Privacy Policy

Last Updated: July 2026  ·  Effective Date: July 2026

Welcome to Vessal ("we," "us," "our"). This Privacy Policy describes how Vessal, accessible at vessal.cc, collects, uses, shares, and protects your personal information when you use our website, platform, and related services (collectively, the "Services").

By accessing or using our Services, you agree to the collection and use of information in accordance with this policy. If you do not agree with this policy, please do not use our Services.

1. Information We Collect

1.1 Personal Information

When you create an account, subscribe to a plan, or contact us, we may collect:

  • Full name, email address, and phone number
  • Billing address and country of residence
  • Payment information (processed securely by Stripe — we never store card details)
  • Government-issued identification (for payout verification, if applicable)
  • Communication preferences and marketing consent

1.2 Trading & Account Data

When you use our evaluation and funded trading programs, we collect:

  • Trade execution data: entries, exits, timestamps, instruments, and position sizes
  • Account performance metrics: P&L, drawdown levels, daily results
  • Evaluation progress and rule compliance status
  • Account configuration and plan selection history

1.3 Automatically Collected Data

When you visit our website, we automatically collect:

  • IP address, browser type, operating system, and device information
  • Pages visited, time spent, referral sources, and click patterns
  • Cookies and similar tracking technologies (see Section 5)

2. How We Use Your Information

We use your information to:

  • Provide our Services: Create and manage your account, process subscriptions, and administer trading evaluations
  • Process payments: Charge subscription fees and disburse profit payouts via Stripe
  • Monitor compliance: Track trading rule adherence (drawdown, daily loss limits, profit targets)
  • Improve our platform: Analyze usage patterns, debug issues, and optimize user experience
  • Communicate with you: Send account updates, trading alerts, policy changes, and — with your consent — marketing materials
  • Prevent fraud: Detect suspicious activity, prohibited trading strategies, and multi-account abuse
  • Legal compliance: Fulfill legal obligations and respond to lawful requests

3. Third-Party Services

We use trusted third-party providers to deliver our Services:

3.1 Supabase (Authentication & Database)

We use Supabase for user authentication (login, registration, password management) and as our primary database for storing account data, trading metrics, and user preferences. Supabase processes your data under their own privacy policy and employs encryption at rest and in transit.

3.2 Stripe (Payment Processing)

All payment processing is handled by Stripe. When you subscribe to a plan or receive a payout, your payment information is transmitted directly to Stripe's PCI DSS Level 1 certified infrastructure. We never store your full credit card number, CVV, or bank account details on our servers. Please review Stripe's Privacy Policy for more information.

3.3 Other Services

We may also use third-party services for:

  • Analytics (e.g., Google Analytics) to understand website usage
  • Email delivery for transactional and marketing communications
  • Customer support platforms for ticket management
  • Cloud hosting infrastructure for service delivery

4. Data Sharing & Disclosure

We do not sell your personal information. We may share data in these circumstances:

  • Service Providers: With third parties who assist us in operating our Services (as described in Section 3)
  • Legal Requirements: When required by law, court order, or governmental authority
  • Business Transfers: In connection with a merger, acquisition, or sale of assets
  • Safety & Fraud Prevention: To protect the rights, safety, and property of Vessal and our users

5. Cookies & Local Storage

We use cookies and browser local storage to:

  • Essential cookies: Maintain your login session and authentication state (via Supabase auth tokens)
  • Preference cookies: Remember your theme preference (dark/light mode), language settings
  • localStorage: Store UI state, theme preferences, and cached dashboard data for performance
  • Analytics cookies: Track aggregate usage patterns (can be opted out of)

You can manage cookies through your browser settings. Disabling essential cookies may prevent you from using certain features of our platform.

6. Data Retention

We retain your data as follows:

  • Account data: Retained for the duration of your active account, plus 3 years after account closure for compliance purposes
  • Trading data: Retained for 5 years after the relevant trades for auditing and dispute resolution
  • Payment records: Retained for 7 years as required by financial regulations
  • Marketing preferences: Retained until you withdraw consent
  • Log data: Automatically purged after 12 months

7. Your Rights

7.1 Under GDPR (European Economic Area Residents)

If you are in the EEA, you have the right to:

  • Access: Request a copy of all personal data we hold about you
  • Rectification: Correct inaccurate or incomplete data
  • Erasure: Request deletion of your data ("right to be forgotten")
  • Restriction: Limit how we process your data
  • Portability: Receive your data in a structured, machine-readable format
  • Objection: Object to processing based on legitimate interests or marketing
  • Withdraw Consent: Withdraw consent at any time where processing is based on consent

7.2 Under CCPA (California Residents)

If you are a California resident, you have the right to:

  • Know: What personal information we collect, use, and disclose
  • Delete: Request deletion of your personal information
  • Opt-Out: Opt out of the sale of personal information (we do not sell personal information)
  • Non-Discrimination: Not be discriminated against for exercising your privacy rights

To exercise any of these rights, please contact us at privacy@vessal.cc. We will respond within 30 days (or as required by applicable law).

8. Data Security

We implement industry-standard security measures to protect your data, including:

  • TLS/SSL encryption for all data in transit
  • Encryption at rest for stored data via Supabase
  • Secure payment processing through Stripe's PCI DSS Level 1 infrastructure
  • Regular security audits and vulnerability assessments
  • Access controls and role-based permissions for internal staff

While we strive to protect your information, no method of electronic transmission or storage is 100% secure. We cannot guarantee absolute security.

9. International Data Transfers

Your data may be transferred to and processed in countries outside your country of residence. We ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) approved by the European Commission, when transferring data internationally.

10. Children's Privacy

Our Services are not intended for individuals under the age of 18. We do not knowingly collect personal information from minors. If we become aware that we have collected data from a child, we will promptly delete it.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on our website and updating the "Last Updated" date. Continued use of our Services after changes constitutes acceptance of the revised policy.

12. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or your personal data, please contact us: