Privacy Policy

Norviq, operator of norviqtrade.com, is the data controller for the personal data described in this policy.

Controller identity: NorviqTrade (enkeltmandsvirksomhed / sole proprietorship), CVR no. 46706218, VAT DK46706218, Gunderupvej 16, 9260 Gistrup, Denmark. Privacy contact: support@norviqtrade.com.

Norviq has not appointed a Data Protection Officer. We have assessed the criteria in Article 37 GDPR: Norviq is not a public authority, its core activity is not large-scale systematic monitoring of individuals, and it does not process special categories of data or criminal conviction data on a large scale. On that basis a DPO is not mandatory. Privacy questions go to support@norviqtrade.com, which is monitored by the business owner.

This policy covers personal data we process when you visit norviqtrade.com, create a Norviq account, and use the journal, analytics, broker synchronisation, growth tools, community, leaderboards and subscriptions.

• Email address and, for email sign-up, a password stored hashed by our authentication provider.
• Where you sign in with Google: the identity information Google returns to the authentication provider (such as email address, name and profile picture) and the linked provider identity.
• Account identifiers, sign-up and sign-in timestamps and email confirmation state.
• Role assignment (standard user, staff, owner).
• Account status (for example active, suspended or deactivated) and, where we set one, the reason shown to you. Deleting your account removes it entirely rather than leaving a permanent “deleted” status; see the account deletion section below.

Two-factor authentication (optional). If you turn on authenticator-app two-factor authentication (2FA), we store in our own database: the secret that lets your authenticator app and our server generate matching six-digit codes; up to 10 one-time backup codes, stored only as one-way hashes so we cannot read them back; records of when you completed 2FA for a sign-in and by which method (authenticator code or backup code); the time of the last accepted code (to stop a code being reused); and a counter of recent wrong attempts and any temporary lockout. This is used to protect your account, prevent unauthorised access and enforce our account security controls (legal basis: legitimate interests in account security, and performance of the contract). It is deleted when you turn 2FA off in Settings.

• Username, display name, avatar and cover images, bio, country, trading style, broker, prop firm, years of experience, website, X/Twitter handle and Discord handle — all optional except the username.
• Visibility preferences: public activity, leaderboard visibility, country display.
• Posts, comments, reactions, poll votes, follows, karma and engagement counts.
• Notifications and activity feed entries generated by your use of the platform.
• Moderation state held in a separate, staff-only table, and staff actions recorded in an audit log.

• Trading accounts you create: name, broker, account login and server, account type, currency, balance and equity snapshots, verification status, captured starting balance and any challenge/funded-account rules you configure.
• Trades: instrument, direction, entry and exit prices, size, stop loss and take profit, commission, swap, profit and loss, open and close timestamps, and (for synced trades) the broker deal identifier and verification flag.
• Journal content you add: notes, tags and screenshots you upload.
• Growth data: goals, habits and habit logs, challenges, progress and achievements.
• Leaderboard snapshots and derived ranking statistics.

If you connect a MetaTrader 4 or MetaTrader 5 account we store the provider, the broker server, the account login, the synchronisation state and error messages, an identifier for the synchronisation account created at MetaApi, and the broker credentials you supply.

Credentials are encrypted with AES-256-GCM before being stored and are never returned to the browser. They are used only to operate the synchronisation. We ask you to supply read-only (investor) credentials.

We store your plan tier, subscription status, current period end and the Stripe customer and subscription identifiers. Card details and full billing details are collected and processed by Stripe on its own systems; Norviq does not receive or store card numbers.

• Standard server and infrastructure logs generated by our hosting and database providers, which can include IP address, timestamps, user agent and requested paths.
• Client-side error reports (technical error details and the page where they occurred) sent to our development platform so we can fix faults.
• Interface preferences stored locally in your browser, such as dashboard tile layout and filters.
• A cookieless unique-visitor count. When a page loads, our own server derives a one-way, pseudonymous identifier using SHA-256 from your IP address, your browser's user-agent string and a secret key held only on our server, and stores that identifier together with the calendar date. It is designed not to identify visitors, is not linked to your account and is not used by Norviq to identify you. In this visitor-count system, we do not store your IP address, user-agent string, the page visited, a referrer or any cookie, local-storage value or persistent device or browser identifier. Standard infrastructure and server logs may separately contain technical information such as IP addresses and user-agent strings, as described above. This counting applies to all visitors, including people who are not signed in. It is used only to produce aggregate visitor totals (day, week, month, year, lifetime) in our internal owner dashboard. Those aggregate totals are plain numbers with no pseudonymous identifier attached and are kept indefinitely, while the pseudonymous records behind them are deleted on the schedule described under Data retention. Legal basis: our legitimate interest (Article 6(1)(f) GDPR) in understanding basic site usage in the least intrusive way available.

