Legal
Privacy policy
We wrote this from our own database rather than from a template. Everything below is what the system actually does — including the parts that are less flattering than a template would have been.
Correction pending — please read. Two statements in this version are wrong and we are not going to leave them standing unmarked. (1) Our backups do not stay in Germany. They are sent to Cloudflare every six hours, encrypted on our own server before they leave it, and we do not currently restrict which of Cloudflare's regions holds them — so where this page says there is no second copy in another country, it is incorrect. (2) This page lists what we hold and does not mention practice trading. We do store your practice accounts, orders, fills, positions, price alerts and risk settings. A corrected version 1.1 saying both of these plainly has been prepared and is awaiting approval; this version stays here until then, because replacing a published policy is a decision and not an edit.
Who we are
RayTrading is operated by iSky Information Technology LLC, a company registered in the United Arab Emirates under licence number 1388197, with its registered address at Gal Business Center 06, Dubai, United Arab Emirates.
In this policy, “we” and “RayTrading” mean that company, and “you” means the person using the service.
You can reach us at [email protected]. That is the only contact channel we operate. We do not run a separate privacy or legal mailbox, and we do not publish a telephone number or postal address for support. If a dedicated privacy contact is ever required of us, we will create one and say so here before the requirement takes effect, rather than after.
What this policy covers
raytrading.ai, app.raytrading.ai, and the RayTrading mobile applications. It does not cover any website we link to; those services have their own policies and we have no control over them.
The information we hold
Each item below is a field that exists. Nothing is listed that we do not collect, and nothing we do collect has been left out.
Your account
| What | Why |
|---|---|
| Email address | It identifies the account and is how we contact you about it |
| Display name | Shown to you and to others in your organisation |
| Preferred language | English or Arabic, so the product speaks to you in one of them |
| Preferred time zone | So a market time means what you expect it to mean |
| Account status | Whether the account is active, suspended or closed |
| When it was created, and last used | Security, and knowing whether an account is dormant |
| Whether the email was verified | To confirm the address belongs to you |
That is the whole of it. We do not ask for or store your legal name, your postal address, your telephone number, your date of birth, your national identity number, your income, your net worth, or any financial account number. We are not required to collect them, because we do not hold your money and do not open accounts on your behalf.
Your password
Stored as an Argon2id hash — a one-way function designed to be expensive to attack. The stored value cannot be turned back into your password. We cannot read it, recover it, or tell it to you. If you lose it, it can only be reset, never retrieved.
Two-factor authentication
If you enable it, we store what is needed to verify your codes, and a set of single-use recovery codes. Recovery codes are stored in a form that lets us check one you present without our being able to read the list.
Sessions and sign-in security
For each session we record when it started, when it was last used, when it expires, whether and why it ended, and the level of authentication it holds. We also record a hash of the network address and a hash of the browser or app that started and last used it.
We do not store your IP address, and we do not store your browser identifier. We store one-way hashes of them. That is enough to notice a session has moved to a different network or device — which is what account security needs — while leaving us unable to reconstruct where you were or what you were using. It also means we cannot produce your browsing history if anyone asks, because we do not have it.
Devices, if you use the mobile app
Installation identifier, platform, app version, device language and time zone, and whether notifications are enabled. If you turn on push notifications, the push token is stored encrypted, alongside a fingerprint that lets us recognise a token we already hold without decrypting it.
Notifications
What we sent you and whether it was delivered, so a failed notification can be retried and a duplicate is not sent twice.
Your use of the product
Your organisation, your role in it, your settings and preferences, and the watchlists, saved views and configuration you create.
Security and administrative records
We keep an audit record of significant actions — sign-ins, permission changes, administrative operations — so that a security question can be answered afterwards. These are retained separately from your account content; see Deleting your account below.
What we do not collect
- No analytics. No Google Analytics, no product analytics tool, no session recording, no heatmaps, and no behavioural tracking of any kind.
- No advertising or marketing trackers. None. We run no advertising pixels, belong to no advertising network, and build no advertising profiles.
- No third-party tags at all. Our pages fetch nothing from any third party — not fonts, not scripts, not images. Everything comes from RayTrading’s own address.
- No location tracking. We use the time zone you chose. We do not use GPS, and we do not derive your location from your network address — which, as above, we do not keep.
Cookies
We use six. All six are set by RayTrading for the exact site you are visiting, and none can be read by any other site or by any third party.
| Cookie | What it does |
|---|---|
| rt_at | Keeps you signed in — essential |
| rt_rt | Renews your session without making you sign in again — essential |
| rt_csrf | Stops another site acting as you — essential, security |
| rt_tenant | Which organisation you are working in — essential |
| rt_locale | English or Arabic — preference |
| rt_tz | Your time zone — preference |
The first four cannot be read by the page’s own JavaScript. All six are sent only over an encrypted connection.
There is no cookie banner, and that is deliberate. Consent requirements attach to cookies that are not necessary for a service you asked for — analytics, advertising, cross-site tracking. We set none of those. The four essential cookies are what signing in consists of, and the two preference cookies store a choice you made in the interface. If we ever add a cookie that needs consent, we will ask for it then, rather than adding a banner now to look conventional.
Who else is involved
Three companies, and nobody else: the machine our software runs on, the network in front of it, and image generation.
Hetzner — hosting
The RayTrading application, its database, its file storage and its backups all run on a server operated by Hetzner Online GmbH in Nuremberg, Germany.
Cloudflare — the network in front
Cloudflare sits in front of our sites. It protects the service from attack and delivers pages efficiently, and every request you make reaches us through it.
