Privacy policy
Last updated: 03/10/2026
This translation is provided for information only. In case of discrepancy, the French version prevails: read the French original.
Data controller
The controller of your data is the publisher of the MullTrade site (see the legal notice). Contact for any question about your data: [email protected].
Data collected
- Account: email address, password (hashed, never stored in plain text), notification preferences, site language.
- License and payment: plan and options chosen, amount, payment status and identifier (Stripe or NOWPayments). Bank card data is entered at Stripe and never passes through MullTrade.
- Bot configuration (after purchasing a license or during the trial): login, password and server of your trading account (MetaTrader 4, MetaTrader 5 or TradeLocker), encrypted at rest; Telegram session of the account you connect; chosen channel(s) and bot settings.
- Bot operation: the messages received from the channels you follow and what the bot did with them (orders placed, ignored, modified), viewable in your log; the results of your trades, read from your broker for your dashboard.
- AI plan: the text and images of the messages of the channels followed, sent so that the AI can extract the trading instructions.
- Residential IP option: the IP assigned to your bot and its country.
- Free trial abuse prevention: an encrypted, non-reversible fingerprint of the email address, IP address, Telegram account and trading account used for a trial. These values are never kept in plain text.
- Technical: IP address and technical logs (site connections, errors), for security and troubleshooting purposes.
- Advertising measurement (only if you accept cookies): see "Cookies and local storage" below.
What the Telegram connection allows
The Telegram session you create by scanning the QR code or with your phone number technically gives access to your Telegram account. MullTrade only uses it to: list your channels during setup, read the messages of the channels you have chosen, and send you your notifications in your "Saved Messages". No other message is read or kept. You can close this session at any time from Telegram (Settings → Devices) or from your client area.
Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Creating and securing your account, providing the service (bot, log, dashboard, notifications), the residential IP option and AI reading | Performance of the contract |
| Processing your payments, issuing invoices and keeping accounts | Performance of the contract and legal obligations |
| Security of the service (technical logs, protection against intrusion attempts, attacks and bots, anti-bot check on forms) | Legitimate interest |
| Preventing the same user from chaining free trials | Legitimate interest |
| Contacting you about your account, your license or an incident | Performance of the contract |
| Measuring the effectiveness of our ads and personalizing ads (Google Ads cookies) | Consent (cookie banner) |
Your data is never sold. It is only used for advertising through the Google Ads cookies, and only if you accept them.
Recipients and processors
| Provider | Role | Data concerned |
|---|---|---|
| OVH SAS (France) | Infrastructure hosting | All the data above (hosted on their servers in France) |
| Stripe | Card, Apple Pay and Google Pay payments | Email, order identifier, amount, payment status |
| NOWPayments | Cryptocurrency payments | Order identifier, amount, payment status |
| Brevo (France) | Sending emails (confirmation, login code, notifications) | Email, content of the email |
| Anthropic | AI reading of messages (AI plan only) | Text and images of the messages of the channels followed |
| IPRoyal | Fixed residential IP (option) | Traffic from your bot to your broker and Telegram (encrypted connections) |
| Cloudflare (Cloudflare, Inc.) | Delivery of the site and protection against attacks and bots; anti-bot check (Turnstile) on the sign-up, login and forgotten-password forms | IP address, requests sent to the site (pages, forms), technical information about the browser and device |
| Google (Google Ireland Limited) | Measurement and personalization of Google Ads advertising, only if you accept cookies | IP address, pages visited, cookie identifier, browser information |
Some of these providers (in particular Stripe, Anthropic, Cloudflare and Google) may process data outside the European Union, in particular in the United States. These transfers are governed by the safeguards provided for by the GDPR (standard contractual clauses of the European Commission and, where applicable, the "Data Privacy Framework" adequacy decision).
Retention periods
- Account and bot configuration: as long as your account exists. A bot's trading credentials and Telegram session are deleted as soon as that bot is deleted.
- Invoices and accounting records: 10 years (legal obligation).
- Bot log: only the latest messages processed are kept (a few hundred at most), the oldest being deleted as new ones arrive.
- AI readings: 30 days.
- Free trial anti-abuse fingerprints: 1 year.
- Technical logs: 12 months at most.
- Backups (encrypted): 7 days on the server, 30 days for the backup copy.
Security
The site is served exclusively over HTTPS. Account passwords are hashed (bcrypt), trading credentials are encrypted at rest, logging in to the account is protected by a one-time code sent by email, and backups are encrypted. Access to the infrastructure is restricted and logged.
Cookies and local storage
The site uses a session cookie, strictly necessary for the service to work (keeping you logged in), and a cookie that remembers the site language you have chosen; it also stores in your browser the light or dark theme and your choice regarding advertising cookies. The language offered on your first visit is deduced from your browser's language, never from your IP address.
The site is delivered through Cloudflare, which protects it against attacks and bots. Cloudflare may set a technical security cookie (for example after an anti-bot check), which is strictly necessary and never used for advertising.
Google Ads advertising cookies, only with your consent. If you click "Accept" in the cookie banner, the site loads the Google Ads tag (Google Ireland Limited), which sets cookies used to measure the effectiveness of our ads (knowing whether a visit, a sign-up or a purchase comes from an ad) and to personalize the ads shown to you. Google then receives in particular your IP address, the pages visited and a cookie identifier; this data may be transferred to the United States ("Data Privacy Framework" adequacy decision). These cookies are kept for 13 months at most.
If you refuse, or as long as you have not made a choice, no Google tag or cookie is loaded and the site works in exactly the same way: your browser then does not contact any advertising or audience-measurement service (fonts and icons are hosted on our servers; only the Cloudflare Turnstile security captcha is loaded on the sign-up, login and forgotten-password pages). Your choice is kept for 6 months. You can change it at any time with the "Cookies" link at the bottom of every page; if you withdraw your consent, the Google cookies set on mulltrade.fr are deleted.
Your rights
In accordance with the GDPR, you have the right to access, rectify, erase, restrict, port and object to the processing of your data, as well as the right to set guidelines regarding what happens to it after your death. To exercise these rights: [email protected]. You can also lodge a complaint with the CNIL, the French data protection authority (www.cnil.fr), or with the data protection authority of your country.