We do not operate any third-party web analytics product. There is no Google Analytics, Google Tag Manager, PostHog, Mixpanel, Hotjar, Plausible or comparable tool in the application.

Advertising measurement (Meta Pixel). We advertise Norviq on Meta's platforms (Facebook and Instagram) and use the Meta Pixel to measure how those adverts perform. When it is active, the pixel is loaded from Meta and reports page views, the creation of a Norviq account and the completion of a paid subscription (including the amount charged and its currency) to Meta Platforms Ireland Limited, together with the technical information Meta receives with any request to it, such as your IP address, browser information and any Meta cookies already present in your browser. We do not send Meta your name, email address, telephone number or any other customer-matching identifier, and we do not upload customer lists to Meta. Meta acts as an independent controller for its own purposes in respect of this data; see Meta's own privacy policy for how it processes it. Legal basis: your consent (Article 6(1)(a) GDPR). In the EU/EEA, the UK and Switzerland the pixel only loads after you accept it in our cookie banner, and you can withdraw that at any time via “Cookie settings” in the footer. Withdrawal stops further reporting; it does not undo reporting that already took place.

Web fonts are served from Norviq's own domain. Loading a page does not send a request to Google Fonts or any other font CDN.

• Providing the Service — accounts, journal, analytics, growth tools, community, notifications. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
• Broker synchronisation — connecting to and reading data from your trading account. Legal basis: contract, at your request.
• Subscriptions and payments — billing, plan entitlement, invoicing records. Legal basis: contract and legal obligation (accounting law).
• Public profile, leaderboards and community posting — displaying what you choose to publish. Legal basis: contract, plus your choices in the visibility settings.
• Security, abuse prevention, moderation and audit logging. Legal basis: legitimate interests (Art. 6(1)(f)) in keeping the platform safe and statistics trustworthy.
• Aggregated platform statistics shown on our homepage — number of traders, number of trades journaled, combined verified volume/profit and loss, and number of countries. These are computed from our own database, are aggregate totals only, and expose no individual trader name, account balance, P&L, trade or broker. They are product statistics, not visitor analytics, and they are never used for advertising, profiling or third-party tracking. Legal basis: legitimate interests.
• Service and security emails (confirmation, password reset). Legal basis: contract.

We do not carry out automated decision-making with legal or similarly significant effects, and we do not sell personal data.

• Supabase (via Lovable Cloud) — database, authentication, file storage and transactional authentication emails.
• Lovable — application hosting (served from Cloudflare's edge network), deployment, client error reporting and managed email delivery. Our Lovable workspace is on the Pro plan. Lovable's Data Processing Agreement is available for Business and Enterprise plans and does not apply to our account; our use of Lovable is governed by Lovable's Terms of Service and Privacy Policy.
• Stripe — payment processing and subscription management, including its hosted checkout and customer billing portal. Stripe acts as an independent controller for parts of this processing.
• MetaApi (Agilium Trade) — MetaTrader account synchronisation; receives the broker credentials and account details needed to connect, and returns account and trade data.
• Google — only if you choose to sign in with Google, in which case Google processes your identity data for that sign-in. Fonts are self-hosted, so no request is made to Google Fonts.

Our Discord server is operated by Discord and is outside this Service; anything you share there is governed by Discord's own policies.

We may also disclose data where legally required, or to establish, exercise or defend legal claims.

Sub-processors. The authoritative list of Lovable's sub-processors, including each provider's purpose and location, is published at trust.lovable.dev/subprocessors. The sub-processors directly relevant to Norviq are listed above: Supabase (database, authentication, file storage, provided through Lovable Cloud), Lovable and Cloudflare (application hosting, edge delivery and managed email), Stripe (payments, billing and tax calculation), MetaApi / Agilium Trade (MetaTrader 4 and 5 connectivity) and Google (only if you sign in with Google). We will update this policy before adding a new sub-processor that is not already covered by Lovable's published list.

