Privacy policy
This policy explains what personal data we process when you use Piply, why, on what legal basis, who we share it with, and what rights you have.
AVA CONSULTING TRADING L.L.C-FZ is established in the United Arab Emirates. Because this service is offered to people in the European Union, the General Data Protection Regulation (EU) 2016/679 applies in full under Article 3(2)(a).
01
Data controller
- AVA CONSULTING TRADING L.L.C-FZ
- Meydan Grandstand, 6th floor, Meydan Road, Nad Al Sheba, Dubai, United Arab Emirates
- privacy@piply.es
- [TO BE APPOINTED — must be established in Spain and named here with contact details before publication]
- Not appointed. The conditions in Article 37(1) are not met. Use the data protection contact above.
You may address either us or our EU representative on any matter concerning the processing of your data.
02
What data we process
Data you give us
- Account data: email, password or Google identifier, language, internal user ID.
- MetaTrader investor password: a read-only credential. We use it once to link your account and then delete it. It is encrypted while held on our systems. It cannot place orders, withdraw funds or change anything on your account.
- Payout address: the address you save to receive your payments.
- Communications: the messages you send us through support.
- Journal content: the notes and tags you write about your trades.
Data we receive from your broker (Art. 14 GDPR)
Some of the data you see in Piply does not come from you. We receive it from your partner broker (Vantage Markets, VT Markets, StarTrader, PU Prime, Axi or RaiseFX, depending on where your account is held) once you have linked your account. The categories are:
- Closed trade history, including instrument, volume in lots, dates and outcome.
- Performance metrics calculated from that history.
- Volume and commission reconciliation data for your account and, where applicable, your referrals' accounts.
- The verification status of your broker account.
Data generated by use
- Technical data: IP address, device and browser type, access logs.
- Security data: interaction signals collected by the anti-abuse system protecting sign-up and sign-in.
- Measurement data: only if you have consented. See the cookie policy.
We do not process special categories of data (Article 9 GDPR). Please do not include health information, personal circumstances or any sensitive data in your journal notes, since that content is processed automatically.
03
Purposes and legal bases
- Performance of a contract (Art. 6(1)(b)). Without this data we cannot provide the service.
- Performance of a contract (Art. 6(1)(b)). This is the core function.
- Performance of a contract (Art. 6(1)(b)).
- Performance of a contract (Art. 6(1)(b)).
- Legitimate interests (Art. 6(1)(f)): protecting the service, its users and the integrity of the programme.
- Performance of a contract (Art. 6(1)(b)) and legitimate interests (Art. 6(1)(f)) in documenting the relationship.
- Consent (Art. 6(1)(a)), withdrawable at any time.
- Consent (Art. 6(1)(a)). You can withdraw it in any message.
- Legal obligation (Art. 6(1)(c)) and legitimate interests (Art. 6(1)(f)) in establishing and defending legal claims.
Where we rely on legitimate interests we have carried out and documented a balancing test against your rights and freedoms. You can ask us for a summary of it.
04
Profiling and the AI Coach
The Piply Coach is an artificial intelligence system. We tell you this under Article 50 of Regulation (EU) 2024/1689 (the AI Act). You are interacting with an AI system, not a person.
What it does
The Coach analyses trades you have already closed and your journal notes to surface patterns: entry times, position sizes, result streaks and untagged trades. It presents those patterns as figures and observations.
The logic involved
- Your closed trades are aggregated by dimensions such as day of week, market session, instrument and relative position size.
- Those aggregates are compared against each other to detect statistical deviations from your own historical average.
- An explanatory text is generated by a language model, working only from those figures and your notes.
Consequences for you
No automated decision produces legal effects concerning you or similarly significantly affects you. The Coach does not determine your level, your cashback rate, your eligibility, your access to any feature, or your account status. Your level depends solely on the volume of lots you have closed, through a fixed arithmetic calculation that is published. We therefore do not carry out automated individual decision-making within the meaning of Article 22 GDPR.
The Coach is an analytics tool. It does not provide investment advice, does not recommend trades and does not predict markets. It can be wrong. Every decision about your trading is yours alone.
Calculating performance metrics does constitute profiling within the meaning of Article 4(4) GDPR, since it evaluates aspects of your behaviour. The right to object described below therefore applies to it.
05
Who we share data with
- Partner broker. Receives the data needed for account attribution and commission reconciliation. Acts as an independent controller in respect of your contractual relationship with it.
