Order Dynamics Markets — Privacy Policy

Version: privacy-v1
Effective from: 2026-11-01
Binding language: English. Any translation is provided for convenience only.

1. What this covers, and who is responsible

This policy describes how we process personal data on markets.orderdynamics.io — both the public website and the platform behind your login.

Controller within the meaning of Art. 4 (7) GDPR is Order Dynamics GmbH, Geschwister-Scholl-Strasse 109, 20251 Hamburg, Germany, trading as Order Dynamics Markets. The full company details are in the Legal Notice at /imprint. Contact for all data-protection matters: legal@orderdynamics.io.

Data protection officer. We have not appointed a data protection officer because we are not required to: fewer than 20 people are constantly engaged in the automated processing of personal data (§ 38 (1) German Federal Data Protection Act, BDSG), and our core activities consist neither of large-scale, regular and systematic monitoring of individuals nor of large-scale processing of special categories of personal data (Art. 37 (1) GDPR). All data-protection questions go to legal@orderdynamics.io.

2. The short version

We hold three kinds of data about you: who you are, how your Alpaca account is connected and what we did in it, and what you did on the Platform. The second kind is the most sensitive. It exists because we cannot size or place an order without knowing the value of your account.

Your Alpaca account stays with Alpaca. We store an encrypted API key for it, and we read balances and positions from Alpaca when we need them. We do not receive your Alpaca password.

We do not use analytics, advertising or tracking technologies, and we do not sell personal data.

3. Visiting the website

When you open a page, our hosting provider processes the technical data your browser sends — IP address, time, requested page, browser type — to deliver the page and protect the service. These server logs are kept for a short period and are not combined with your account.

Legal basis: Art. 6 (1) (f) GDPR, our legitimate interest being the secure and stable operation of the website.

Early-access list. If you asked for early access before opening an account, we store your email address, the role you chose, your note and the time of your consent, and link the entry to your account once you open one. Legal basis: Art. 6 (1) (a) GDPR. You can withdraw your consent at any time by writing to us.

4. Account and access data

To give you an account we process your name, your email address, your password in hashed form, the role you joined in (investor or strategy provider), your time zone and your account state.

If you enable two-factor authentication we store the secret for your authenticator app in encrypted form, and your recovery codes in hashed form. If you add a passkey, we store its public key, its identifier, the name you give it (by default your device and browser, such as "Mac · Safari"), whether it is synced across your devices, a usage counter and the times it was added and last used. The private key stays on your device or in your password manager; we never receive it, nor your fingerprint, face or device PIN. You can remove a passkey at any time under Security. We store session records with the time of creation and last use, the IP address and the browser of each session, and the time of your last sign-in.

Purpose: providing the account, and protecting it. Legal basis: Art. 6 (1) (b) GDPR for the contract; Art. 6 (1) (f) GDPR for security, our legitimate interest being the prevention of unauthorised access.

5. Your Alpaca account and your orders

This is the part that goes beyond an ordinary web service, so we set it out in full. When you connect an Alpaca account, we process:

• your API key ID and secret, encrypted with AES-256-GCM under a key that is held separately from the database. We show only the last characters of the key ID in the interface;
• the account number, its status, its currency, and whether it is a paper or live account;
• account value, cash and buying power, and your positions, read from Alpaca when an order is sized or when you open your account view. We do not keep a copy of your full account. Positions include those you opened yourself, because Alpaca reports them; we use them only to make sure we never touch them;
• the orders we prepared or placed for you: strategy, signal, instrument, side, quantity, status, Alpaca's order reference, filled quantity and price, and the times at which you released or declined an order;
• your settings: default position size, and per strategy whether it is on, its own position size, and approval or automatic mode;
• the last error Alpaca returned, so that you and we can see why an order or a connection failed.

Purpose: delivering the Services — sizing, placing and tracking orders, and showing you your holdings and their performance. Legal basis: Art. 6 (1) (b) GDPR. Without these data the Services cannot be provided.

Alpaca is not our processor. It provides your brokerage account under your own agreement with it and processes your data as an independent controller under its own privacy notice. We send Alpaca the orders described above.

6. Bundles, subscriptions and payments

We store which bundles you hold, since when, whether they are free or paid, and when you cancelled them.

Payments are processed under Stripe's Managed Payments programme, with Stripe as merchant of record. The checkout is operated under the Link brand. When you buy a paid bundle, you enter your name, billing address, email address and payment details directly with Stripe. We do not receive or store your card or bank details.

Stripe returns to us what we need to grant access: a customer and subscription identifier, the bundles on your subscription, their status, the billing period, the amounts and the currency. We store an identifier that links your account to your Stripe customer record.

Legal basis: Art. 6 (1) (b) GDPR; Art. 6 (1) (c) GDPR where we must keep records under commercial and tax law.

Strategy providers see how many subscriptions their bundles have and the revenue those generate. They do not see who you are.

7. The assistant

Public assistant. When you use the assistant without being signed in, the text of your conversation is sent to Anthropic to generate the answer, together with the public content of our website. These conversations are not stored on the Platform. Please do not enter personal data that the assistant does not need.