Where a provider makes a data processing agreement part of the plan we subscribe to, that agreement governs the provider's obligations as a processor, its own sub-processors and the safeguards used for international transfers. Because our Lovable workspace is on the Pro plan, Lovable's Data Processing Agreement does not apply to our account; our use of Lovable is governed by Lovable's Terms of Service and Privacy Policy, which describe the international transfer safeguards in the section below.

Norviq is a global platform and our providers operate globally. We only state what we can actually verify from our own configuration:

• Database, authentication and file storage (Supabase via Lovable Cloud) — hosted in a single region inside the EU: AWS eu-west-1 (Ireland). Your journal, trades, account data and community content are stored there.
• Application hosting (Lovable / Cloudflare edge) — requests are served from the edge location nearest to you, worldwide. Processing is therefore not limited to the EU/EEA. Lovable's Privacy Policy states that transfers from the EEA use the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), with transfer impact assessments where required.
• Stripe — a global payment processor; payment and billing data is processed in and outside the EU/EEA, including in the United States.
• MetaApi (Agilium Trade) — our MetaTrader synchronisation accounts are provisioned in MetaApi's new-york region (United States), so broker credentials and trade history pass through infrastructure in the United States.
• Managed email delivery — Lovable manages the sending of account and transactional emails. Lovable does not publish a specific processing or storage location for this service.
• Google — only for Google sign-in; a global service.

We do not claim that all data is stored in the EU. Your core account and trading data sits in the EU, but hosting, payments and MetaTrader connectivity involve processing outside the EU/EEA. Each transfer relies on the safeguard documented by the provider concerned:

• Supabase (via Lovable Cloud) — our core account, trading and community data is hosted in AWS eu-west-1 (Ireland). For any processing outside the EEA, Lovable's Privacy Policy states that transfers from the EEA use the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), with transfer impact assessments where required.
• Lovable / Cloudflare — Lovable's Privacy Policy states that transfers from the EEA use the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), with transfer impact assessments where required. Cloudflare is also self-certified under the EU–US Data Privacy Framework.
• Stripe — the EU Standard Contractual Clauses in the Stripe data processing agreement. Stripe is also self-certified under the EU–US Data Privacy Framework.
• Google — Google is self-certified under the EU–US Data Privacy Framework and additionally offers the EU Standard Contractual Clauses.
• Lovable managed email delivery — Lovable does not publish a specific processing or storage location for this service. Where its processing entails a transfer from the EEA, Lovable's Privacy Policy states that it uses the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914), with transfer impact assessments where required.
• MetaApi (Agilium Trade) — the transfer safeguards set out in the standard data processing terms that apply to our account. MetaApi does not publish those clauses openly, so we do not state which specific mechanism applies; we have asked them to confirm in writing whether the EU Standard Contractual Clauses form part of those terms and will update this policy with their answer.

We keep the data you own for as long as your account exists, because the Service is built around a continuous performance history. When you delete your account, that data is deleted through the deletion flow described in the next section. Beyond that, the periods below are the ones we actually apply or that are imposed on us by law.

• Account, journal, trades, analytics, community content — kept until you delete the item, the trading account, or your Norviq account. Deletion runs immediately and is permanent.
• Trading account deletion — immediately and permanently deletes its broker connection, baseline ledger, leaderboard snapshots and all of its trades, including verified ones.
• Broker credentials — held encrypted only while the connection exists, and deleted with the connection.
• Two-factor data — the 2FA secret, backup-code hashes and 2FA sign-in records are deleted when you turn 2FA off in Settings, and with your account when you delete it. Verified-sign-in records expire automatically (24 hours after a backup-code sign-in, 30 days after an authenticator-code sign-in).
• Cookieless visitor-count records — pseudonymous daily records are deleted when their date is more than 400 days old, and a pseudonymous visitor record is deleted after more than 400 days without a further visit. Only anonymous aggregate numbers (an all-time count of unique visitors and a count per calendar day) are kept indefinitely.
• Payment, invoice and accounting records — retained by Stripe and by us for 5 years from the end of the financial year, as required by the Danish Bookkeeping Act (bogføringsloven).
• Moderation and abuse records — kept while needed to enforce the community rules and to defend legal claims, and reviewed at least yearly.
• Database backups — our database provider takes automated backups on a rolling schedule and overwrites them automatically as newer backups are taken. Deleted data disappears from backups once the older copies have been cycled out; we cannot restore individual deleted records from them.
• Infrastructure, security, error and email-delivery logs — held by our hosting, database, error-reporting and email-delivery providers. Lovable has confirmed in writing that it does not publish a retention period for email delivery and activity logs. Other logs are held for the limited periods set by the providers' own standard log-retention policies. We do not control those periods and do not use these logs to rebuild a deleted account.

