We collect the minimum needed to deliver and license the Software. Strategies, set files, and backtest reports never leave your machine. License activation and periodic validation — routed through Lemon Squeezy — are the only things we transmit. We don't sell or rent your data, ever.
§ 1Who we are
The data controller is INFINITYDEV, S.L. (NIF B-44974798), Plaça Jardí Enric Morera 2, 17600 Figueres, Girona, Spain. Data-protection contact: legal@trendsurfers.io.
§ 2What we collect
2.1 Website visitors
The TrendSurfers website is a static site hosted on Cloudflare Pages. We do not operate a web server, set cookies, or run analytics scripts. We do not have access to server-level access logs.
- Cloudflare infrastructure data — Cloudflare, Inc. may process IP addresses and request metadata as part of their CDN and DDoS protection service. This processing is governed by Cloudflare's own privacy policy; INFINITYDEV, S.L. does not receive or store this data.
- Email contact — if you email us directly, the contents and your reply-to address. We have no web-based contact form.
2.2 Buyers (via Lemon Squeezy)
Lemon Squeezy LLC is the Merchant of Record. It collects payment data, billing address, and tax identifiers directly; we do not receive your full payment details. From Lemon Squeezy we receive: order ID, purchase date, billing email, billing country (for VAT compliance), license key issued, and refund/chargeback events.
2.3 Software users
- License key and the one-way Hardware Fingerprint generated at activation. The Fingerprint is a hash of selected hardware identifiers — it cannot be reversed to its underlying components. Both are transmitted to Lemon Squeezy LLC (the Merchant of Record and license API provider) for activation and ongoing validation.
- License validation pings — periodic check via the Lemon Squeezy API whether the License Key is still valid (refunded keys are revoked).
The Software does not transmit your strategies, set files, EA parameters, backtest reports, MT5 credentials, broker information, account balances, or any trading data. These remain on your local machine.
2.4 Machine hardware fingerprint
On activation, the Software computes a one-way hardware fingerprint hash from a combination of: motherboard serial number, CPU identifier, Windows MachineGuid (registry), system-drive volume serial number, and Windows installation ID. The resulting hash is stored only as a hashed value — it cannot be reversed to reconstruct the underlying hardware identifiers.
- Categories of data processed: hardware fingerprint hash (a pseudonymous identifier derived from device hardware — not a personal identifier in isolation, but capable of being associated with a natural person in context).
- Lawful basis: legitimate interest (GDPR Art. 6.1.f) — preventing license abuse, enforcing the single-machine activation model agreed at purchase, and protecting InfinityDev SL's intellectual property from unauthorised distribution.
- Retention: the fingerprint hash is retained by Lemon Squeezy for the lifetime of the license; upon a valid erasure request, we will request deletion from Lemon Squeezy subject to any overriding retention obligation under applicable commercial law.
- Recipients: Lemon Squeezy LLC (Merchant of Record and license API provider). The hardware fingerprint hash is transmitted to Lemon Squeezy's API solely for license activation and validation. INFINITYDEV, S.L. does not operate its own license-validation backend and does not store the fingerprint hash independently. Lemon Squeezy's processing is governed by their own privacy policy and the Data Processing Agreement between the parties.
§ 3Why we collect it & legal basis
| Purpose | Data | Legal basis (GDPR Art. 6) |
|---|---|---|
| Delivering the Software you bought | Order data, license key, fingerprint | Contract (6.1.b) |
| License validation & revocation on refund | License key, fingerprint, validation timestamp | Contract (6.1.b) |
| Tax compliance & bookkeeping | Order data, billing country | Legal obligation (6.1.c) |
| Customer support | Email, ticket content | Contract (6.1.b) |
§ 4Sub-processors
We use the following sub-processors. Each operates under a written data-processing agreement and an appropriate legal-transfer mechanism.
| Sub-processor | Role | Location |
|---|---|---|
| Lemon Squeezy LLC | Merchant of Record — payment processing, invoicing, tax collection, refund handling, license key issuance and API (activation/validation), hardware fingerprint storage | USA (Standard Contractual Clauses) |
| Cloudflare, Inc. | Static website hosting (Cloudflare Pages), CDN, DDoS protection, DNS | USA / EU (SCCs + Data Processing Addendum) |
This list is updated whenever we add or remove a sub-processor that processes personal data.
§ 5International transfers
Some sub-processors are based outside the European Economic Area. For all such transfers we rely on the European Commission's Standard Contractual Clauses (Decision 2021/914) and, where applicable, on adequacy decisions. Copies of the SCCs are available on request.
§ 6Retention
- Order & invoice data — 6 years (Spanish bookkeeping requirement, Código de Comercio Art. 30). Held by Lemon Squeezy as Merchant of Record; INFINITYDEV, S.L. retains the minimum required for tax compliance.
- License key & fingerprint — retained by Lemon Squeezy for the lifetime of the license; deletion on request, subject to the 6-year commercial-records obligation above.
- Support emails — 24 months after last contact.
§ 7Your rights
Under GDPR Articles 15–22, you have the right to:
- Access — obtain a copy of the personal data we hold about you;
- Rectification — correct inaccurate data;
- Erasure — request deletion ("right to be forgotten"), subject to legal-retention obligations;
- Restriction — limit how we process your data;
- Portability — receive your data in a structured, machine-readable format;
- Object — to processing based on legitimate interest;
- Withdraw consent — for processing based on consent, at any time, with no effect on prior processing.
To exercise any right, email legal@trendsurfers.io. We respond within one month (extendable by two months for complex requests, with notice).
§ 8Cookies & similar technologies
The TrendSurfers website is a static HTML site and currently sets no cookies and uses no analytics or tracking scripts. No consent banner is required.
The Software itself does not set cookies.
§ 9Local-first design
We've designed the Software so the most sensitive data stays out of our reach by default. Specifically:
- Strategies, EA parameters, and set files remain on your local disk in folders you control.
- Backtest reports are written to a folder of your choice; we don't upload them anywhere.
- MT5 login credentials are managed by MT5 itself — we don't read or store them.
- Account balances and trade data aren't transmitted; the Software doesn't connect to live broker accounts for execution.
§ 10Security
We implement appropriate technical and organisational measures to protect personal data: TLS in transit for all API calls (via Lemon Squeezy), principle-of-least-privilege access for staff, regular dependency updates, and secrets isolated from source repositories. The Software's installer is digitally signed.
§ 11Children
The Software is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has provided us personal data, contact us and we'll delete it.
§ 12Updates to this policy
We may update this policy. The "Effective" date at the top reflects the latest revision. Material changes will be announced on the website and, where appropriate, by email to active Licensees.
§ 13Contact & complaints
For data-protection questions or to exercise your rights:
INFINITYDEV, S.L.
Plaça Jardí Enric Morera 2, Bajos
17600 Figueres, Girona — Spain
Data-protection & GDPR rights: legal@trendsurfers.io
Legal notices (DMCA, trademark, general legal): legal@trendsurfers.io
You also have the right to lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD): www.aepd.es, C/ Jorge Juan, 6, 28001 Madrid.