is responsible for the personal data described in this policy and can be reached at hello@proptector.com.

For questions about this policy or your personal data, contact us at hello@proptector.com.

2. What this policy covers

This policy explains how we handle personal data in three situations:

• Website visitors: people who visit proptector.com, use the live demo or fill in the contact form.
• Business contacts: people who work at prop firms we talk to, work with or invoice.
• Trader data: personal data of traders that our client firms send to PropTector so we can review payout requests for them. For this data, the client firm decides what is processed and why, and we act on its instructions (see section 5).

3. What data we collect

From website visitors and business contacts

• Contact details you give us: name, work email, firm name, role and firm website.
• Information you choose to share in the form, such as payout volume, markets, platforms and your message.
• Booking details if you schedule a call: the selected time and your time zone.
• Emails and call notes when you talk to us.
• Basic technical data: IP address, browser type, device type, pages visited and referring website.

The live demo uses fictional data only. Account numbers you type into the demo are used to generate a simulated result in your browser and are not stored.

From client firms (trader data)

Depending on the services a firm uses, this can include: name, email address, country, identity document details, payment method details (such as card holder name and the last four digits of a card), IP addresses, device identifiers, login times, trading accounts, trade history and payout requests.

We do not ask for full card numbers and we do not use trader data for our own marketing.

4. Why we use your data and on what legal basis

5. Trader data: controller and processor roles

When a prop firm uses PropTector to review payouts, that firm is the controller of its traders' data and PropTector is the processor. We process trader data only:

• on the documented instructions of the client firm,
• under a data processing agreement with that firm, and
• for the purpose of providing the services the firm has ordered.

Traders who want to exercise their privacy rights should contact the prop firm they have an account with. If a trader contacts us directly, we will pass the request on to the relevant firm.

Cross-firm detection. If we offer cross-firm detection, it will only apply to firms that opt in, will only use the data fields those firms agree to share, and will be described in the data processing agreement before it is used.

Decisions about traders. PropTector produces evidence and a recommended verdict. The final decision on a payout is made by the client firm. By default, PropTector provides the verdict and the firm decides what to do with it. A firm can choose to apply verdicts automatically. In that case, the firm is responsible for making sure this is allowed under data protection law, including informing its traders and giving them a way to ask for a human review of the decision.

6. Who we share data with

We do not sell personal data. We share it only with:

• Service providers that help us run PropTector, such as hosting, email and scheduling providers. They may only use the data to provide their service to us. For example, we use Google Workspace for email and documents, and Vercel for hosting the website and platform. A current list of providers is available on request.
• Professional advisers such as accountants and lawyers, where needed.
• Authorities, when the law requires it.
• A buyer or successor, if PropTector is sold or merged, under the same protections as this policy.

Client firms receive a list of the sub-processors that handle their trader data and are told before we add a new one.

7. International transfers

Some of our providers, including Vercel and Google, are based in the United States. If data is transferred outside the EEA, we use an adequacy decision or the European Commission's Standard Contractual Clauses, with extra safeguards where needed.

8. How long we keep data

• Contact form and sales conversations: up to 24 months after our last contact, unless you become a client.
• Client contract and invoicing records: 7 years, as required by Dutch tax law.
• Trader data: for as long as the client firm instructs. When a contract ends, we delete or return trader data within 30 days, unless the law requires us to keep it.
• Backups: deleted automatically within 35 days.

9. How we protect data

We use technical and organisational measures to protect personal data, including encryption, access control and logging. More detail is on our Security page.

10. Your rights

If you are in the EEA or the UK, you have the right to:

• access the personal data we hold about you,
• have incorrect data corrected,
• have your data deleted,
• restrict or object to how we use it,
• receive your data in a portable format, and
• withdraw consent at any time, where we rely on consent.

To use these rights, email hello@proptector.com. We reply within one month. We may ask you to confirm your identity first.

You can also file a complaint with a data protection authority. In the Netherlands this is the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl).

11. Cookies

We only use cookies that are needed for the website to work. We do not use analytics, tracking or advertising cookies.

12. Children

Our website and services are for businesses. They are not meant for anyone under 18, and we do not knowingly collect their data.

13. Changes to this policy

We may update this policy. The date at the top shows when it last changed. If we make significant changes, we will tell client firms in advance.

14. Contact

Privacy questions: hello@proptector.com
PropTector, the Netherlands

Terms of service

1. About these terms

These terms apply to the use of the PropTector services by business customers ("Customer", "you") and are agreed with PropTector, registered in the Netherlands, Chamber of Commerce number 94494037, VAT number NL005087819B07 ("PropTector", "we", "us").

The specific services, fees and term are set out in an order form or written proposal ("Order"). If an Order and these terms conflict, the Order applies. Your own general terms and conditions do not apply.

PropTector is for businesses only. It is not offered to consumers.

2. The website and live demo

Anyone may use proptector.com and the live demo. All accounts, names, amounts and results in the demo are fictional, including results generated for account numbers you type in. Demo results are not a review of any real account and must not be relied on for any decision.

3. The services

PropTector provides software and related services for prop trading firms, which may include:

• automated payout reviews using KYC, payment, IP, device and trading data,
• retroactive payout audits,
• data analysis and reporting,
• reputation management, and
• premium email services.

What is included for you is described in your Order. We may improve or change features over time, as long as the service you ordered is not materially reduced during your term.

4. Accounts and access

• You are responsible for everyone who uses PropTector through your account.
• Keep login details confidential and tell us straight away at hello@proptector.com if you suspect unauthorised access.
• Only give access to your own staff and contractors who need it.