No automated purge job runs inside the product itself: deletion is event-driven and happens when you delete something.

You can delete your entire Norviq account yourself, from Settings → Your data. The deletion runs immediately and covers:

• Your login, profile, username, avatar and cover images.
• All trading accounts, trades, journal notes, tags and uploaded screenshots, together with baseline ledger entries and leaderboard snapshots.
• Broker connections: the synchronisation account is undeployed and deleted at MetaApi and the encrypted credentials are destroyed.
• All of your community data — posts, comments, reactions, poll votes, follows and bookmarks are deleted outright. We do not keep anonymised "deleted user" placeholders in their place.
• Goals, habits, challenges, achievements, notifications and activity entries.
• Files stored in our storage buckets.
• Any active subscription is cancelled at Stripe so no further charges are made. Deletion does not refund an already-paid period; see the Terms.

Your username is released on deletion and may later be registered by someone else. We do not keep a record of deleted accounts for anti-abuse purposes.

You can also delete individual trading accounts and individual pieces of community content at any time. Backups held by our providers and records Stripe must keep for accounting purposes may persist for a limited period after erasure.

You can download a copy of your data yourself, from Settings → Your data. The export is a structured, machine-readable JSON file covering your profile, trading accounts, trades, journal entries, goals, habits, challenges, achievements, community content, notifications, preferences and subscription identifiers, plus a separate CSV of your trades.

For security, the export deliberately excludes secrets: it contains no password, no session or authentication token, no two-factor secret or backup codes and no broker credentials.

Under the GDPR you have the right to:

• Access your personal data and receive a copy.
• Have inaccurate data corrected — most profile and journal data is editable in the Service.
• Have your data erased.
• Restrict or object to processing based on legitimate interests.
• Data portability.
• Withdraw any consent you have given, without affecting prior processing.

We respond to requests within one month, as required by the GDPR. We may need to verify your identity first.

• All traffic is served over HTTPS.
• Database access is protected by row-level security policies scoped to the signed-in user.
• Broker credentials are encrypted with AES-256-GCM and never exposed to the browser.
• Privileged operations run server-side; administrative actions are logged.
• Optional two-factor authentication (authenticator app) and one-time backup codes. Wrong codes are limited on our server: after 5 wrong codes verification is blocked for 1 minute, and each further lockout doubles the wait, up to 1 hour. Once 2FA is on, access to your data and account actions is refused until you complete it for that sign-in. A backup code completes 2FA for that sign-in only and does not turn 2FA off. Turning 2FA off requires a current code or an unused backup code.
• Accounts that are suspended, deactivated or deleted by us or by you are signed out and blocked from changing data in the Service.
• Payment card data is handled solely by Stripe.

No system is perfectly secure. Please use a strong, unique password, turn on two-factor authentication in Settings, keep your backup codes somewhere safe, and only ever supply read-only broker credentials. If you lose both your authenticator and your backup codes, contact us; we will need to verify your identity before resetting 2FA.

The Service is not intended for anyone under 18 and we do not knowingly collect data from children. If you believe a minor has created an account, contact us and we will remove it.

If you believe we have handled your data unlawfully you can lodge a complaint with your local supervisory authority. In Denmark this is Datatilsynet (the Danish Data Protection Agency), Carl Jacobsens Vej 35, 2500 Valby, datatilsynet.dk. We would appreciate the chance to address your concern first.

We update this policy as the Service evolves. The date at the top shows the current version, and we will notify you of material changes through the Service or by email.

Privacy requests and any other question about this policy: support@norviqtrade.com. The same address is used for support and legal notices. General contact details are on the Contact page.