Privacy Policy
The version that applied from 28 September 2026. All versions
About this version
- Took effect: 28 September 2026
- Status: In force from this date
- Length: 3,736 words
- Change recorded as: Merge pull request #1610 from becspage-arch/claude/practice-replay-plan
- Change record reference:
7731036dindocs/legal/privacy-policy-DRAFT.md
What was in it
- The short version
- 1. Who we are
- 2. What we collect, and where it comes from
- 3. What never reaches us
- 4. Why we use your data, and our lawful basis
- 5. What we publish
- 6. Who we share it with
- 7. International transfers
- 8. How long we keep it
- 9. Your rights
- 10. Your rights in the United States
- 11. How to make a request
- 12. Cookies, security and other points
- 13. Contact and complaints
The text
# Privacy Policy
**Wildflower Privacy Policy**
**Controller:** Page Ventures Ltd, a company incorporated in England and Wales, company number 17080516, registered office Office 7283, 58 Peregrine Road, Hainault, Ilford, Essex, IG6 3SZ
**Version:** 1.0
**Last updated:** 27 September 2026
**Effective:** 27 September 2026
---
## The short version
This is a summary. The sections below are the detail, and the detail governs.
- We collect your account and billing details, the record of your own trades,
what you build, your conversations with the assistant, the tests you save,
how you use the app, and diagnostics.
- Your market data, your chart files and your broker credentials never reach
our servers. They stay on your own device.
- We never hold your money. It stays with your broker.
- We use your data to run Wildflower, bill you, support you, keep it safe and
improve it. We share it only with the kinds of service provider described in
section 6, and we do not sell it.
- We use no third-party analytics and no advertising trackers, so there is no
cookie banner.
- You can export your data from Settings, and ask us to correct it, delete it
or stop using it at privacy@wildflower.money.
---
## 1. Who we are
1.1. Wildflower is software for retail traders, provided by Page Ventures Ltd
("**Wildflower**", "**we**", "**us**"). We are the controller of the personal
data described in this policy, under the UK GDPR and the Data Protection Act
2018, and under the EU GDPR where it applies.
1.2. Contact us about this policy at privacy@wildflower.money, or by post at
the address above. We are not required to appoint a Data Protection Officer
and have not done so; our privacy contact answers everything here.
1.3. If you are in the European Economic Area, we will appoint a representative
in the EU under Article 27 of the EU GDPR before we take our first customer
there, and we will name them and give their address here.
1.4. This policy covers the Wildflower web app, the Wildflower desktop
application (the "**Local Application**"), the mobile app, our websites and
support. Your broker, prop firm, data vendor and charting platform are separate
companies with their own privacy policies. This policy sits alongside the
[Terms of Service](./terms-of-service-DRAFT.md).
---
## 2. What we collect, and where it comes from
| Category | Examples | