Privacy Policy

1. Who We Are

PacaTrader ("PacaTrader," "we," "us," or "our") operates a self-directed trading dashboard software platform accessible at http://PacaTrader.com (the "Service"). This Privacy Policy explains how we collect, use, store, disclose, and protect information about you ("User," "you") when you use our Service.

This Privacy Policy is incorporated into and subject to our Terms of Service. By using the Service, you agree to the practices described here.

2. Data We Collect

We collect the following categories of information:

We collect only the data reasonably necessary to operate, maintain, and improve the Service. We do not collect your Social Security number, government ID, or sensitive personal classifications (race, religion, health data, etc.).

3. How We Use Your Data

We use the information we collect for the following purposes:

• Providing the Service: Operating your account, processing your Alpaca API connections, executing orders you direct, running your Automations, and displaying your account data
• Security & fraud prevention: Authenticating logins, detecting unauthorized access, maintaining audit trails, and enforcing account safety
• Billing & subscriptions: Processing payments, managing subscription status, and communicating billing changes
• Support: Responding to your requests, troubleshooting issues, and diagnosing errors
• Service improvement: Analyzing usage patterns in aggregate to improve features, reliability, and performance
• Legal compliance: Complying with applicable laws, regulations, court orders, and lawful government requests
• Communications: Sending you service-related notices, security alerts, and — with your consent — product updates or announcements

We do not use your trading data, positions, or order history to develop, test, or train investment strategies for any third party.

4. Alpaca Credentials — Special Handling

Your Alpaca API keys, API secrets, and OAuth tokens are among the most sensitive data you provide. We treat them with the highest level of protection:

• Encryption at rest: API keys and OAuth tokens are encrypted using strong encryption before being stored in our database. They are never stored in plaintext.
• Encryption in transit: All data transmitted between your browser, our servers, and Alpaca's API is encrypted via TLS/HTTPS.
• Access controls: Credentials are accessed only by the systems and processes that require them to perform authorized API calls on your behalf. They are not accessible to general application code or staff without appropriate need.
• No display: Alpaca credentials and OAuth tokens are never displayed back to you in full after initial entry, and are never exposed in API responses, logs, or error messages.
• No sale or transfer: Your Alpaca credentials are never sold, shared with advertisers, or transferred to any third party except Alpaca itself (solely to authenticate your API requests).
• Revocation: You may disconnect your Alpaca account at any time from within the Service. Upon disconnection, stored credentials are deleted or invalidated. You should also independently revoke API keys and OAuth permissions directly within your Alpaca account.

5. Cookies & Tracking Technologies

PacaTrader uses cookies and similar technologies for the following limited purposes:

• Session cookies: Required to maintain your login session and keep you authenticated while you use the Service. These are deleted when you close your browser.
• Preference cookies: Store your display preferences (e.g., theme, layout settings) so they persist across sessions.
• Security cookies: Used to detect and prevent unauthorized access and CSRF attacks.

We do not use third-party advertising cookies, behavioral tracking pixels, or cross-site tracking technologies. We do not serve advertisements.

You can control cookies through your browser settings, but disabling essential cookies may prevent you from logging in or using core features of the Service.

6. Data Sharing & Disclosure

We do not sell, rent, or trade your personal data. We share your data only in the following limited circumstances:

• Alpaca: We transmit your API requests and orders to Alpaca's API as authorized by you. We do not share your PacaTrader account data with Alpaca beyond what is required for API authentication.
• Stripe: Your payment information is processed by Stripe. We share only the billing data necessary for Stripe to process your subscription. Stripe's privacy practices are governed by Stripe's Privacy Policy.
• Hosting & infrastructure providers: We use third-party hosting and cloud infrastructure providers to operate the Service. These providers process data on our behalf under data processing agreements and are not permitted to use your data for their own purposes.
• Legal requirements: We may disclose your data if required to do so by law, court order, subpoena, or lawful government request, or if we believe disclosure is necessary to protect rights, safety, or property of PacaTrader, our users, or the public.
• Business transfers: In the event of a merger, acquisition, or sale of all or substantially all of our assets, your data may be transferred to the successor entity. We will notify you via email or in-app notice before your data is transferred and becomes subject to a different privacy policy.
• With your consent: We may share your data with third parties when you have given us explicit consent to do so.

