1. Controller
Georg Steinbauer, Erlenweg 46, 8530 Deutschlandsberg, Austria. Email: support@thefundedpilot.com
2. Data we process
- Account data: name, email address and password (stored only as a secure hash by our login provider).
- Personal details: date of birth, address, country and optional phone number.
- Identity verification (KYC): photos or scans of your ID document, a selfie and optionally a proof of address.
- Trading data: trading login and server, balance, equity, trades and rule violations. Your trading password is stored encrypted.
- Purchase data: order number, product and amount. Card details are handled by the checkout provider and never reach us.
- Technical data: IP address and browser information in server logs, and the cookies needed to keep you logged in.
3. Purposes and legal bases
- Providing evaluations, the dashboard, rule monitoring and payouts: performance of a contract (Art. 6(1)(b) GDPR).
- Identity verification, fraud and money-laundering prevention, accounting and tax records: legal obligations (Art. 6(1)(c) GDPR) and our legitimate interest in preventing fraud (Art. 6(1)(f) GDPR).
- Service emails about your account (e.g. account ready, passed, failed, KYC status): performance of a contract (Art. 6(1)(b) GDPR). We do not send marketing emails without your consent.
- Waitlist and launch news: when you register before our launch, your sign-up order decides your place on the waitlist (performance of a contract, Art. 6(1)(b) GDPR). Launch news and offers are only sent if you tick the optional box at sign-up (consent, Art. 6(1)(a) GDPR); you can withdraw it at any time by email or via the link in each email.
- Launch giveaway: when you spin the giveaway wheel, we store your result, your tickets, who invited you (if you used an invite link) and, if you win, that you won. We use this to run the draw, notify winners and prevent fraud (performance of the giveaway, Art. 6(1)(b) GDPR, and our legitimate interest in preventing fraud, Art. 6(1)(f) GDPR). Taking part requires a newsletter subscription (consent, Art. 6(1)(a) GDPR), which you can withdraw at any time without losing your tickets. See the Giveaway Rules.
- Security of our systems and server logs: legitimate interest (Art. 6(1)(f) GDPR).
4. Service providers
We use the following processors, bound by data processing agreements. Where data is transferred outside the EU/EEA (*), this is based on an adequacy decision of the European Commission (e.g. the EU-U.S. Data Privacy Framework) or EU Standard Contractual Clauses.
| Provider | Purpose | Location |
|---|---|---|
| Supabase | Database, login and private document storage | EU (Frankfurt, Germany) |
| MetaApi (Agilium) | Connection to your trading account, trade and equity data | outside the EU* |
| Shopify | Online shop and checkout | EU / outside the EU* |
| Shopify Payments, PayPal | Payment processing (independent controllers for the payment) | EU / outside the EU* |
| Vercel | Website hosting | EU / outside the EU* |
| Resend | Sending transactional emails | EU (Ireland) |
| Cloudflare | Domain, DNS, email forwarding and bot protection at sign-up and login (Turnstile) | global network* |
5. How long we keep data
- Account and trading data: for as long as your account exists.
- KYC documents: for the duration of the business relationship and up to 5 years after it ends, where anti-money-laundering rules require it.
- Invoices and accounting records: 7 years (Austrian tax law, § 132 BAO).
- Rule violations: as long as needed to handle disputes and legal claims.
6. Cookies
On thefundedpilot.com we only use cookies that are technically necessary to keep you logged in and secure. We do not use analytics, advertising or tracking cookies. These cookies do not require consent (§ 165 (3) TKG 2021, Art. 5 (3) ePrivacy Directive).
| Cookie | Purpose | Duration |
|---|---|---|
| sb-…-auth-token | Keeps you logged in to the dashboard (Supabase) | Until you log out, max. 1 year |
| fp_ref | Remembers the invite link you came from, so the person who invited you gets their giveaway ticket | 30 days |
| __cf_bm, cf_clearance | Protection against bots and attacks (Cloudflare), only if needed | 30 minutes to 1 year |
The checkout runs in our Shopify store, which uses its own cookies and its own cookie banner. There you can choose which optional cookies you allow.
7. Security
Data is transferred encrypted (HTTPS). Every customer can only access their own data; this is enforced directly in the database. KYC documents are stored in a private storage area and can only be opened by authorised staff through links that expire after a few minutes. Trading passwords are stored encrypted (AES-256).
8. Your rights
You have the right to access, rectification, erasure, restriction of processing, data portability and to object to processing based on legitimate interests. To exercise your rights, email support@thefundedpilot.com. You can also lodge a complaint with a supervisory authority, in Austria the Österreichische Datenschutzbehörde, Barichgasse 40–42, 1030 Vienna, Austria (dsb.gv.at).
9. Changes
We update this policy when our services or legal requirements change. The current version is always available on this page.