5. Your responsibilities

You confirm that:

• you have a lawful basis to share trader data with PropTector and have informed your traders as required by law,
• the rules you configure (such as news windows, hold times and accounts per device) match your own trader agreements,
• the data you send us is accurate to the best of your knowledge, and
• you will use PropTector in line with applicable laws, including data protection and anti-discrimination laws.

6. Verdicts are recommendations

PropTector produces evidence and a recommended verdict based on the data you provide and the rules you configure. You remain responsible for:

• the final decision on every payout,
• reviewing cases before acting on them where your policies or the law require human review, and
• all communication with your traders, including emails sent in your name through our email service.

PropTector does not guarantee that every rule breach or fraudulent account will be detected, or that every flagged account has broken a rule.

7. Acceptable use

You must not:

• use PropTector for any unlawful purpose,
• try to access data belonging to other customers,
• test, scan or attack our systems without written permission (see our Security page for responsible disclosure),
• copy, resell or reverse engineer the software, or
• upload malware or data you have no right to share.

We may suspend access if you break these rules or if suspension is needed to protect the service or other customers. We will tell you why, where the law allows.

8. Fees and payment

• Fees are set out in your Order and exclude VAT unless stated otherwise.
• Unless the Order says otherwise, we invoice monthly in advance and invoices are due within 14 days.
• If an invoice is more than 30 days overdue, we may suspend the service after giving you written notice.
• We may change fees at renewal by giving at least 30 days' notice.

9. Your data and confidentiality

• You keep ownership of all data you send to PropTector ("Customer Data").
• We only use Customer Data to provide and support the services, and to improve the service in a form that does not identify you or your traders.
• Both parties will keep the other party's confidential information secret and only use it for this agreement. This does not apply to information that is public, already known or legally required to be disclosed.

10. Data protection

Where we process personal data on your behalf, we do so as your processor under a data processing agreement ("DPA"), which forms part of these terms. The DPA covers our security measures, sub-processors, breach notification, audits and deletion of data at the end of the contract.

Cross-firm detection is only used if you opt in, and only under the conditions set out in the DPA.

11. Intellectual property

PropTector, including the software, design, brand, the Tec mascot and all reports and templates we provide, belongs to us or our licensors. During your term you may use the service and the reports it produces for your own business. Reports generated from your data may be kept and used by you after the term ends.

If you give us feedback, we may use it to improve PropTector without any obligation to you.

12. Availability and support

We aim to keep PropTector available at all times, apart from planned maintenance, which we announce in advance where possible. Support is available by email at hello@proptector.com between 09:00 and 17:00 Dutch time (CET/CEST), seven days a week. Any specific service levels are set out in your Order.

13. Warranties

We will provide the services with reasonable care and skill. Apart from what is stated in these terms, the services are provided "as is" and we do not give other warranties, such as fitness for a particular purpose.

14. Limitation of liability

• Our total liability under this agreement is limited to the fees you paid in the 12 months before the event that caused the claim.
• We are not liable for indirect or consequential loss, including lost profits, lost revenue, payouts made or withheld based on your decisions, or loss of goodwill.
• These limits do not apply to liability that cannot be limited by law, including liability for intent or deliberate recklessness.

15. Indemnity

You will compensate us for claims from third parties, including your traders, that arise from your decisions about payouts, your trader agreements or your breach of section 5.

16. Term and termination

• The agreement starts on the date in your Order and runs for the term stated there. Unless the Order says otherwise, it renews for the same period unless either party cancels in writing at least 30 days before the end of the term.
• Either party may end the agreement straight away by written notice if the other party seriously breaches these terms and does not fix the breach within 30 days, or becomes insolvent.
• When the agreement ends, your access stops. You can ask for an export of your data within 30 days, after which we delete it as described in the DPA.

17. Changes to these terms

We may update these terms. We will give at least 30 days' notice of changes that affect you. Changes apply from your next renewal, unless the law requires otherwise.

18. Governing law

These terms are governed by the laws of the Netherlands. Disputes will be settled by the competent court in the district where PropTector has its registered office.

19. Contact

hello@proptector.com
PropTector, the Netherlands

Security

Prop firms trust us with sensitive trader data. This page explains how we protect it.

Data isolation

Each firm's data is kept separate from other firms' data using row-level security in our database, so every request can only read and write the data of the firm it belongs to. Firms cannot see each other's traders, accounts or results. Cross-firm analysis only happens for firms that opt in, and only on the data fields they agree to share.

Access control

• Firm users sign in with individual accounts. Two-factor authentication is available.
• Each user gets a role that limits what they can see and do.
• PropTector staff only access customer data when needed for support or to fix a problem, and that access is logged.

Audit trail

Every verdict, rule change and reviewer action is recorded with a timestamp and the user who made it. Firms can request an export of this history.

Hosting and backups

We aim to restore service within 48 hours after a major incident.

Secure development

• Code changes are reviewed before release.
• Dependencies are monitored and updated when security fixes are released.
• Production credentials are stored in a secrets manager, not in code.

Incident response

If we become aware of a security incident affecting your data, we will notify you without undue delay and within 48 hours, share what we know, and keep you updated while we fix it. This supports your own obligation to report breaches within 72 hours under the GDPR.

Data retention and deletion

Trader data is kept for as long as your firm instructs. When a contract ends, we delete or return it within 30 days. Backups are removed automatically within 35 days.

Reporting a vulnerability

If you find a security issue, email hello@proptector.com with a description and steps to reproduce it. We acknowledge reports within two business days. Please give us reasonable time to fix the issue before sharing it publicly, and do not access, change or delete data that is not yours while testing. We will not take legal action against researchers who follow these guidelines in good faith.