Drawdown Defender - Privacy Policy
Last updated: October 12, 2026
This Privacy Policy explains how Drawdown Defender LLC (“we”, “us”) collects, uses, shares and protects personal information when you use the Drawdown Defender website and service (the “Service”). Contact: support@drawdowndefender.com.
1. Information we collect
You give us:
- Account details: your email address and a password (we store only a one-way hash of it, using argon2id). If you sign in with Google we receive your Google account’s email address and a unique Google identifier; we do not receive your Google password.
- Trading-account sign-in details: for each trading account you connect, the platform, firm/server, account login and password (or equivalent credentials). These are stored encrypted (see Section 6).
- Protection settings: the drawdown rule, protection line and alert preferences you choose.
- Your confirmation that your firm permits the Service, with its wording, the time you gave it and your IP address at the time.
- Support messages you send us.
We collect when the Service runs:
- Trading-account data: account number, balance, equity, open positions and related figures read from your platform, and records of any protection action we take (for example, positions we closed and when).
- Connection and security records: sign-ins to your Drawdown Defender account (time, success or failure, IP address, and browser/user-agent details) our sign-ins to your trading accounts, and service logs. We use these to secure and operate the Service.
- Dedicated Network Route: A dedicated network address (IP) assigned to your account for platform connections through our proxy provider.
- Email records: a record of each email we send you (type, time, delivery status).
- Cookies: only strictly necessary cookies, for example to keep you signed in, protect forms, support Google sign-in and verify your sign-up. We do not use advertising or analytics cookies.
From payment processing: Stripe processes your payment. We receive your billing status, plan, invoices and a card’s brand and last four digits; we never receive or store your full card number.
2. How we use information
- To provide the Service: connect to your trading accounts, evaluate your drawdown, close positions where you have switched protection on, and alert you.
- To run your account and billing, and to send service emails (verification, sign-in notices, password resets, alerts, receipts).
- To keep the Service secure, prevent abuse, investigate problems, and meet legal obligations.
- We do not sell your personal information, share it for cross-context behavioral advertising, or use your trading data for our own trading.
3. How we share information
We share personal information only with service providers who process it for us, under contract, and only as needed:
| Provider | Purpose | Data involved |
|---|---|---|
| Hetzner Online | Servers and databases that run the Service | All Service data (encrypted credentials stay encrypted) |
| Amazon Web Services | Key management for credential encryption (KMS); sending email (SES); encrypted database backups (Amazon S3, United States) | Encryption keys never leave AWS; your email address and email content; encrypted database backups (Amazon S3, United States) |
| Stripe | Payments, tax, invoicing | Billing details, email address |
| Optional sign-in with Google | Your Google identity, if you choose it | |
| Decodo (or designated proxy provider) | A dedicated network address (IP) for connections to your trading accounts | Network traffic to your firm’s platform passes through it; the platform connection is encrypted |
| Uptime Monitoring Providers | Operational alerts | No customer personal data |
We also disclose information to the trading platform and your firm when we sign in and act on your account, because that is the Service. We may disclose information if required by law, to protect our rights or users’ safety, or in a merger or sale of the business (with notice to you).
4. Where information is processed
We are based in the United States. Our servers are operated by Hetzner in datacenters in Germany, and our other providers process data in the US and elsewhere. Where required by applicable law, cross-border transfers of personal data outside the European Economic Area (EEA) or UK rely on Standard Contractual Clauses (SCCs), with the UK International Data Transfer Addendum for transfers from the UK, or applicable adequacy decisions.
5. Retention and deletion
| Data | Kept |
|---|---|
| Your account, settings and trading-account data | Until you delete your account or remove the trading account. When you remove a trading account, its identifying details and trading data are cleared within 30 days; we keep a record of the protection actions we took, for disputes. |
| Your confirmation that your firm permits the Service | Kept until you delete your Drawdown Defender account, then anonymized. |
| Trading-account credentials | Until you remove the account or delete your Drawdown Defender account; then deleted from the live system immediately. |
| Backups | Copies of our database are kept for up to 37 days and then deleted, so deleted data can remain in backups until they expire. When you delete your Drawdown Defender account, the encryption key unique to you is destroyed, so backup copies of your trading-account credentials can no longer be read, unless the same trading login is still protected under another Drawdown Defender account. |
| Email records after you delete your account | Kept for up to 2 years for support, security and disputes, with your email address replaced by a keyed, one-way code (HMAC-SHA256); we can confirm whether an email was sent to a specific address if that address is given to us, but cannot list former customers’ addresses. |
| Billing records | Kept by us and Stripe as long as tax and accounting law requires (typically 7 years). |
| Security and service logs | Kept for up to 90 days, then deleted. |
When you delete your account we delete or anonymize your personal information, except what we must keep for legal, tax, security or dispute purposes as shown above.
6. Security
- Trading-account credentials are encrypted using envelope encryption: each customer’s credentials are encrypted with a key unique to that customer, and that key is itself encrypted by a master key held in Amazon Web Services Key Management Service, which never leaves AWS.
- Passwords are stored only as argon2id hashes. Connections to the Service use HTTPS.
- Access to production systems is restricted to authorized engineering personnel and automated processes.
- No system is perfectly secure. If a breach affects your personal information we will notify you and regulators as the law requires.
7. Your choices and rights
- You can view and update your account details in your Profile, remove trading accounts, and delete your account at any time. If you signed in with Google, you can also remove our access in your Google account settings.
- You can ask us for a copy of your personal information, or to correct or delete it, by emailing support@drawdowndefender.com. We will verify your identity before acting.
- California residents: you have rights under California law to know, delete and correct personal information, and to not be discriminated against for exercising them. We do not sell or share personal information for cross-context behavioral advertising as those terms are defined under the CCPA/CPRA.
- Do Not Track: we do not respond to browser “Do Not Track” signals, because we do not track you across other websites or over time.
- EU/UK residents: If you reside in the EEA or UK, our legal bases for processing include: (1) Contract Performance (to provide automated drawdown protection); (2) Legitimate Interests (to secure the platform and prevent fraud); and (3) Legal Obligations (for tax and accounting). You have the right to access, rectify, port, or erase your data, restrict or object to processing, and lodge a complaint with your local data protection supervisory authority.
8. Children
The Service is not for anyone under 18, and we do not knowingly collect information from them.
9. Changes
If we change this policy materially we will tell you by email or in the app before the change takes effect.
10. Contact
Drawdown Defender LLC · 455 Market St Ste 1940, PMB 607149, San Francisco, California 94105-2448, US · support@drawdowndefender.com
Drawdown Defender LLC is the controller of the personal information described in this policy.
Representative
We value your privacy and your rights as a data subject and have therefore appointed Prighter Group with its local partners as our privacy representative and your point of contact for the following regions:- European Union (EU)
- United Kingdom (UK)