- Authentication (Firebase), anti-abuse protection and server infrastructure. Acts as a processor.
- Website hosting and delivery. Acts as a processor.
- Generating the Coach's responses. Acts as a processor. Your data is not used to train models.
- Where legally required or necessary to establish or defend legal claims.
We do not sell your personal data and do not share it with third parties for advertising purposes.
The specific processor list and the contracting entities must be confirmed and itemised here before publication.
06
Processing outside the European Economic Area
This section separates two situations that are often conflated and that are treated differently in law.
1. Access from the United Arab Emirates
Your data is hosted on infrastructure located in the European Union. Our staff access it from the United Arab Emirates.
Under European Data Protection Board Guidelines 05/2021, that access is not an international transfer within the meaning of Chapter V GDPR, because no data is disclosed to a different controller or processor: it is the same controller accessing its own data.
That does not remove the risk. The United Arab Emirates has no adequacy decision from the European Commission. We therefore apply reinforced measures under Articles 5, 24, 32 and 48 GDPR: role-based access control, encryption, access logging, and an express policy of not complying with requests from third-country authorities that lack a basis in Union law or in an international agreement in force.
2. Disclosure to recipients in third countries
Disclosing data to your partner broker (Vantage Markets, VT Markets, StarTrader, PU Prime, Axi or RaiseFX) and to processors located outside the EEA is an international transfer. It is covered by the Standard Contractual Clauses approved by Commission Implementing Decision (EU) 2021/914, supplemented by a transfer impact assessment.
You can request a copy of the safeguards in place by writing to privacy@piply.es.
The Standard Contractual Clauses must be signed and the transfer impact assessment documented before publication. The contracting entity and country of each recipient must be confirmed.
07
How long we keep your data
- Deleted immediately after the account is linked.
- While the account is active, and 12 months after closure.
- While the account is active, and 12 months after closure.
- 90 days from each conversation.
- The period required by applicable accounting and tax rules.
- 24 months from the last exchange.
- 12 months.
After those periods the data is deleted or irreversibly anonymised, unless we need to retain it to establish or defend legal claims.
08
Your rights
- Access: confirmation of whether we process your data, and a copy of it.
- Rectification: correction of inaccurate data, or completion of incomplete data.
- Erasure: deletion of your data where one of the grounds in Article 17 applies.
- Restriction: suspension of processing in the cases set out in Article 18.
- Portability: receiving the data you provided in a structured, commonly used format, or having us transmit it to another controller.
- Withdrawal of consent: where processing is based on your consent, you can withdraw it at any time, as easily as you gave it. Withdrawal does not affect the lawfulness of processing before it.
Right to object
You have the right to object at any time, on grounds relating to your particular situation, to processing we carry out on the basis of our legitimate interests, including profiling. If you object, we will stop processing your data for that purpose unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or the processing is needed to establish or defend legal claims. Where processing is for direct marketing, your objection is absolute and no balancing applies.
To exercise any of these rights, write to privacy@piply.es or contact our EU representative. We will respond within one month, extendable by a further two months where a request is particularly complex, in which case we will tell you within the first month. Exercising these rights is free of charge.
09
Complaining to a supervisory authority
If you consider that the processing of your data infringes the GDPR, you can lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, your place of work, or the place of the alleged infringement.
- Agencia Española de Protección de Datos (AEPD) — C/ Jorge Juan, 6, 28001 Madrid — www.aepd.es
As we have no main establishment in the Union, there is no lead supervisory authority within the meaning of Article 56 GDPR. Any competent authority may deal with your complaint directly.
We would appreciate the chance to address the issue first, though that is not a precondition to complaining.
10
Security
- The MetaTrader investor password is encrypted while held on our systems and deleted once the account is linked.
- Access to production data is role-restricted and logged.
- Communications are encrypted in transit.
- Sign-up and sign-in are protected against automated access attempts.
No system is completely secure. If a breach of your data occurred that was likely to result in a high risk to your rights, we would tell you without undue delay under Article 34 GDPR.
11
Minors
Piply is not directed at people under 18 and we do not knowingly allow them to register. If you become aware that a minor has created an account, tell us and we will delete it.
12
Changes to this policy
If we change this policy materially, we will tell you by email or through a prominent notice in the service before the changes take effect. The date of the last update appears at the top of this document.