Privacy Policy

PropDrill (propdrill.com) is the controller of your personal data: we decide how and why it's used. For anything about privacy, write to support@propdrill.com.

• Account details: your name and email address, and your password, which we store only as a secure hash. If you sign in with Google, Google shares your name, email address and profile picture with us, and you don't set a password.
• Your sessions: the challenges you set up, your simulated trades, drawings and settings, their results, and how much time you spend in the simulator.
• Plan and billing: whether you're on Pro, and your subscription's status, dates and Paddle customer reference. Paddle collects your payment details at checkout; we never see your card.
• Sign-in and technical data: your IP address and browser type, recorded when you sign in, the country that IP address is in, and server logs. We work out the country on our own server, without sending your address to anyone, and never anything more precise than the country.
• Messages: emails you send us, and our replies.

• To provide PropDrill: running your account, saving your sessions and giving you Pro. Legal basis: our contract with you.
• To send account emails: confirming your email address, resetting your password, and telling you about important changes to the service or these policies. Legal basis: our contract with you.
• To keep PropDrill secure: spotting suspicious sign-ins, preventing abuse such as extra accounts made to get around limits, and fixing faults. Legal basis: our legitimate interest in a safe, working service.
• To know where our users are: the country you signed up or last signed in from, kept with your account so we know which countries PropDrill serves. Legal basis: our legitimate interest in running and improving the service.
• To see how PropDrill is used: counting your sessions, trades, practice days and time in the simulator, including sessions you've deleted, so we can improve PropDrill and invite active traders to give us feedback. Legal basis: our legitimate interest in running and improving the service.
• To answer you: replying to your messages. Legal basis: our legitimate interest in helping you, or our contract with you.
• To meet legal obligations: keeping records the law requires, and answering lawful requests from authorities. Legal basis: legal obligation.

We don't sell your data, show ads or send marketing. We don't make automated decisions about you that have legal or similarly significant effects.

Only with the providers that help run PropDrill, and only what each of them needs:

• Paddle (Paddle.com Market Ltd): our reseller and Merchant of Record. It runs checkout and handles payments, tax, invoices and refunds. What you enter at checkout is covered by Paddle's privacy notice.
• Hosting: the provider that runs our server, which is in the European Union.
• Email: the provider that sends and receives our emails.
• Backups: a cloud storage provider keeps copies of our database. They're encrypted before they leave our server, so the provider can't read them.
• Google, only if you choose to sign in with Google: it handles that sign-in.
• Professional advisers, such as accountants or lawyers, where needed.
• Authorities, where the law requires it.

Our server is in the European Union. Some of the providers above also process data in other countries, including the UK and the US. Where the GDPR or UK GDPR applies, these transfers are protected by an adequacy decision or by standard contractual clauses (for the UK, the International Data Transfer Agreement).

• Account, sessions and sign-in records: while your account exists. A session you delete leaves your dashboard but stays with your account, out of sight, for the counts above. When you ask us to delete your account, we delete them all within 30 days.
• Backups: copies of the database are kept for up to 12 months and then deleted, so deleted data can remain in a backup until it expires.
• Billing records: as long as tax and accounting law requires. Paddle keeps its own records as the seller.
• Server logs: a short time, for troubleshooting.
• Emails with us: as long as we need them to help you.

Depending on where you live, including under the GDPR and UK GDPR, you can ask us to:

• give you a copy of your personal data (access);
• correct it (rectification);
• delete it (erasure);
• limit how we use it (restriction);
• give it to you, or to another service, in a common machine-readable format (portability);
• stop using it where we rely on our legitimate interests (objection).

Where we rely on your consent, you can withdraw it at any time. To use any of these rights, write to support@propdrill.com. We'll reply within one month. You can also complain to the data protection authority where you live.

We use HTTPS everywhere, store passwords only as hashes, encrypt our backups and keep access to our server tightly restricted. No system is perfectly secure, but we work to protect your data, and we'll tell you if a breach puts it at risk, as the law requires.

We only use cookies the site needs to work: the cookie that keeps you signed in, and short-lived cookies that protect signing in. We don't use advertising or analytics cookies, so we don't ask for cookie consent. Some display preferences, such as your chart layout, are saved in your browser's local storage and stay on your device.

PropDrill is for people aged 18 and over. We don't knowingly collect data from anyone younger.

If we change this policy in a significant way, we'll tell you by email or on the site. The date at the top shows when it last changed.

Privacy questions or requests: support@propdrill.com.