Privacy Policy
Last updated: 27 May 2026
DeckLive is operated by Flow 88 Gestão de Activos, registered in Lisbon, Portugal. This Privacy Policy explains what data we collect, how we use it, who we share it with, and the rights you have under the EU General Data Protection Regulation (GDPR).
Who we are
DeckLive is a multi-account dashboard for traders. We operate the website at decklive.io and the application at app.decklive.io. The data controller is Flow 88 Gestão de Activos, Lisbon, Portugal.
Data we collect
When you sign up: your email address and a password (hashed with bcrypt — we never store it in clear text). When you connect a MetaTrader account: account number, broker server, label, prop firm, phase and initial balance. Your MetaTrader password is encrypted with AES-256 (Fernet) before being written to our database; the encryption key is stored separately from the database. When you use the dashboard: live equity, balance, floating P&L, open positions, drawdown values, trade history (fetched from your MetaTrader terminal at intervals of 1-2 seconds). When you visit the website: anonymous IP address, browser user-agent, an anti-abuse device fingerprint, and the country derived from your IP via ip-api.com. When you subscribe: billing email, postal address, VAT number if applicable, and the last 4 digits of your card (full card data is handled by Stripe and never touches our servers). When you connect Telegram: your Telegram chat ID and public username, used only to deliver alerts.
How we use your data
To operate the service: authenticate you, run your account monitoring workers, calculate drawdown buffers, and deliver alerts. To bill you: process subscription payments via Stripe and issue tax-compliant invoices via TOConline. To prevent abuse: limit free trials to one per device fingerprint and IP. To improve the product: aggregate anonymous usage metrics. We do not sell your data, ever.
Third parties we share data with
Stripe (payments, USA + EU): card processing, subscription management. Stripe is PCI-DSS Level 1 certified. Resend (transactional email, EU): verification, alerts, billing notifications. Cloudflare (CDN + DDoS protection, global): hosts decklive.io and proxies traffic to our origin. Hetzner (origin server, Germany): hosts the DeckLive application. Telegram (push notifications, global): delivers alerts when you opt in. TOConline (invoicing, Portugal): generates and stores tax invoices as required by Portuguese law. ip-api.com (IP geolocation, free tier): used only for anti-abuse classification (residential / mobile / datacenter / VPN). We never share your trading data, account credentials, equity, drawdown or P&L with any third party for marketing or analytics.
How long we keep your data
Account data: for as long as your account is active, plus 30 days after deletion. Snapshots and trade history: 90 days on Starter, 365 days on Pro, unlimited on Team. Billing records: 10 years (Portuguese tax law). Anonymous server logs: 30 days. After deletion or expiry, data is permanently erased from active databases and overwritten in backups within 90 days.
Your rights under GDPR
You can: access all data we hold about you (request via [email protected]); correct inaccurate data; export your data in machine-readable format (JSON); delete your account and all associated data; restrict or object to processing; lodge a complaint with the Portuguese Data Protection Authority (CNPD) or your local EU supervisory authority. We respond to requests within 30 days.
Cookies
We use only essential cookies required for the service to work: an authentication session cookie (HTTP-only, Secure, SameSite=Lax) and a language preference cookie. We do not use marketing, advertising or analytics cookies. No third-party trackers are loaded on decklive.io.
Security
MetaTrader passwords are encrypted with AES-256 (Fernet symmetric encryption) before being written to disk. The encryption key is stored in a separate file with restricted file-system permissions, not in the database. The DeckLive connector is read-only by design: it can only fetch balance, equity and positions, never send trade orders. We recommend using your MetaTrader investor (read-only) password instead of your master password for an additional layer of safety. All traffic is encrypted in transit with TLS 1.3 via Cloudflare.
Children
DeckLive is intended for users 18 years of age or older. We do not knowingly collect data from minors.
Changes to this policy
We will notify registered users by email at least 30 days before any material change to this Privacy Policy. The current version and the date of the last update are always available at decklive.io/privacy.