All third-party service providers who handle your data on our behalf are contractually required to protect it and use it only for the purposes for which it was shared.

7. No Sale of Personal Data

PacaTrader does not sell, and will never sell, your personal data, Alpaca credentials, OAuth tokens, trading data, or private account access to any third party for any purpose, including advertising, marketing, data brokering, or analytics.

If you are a California resident, please note that this policy means we do not engage in "sale" of personal information as defined under the California Consumer Privacy Act (CCPA) and its amendments.

8. Data Retention

We retain your personal data for as long as your account is active or as needed to provide the Service. Specifically:

• Account data is retained for the duration of your account and for up to 90 days after deletion to allow for recovery and fraud investigation, after which it is purged.
• Alpaca credentials are deleted promptly upon account disconnection or account deletion.
• Activity and audit logs are retained for up to 12 months to support security, troubleshooting, and dispute resolution, then purged.
• Billing records may be retained for up to 7 years as required by applicable law and accounting standards.
• Support communications are retained for up to 3 years to assist with ongoing issues and disputes.

After the applicable retention period, data is securely deleted or anonymized so that it can no longer be associated with you.

9. Security

We implement industry-standard security measures to protect your data, including:

• TLS/HTTPS encryption for all data in transit
• Encryption at rest for sensitive credentials and tokens
• Access controls and role-based permissions limiting who can access data
• Comprehensive activity and audit logging
• Regular security reviews and vulnerability monitoring
• Secure server configuration and hosting practices

However, no security system is impenetrable. While we work hard to protect your data, we cannot guarantee absolute security. You are responsible for maintaining the security of your account credentials and for promptly notifying us of any suspected unauthorized access.

In the event of a data breach that affects your personal information and requires notification under applicable law, we will notify you as required by law.

10. Your Rights & Choices

Depending on your location, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you
• Correction: Request correction of inaccurate or incomplete data
• Deletion: Request deletion of your account and associated personal data (subject to retention obligations noted above)
• Portability: Request a machine-readable export of data you provided to us
• Restriction: Request that we limit processing of your data in certain circumstances
• Objection: Object to certain processing activities
• Withdraw consent: Where processing is based on your consent, withdraw it at any time without affecting the lawfulness of prior processing

To exercise any of these rights, contact us at privacy@pacatrader.com. We will respond within 30 days. We may need to verify your identity before processing your request.

California residents (CCPA): You have the right to know what personal information we collect, disclose, and sell (we do not sell), and the right to non-discrimination for exercising your privacy rights.

EEA/UK residents (GDPR/UK GDPR): Our lawful basis for processing is (a) performance of a contract with you, (b) compliance with legal obligations, (c) our legitimate interests in operating and improving the Service, and (d) your consent where applicable. You have the right to lodge a complaint with your local supervisory authority.

11. Children's Privacy

The Service is not directed at individuals under the age of 18. We do not knowingly collect personal information from children under 18. If we become aware that we have collected personal data from a child under 18, we will delete it promptly. If you believe we have inadvertently collected such information, please contact us immediately at privacy@pacatrader.com.

12. International Users & Data Transfers

PacaTrader is operated in the United States. If you access the Service from outside the United States, your data may be transferred to, stored, and processed in the United States or other countries where our hosting providers maintain infrastructure. These countries may have data protection laws that differ from those in your country.

By using the Service, you consent to such transfers. Where required by applicable law (such as GDPR), we ensure that appropriate safeguards are in place for cross-border data transfers, including Standard Contractual Clauses.

13. Third-Party Links & Services

The Service may contain links to or integrations with third-party websites or services (such as Alpaca, Stripe, or market data providers). This Privacy Policy does not apply to those third-party services. We encourage you to review the privacy policies of any third-party service you use. PacaTrader is not responsible for the privacy practices of third parties.

14. Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the "Last updated" date at the top and, where appropriate, notify you by email or in-app notice.

Your continued use of the Service after the updated Privacy Policy takes effect constitutes your acceptance of the revised policy. If you do not agree, you must discontinue use of the Service and request account deletion.

15. Contact Us

For questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us:

We aim to respond to all privacy-related inquiries within 30 days.