Your personal assistant. When you are signed in, the assistant answers about your own account. For each question we read, from your account only, the data it needs to answer: your connected Alpaca account (balance, positions, orders and activities), your strategies and their settings, your signals, your bundles and invoices, and, if you are a strategy provider or administrator, the figures of that role. This data and your question are sent to Anthropic to generate the answer. Your conversations are stored in your account for 90 days so that you can continue them; you can delete each one, and switch the personal assistant off, at any time in your account.

Voice. If you talk with the assistant, your voice is sent to OpenAI to turn it into text, and the text of the answer is sent to ElevenLabs (or, if that is unavailable, to OpenAI) to read it aloud. Neither audio nor the spoken answer is stored by us. Where these services cannot be used, your browser's own speech recognition and voices are used instead, which its vendor (for example Google for Chrome or Apple for Safari) may process under its own terms.

Legal basis: Art. 6 (1) (b) GDPR where you use it as part of the Services; otherwise Art. 6 (1) (f) GDPR, our legitimate interest being to answer the question you asked.

8. Strategy providers

If you apply as a strategy provider, we process your company or trading name, your website, your application note and our review decision. Once approved, we process your strategies and bundles with their versions and review history, the signals you send, and the access tokens of the signal API in hashed form. For every API request we log the endpoint, the result, the IP address and the client. If you connect an AI assistant to our MCP server, we store the OAuth client and its tokens in hashed form.

Legal basis: Art. 6 (1) (b) GDPR; Art. 6 (1) (f) GDPR for the request log, our legitimate interest being the security of the signal API.

9. Email

We send transactional email — confirmation of your address, password resets, security notices, subscription confirmations and service messages — through Resend. For that purpose your email address and the content of the message are processed by Resend. We do not send newsletters from the Platform, and our emails contain no tracking pixels.

Legal basis: Art. 6 (1) (b) GDPR for service messages; Art. 6 (1) (f) GDPR for security notices.

10. Who processes data for us

Each acts on our instructions under a data-processing agreement, except Stripe, which acts as an independent controller for the payment itself. Where personal data reaches a country outside the EEA, the transfer is covered by the EU-US Data Privacy Framework where the recipient is certified, and otherwise by the European Commission's Standard Contractual Clauses.

11. Records we keep for security and proof

Audit events. State-changing actions on the Platform are recorded with the account concerned, the acting account, the action, the time, and the IP address and browser. This lets us reconstruct what happened to an account, including access by our staff, which is itself recorded.

Rate-limit counters. Short-lived counters that protect sign-in, sign-up and other sensitive paths from abuse.

Consent records. When you accept the Terms of Use, acknowledge the Risk Disclosure, are shown this Privacy Policy, ask us to start a paid bundle at once, or make the Declaration of Own Use, we record which document, which version, what kind of act, where and when, together with the IP address and browser. These records are what allow us — and you — to establish later what you agreed to. You can see them in your account under Legal.

Legal basis: Art. 6 (1) (f) GDPR for security; Art. 6 (1) (c) GDPR where we must be able to demonstrate compliance.

12. Cookies

We set only cookies that are strictly necessary: a session cookie that keeps you signed in and protects the session. We use no analytics or advertising cookies, so we do not ask for cookie consent. Details are in the Cookie Policy at /cookies.

13. How long we keep data

• Account and connection data — until your account is deleted. Your Alpaca key is deleted as soon as you disconnect or ask for deletion.
• Orders, subscriptions and billing records — subject to statutory retention periods under German commercial and tax law, currently up to ten years, because they document business transactions.
• Consent records and audit events — retained after your account is deleted, because their purpose is to establish what happened; IP address and browser are removed once they are no longer needed for that purpose.
• Session records, email links and rate-limit counters — removed when they expire, within hours or days.

Deleting your account. You can delete your account yourself under Account. Your Alpaca key is deleted at once. For 30 days you can restore the account by logging in; after that, or earlier if you choose, your personal data is erased. Orders, billing and consent records that we must keep are retained without your name, email address, IP address or browser, linked only to an anonymous placeholder.

14. Your rights

Under the GDPR you have the right to access your data, to have inaccurate data corrected, to erasure, to restriction of processing, to data portability, and to object to processing based on legitimate interests. Where processing rests on consent, you may withdraw it at any time with effect for the future. To exercise any of these rights, write to legal@orderdynamics.io.

You also have the right to lodge a complaint with a supervisory authority. The authority responsible for us is the **Hamburg Commissioner for Data Protection and Freedom of Information** (Der Hamburgische Beauftragte für Datenschutz und Informationsfreiheit, HmbBfDI), Ludwig-Erhard-Str. 22, 20459 Hamburg, Germany, phone +49 40 428 54-4040, mailbox@datenschutz.hamburg.de, https://datenschutz-hamburg.de. You may also contact the supervisory authority in the Member State of your residence or place of work.

15. Security

Traffic between your device and the Platform is encrypted in transit. Passwords, recovery codes and tokens are stored hashed; API keys and authenticator secrets are encrypted at rest. For passkeys we hold only the public key, which cannot be used to sign in. Access by our staff to customer data is restricted and recorded.

No method of transmission or storage is completely secure, and we do not claim otherwise.

16. Changes

We may update this policy. A new version is published at /privacy with a new version identifier, and the version you were shown remains retrievable at /legal/privacy/v/<version>. Where a change is material, we will tell you before it takes effect.

Contact: legal@orderdynamics.io