We would rather be accurate than leave that implied: Cloudflare ends the encrypted connection at whichever of its locations is nearest to you — somewhere on its global network, not necessarily in Germany — and passes the request to our server. It therefore handles your connection, including your network address, in order to do that. Cloudflare acts on our instructions and is not permitted to use your information for its own purposes.
OpenAI — image generation
We use OpenAI to generate imagery used in the product. Image generation is the only approved use, and one image model is the only approved model.
No customer personal data is sent to OpenAI. Not your email address, not your name, not your account content, not your holdings, not your watchlists.
RayTrading also contains an analytical component designed to send market evidence — prices, measurements, published headlines, filing excerpts — to a language model. We describe it here because it is built, not because it is running: it has never run in production, no text model is approved for it, and its records are empty. When it does run, what it sends is market information identified by instrument and carries no user identifier — there is no field for one. If that changes, this policy will change before the behaviour does.
And the reverse, plainly, because it is what people reasonably fear: we do not send your holdings, your activity, or anything else about you to an AI provider. “The platform uses AI” does not mean your data is the input.
Nobody else
We do not sell your personal information. We do not share it with advertisers, data brokers or partners, and we do not disclose it for anyone else’s marketing. We may disclose information where the law requires it, or to protect the service and its users from fraud, abuse or a security threat.
Brokers, if you connect one
Broker connections are not yet available. When they are, connecting a broker will be your explicit choice, made for each broker, and what is exchanged will be described at the moment you make that choice — not in a policy you read months earlier.
Where your information is
Your information is stored in Germany. The database, the file storage and the backups are all on one server in Nuremberg. There is no second copy in another country and no other cloud region holds your data.
Your traffic, however, does not travel only through Germany. Requests reach us through Cloudflare’s global network, which handles your connection at whichever location is closest to you before passing it on. So your data is stored in Germany and transmitted through infrastructure outside it.
We are stating those two things separately on purpose. “All your data is in Germany” is the sentence a privacy policy usually reaches for here. In our case it would be true of storage and untrue of transit — so we have said which is which instead.
Our company is registered in the United Arab Emirates, so our own staff access the service from there. We have made no other commitment about where your data lives, and we would rather say so plainly than imply a guarantee we have not built.
How long we keep it
We do not currently operate fixed retention periods, and we are not going to invent one here. We hold your account and its content for as long as the account exists. When you delete your account, the erasure described below happens immediately rather than after a countdown.
We would rather tell you that than publish a “30 days” or “90 days” that nothing enforces. Setting and enforcing defined retention periods is work we still owe you, and this section will be replaced with specifics when they are real.
Deleting your account
You can delete your account yourself, from inside the product. This is not a request you email to us and wait on. You ask, you confirm your identity by answering a challenge, and it is carried out.
When it is, we erase what is yours and remove you as a person from what remains:
- Erased — your sessions, your registered devices, your credentials and two-factor factors, your preferences, watchlists and notifications
- Scrubbed — your identifying details are removed from records that must survive for security and integrity reasons. Those records continue to exist as records of an event, without identifying you
Some things are kept: security and audit records that exist to answer questions about an account’s history, and anything the law requires us to retain. That is why we describe this as erasing what is yours, removing the person, and keeping what the platform must keep — rather than promising total disappearance, which would not be true.
Deletion cannot be undone.
Your rights
Depending on where you live, you may have the right to ask for a copy of your information, to correct it, to have it deleted, to restrict or object to how we use it, and to complain to a data protection authority.
- Correction and deletion you can do yourself, inside the product
- For access and everything else, write to [email protected]
We will respond as promptly as we can. We have not committed to a fixed number of days, because we have not yet built a process that would guarantee one, and a deadline we promise and miss is worse than an honest “as promptly as we can”.
Which data protection law applies to you depends on where you are, and RayTrading is available in many countries. Our company is in the United Arab Emirates, our servers are in Germany, and our first commercial markets are the United States and Saudi Arabia. More than one regime may therefore apply, and which ones — and what each additionally requires of us — is a question we have put to legal counsel rather than answered ourselves.
This does not affect what you can do today. Whatever your jurisdiction, write to us and we will handle your request. We will name the applicable laws and the authority you may complain to once that advice is in, and we will not guess at them in the meantime.
Security
- Passwords are hashed with Argon2id
- Network addresses and device identifiers are stored only as one-way hashes
- Push notification tokens are encrypted
- All traffic is served over an encrypted connection, and every cookie is marked accordingly
- Authentication cookies cannot be read by page scripts and are scoped to a single site
- Every state-changing request carries cross-site request forgery protection
- Two-factor authentication is available, and we recommend it
- The customer product and the administrative console are separated at the routing and session layer: an administrative session cannot be used to enter the customer product, or the reverse
We do not promise that the service cannot be breached, and you should be sceptical of any service that does. No system is perfectly secure. What we can tell you is what we actually do, which is the list above.
We hold no security certification. We are not ISO 27001 certified, not SOC 2 audited, and hold no equivalent attestation. If we obtain one, we will say so and name the auditor.
Children
RayTrading is not intended for anyone under 18, and we do not knowingly collect information from children. If you believe a child has created an account, contact us and we will remove it.
Changes to this policy
We will post any change here and update the version and effective date at the top of the page. If a change materially affects how we handle your information, we will tell you directly rather than relying on you to notice.
iSky Information Technology LLC
Licence 1388197
Gal Business Center 06, Dubai, United Arab Emirates
This document has not been reviewed by a lawyer. Every factual statement in it was checked against the running system; which privacy laws apply to you, and what each additionally requires of us, is a question we have put to legal counsel and will answer here once we have their advice.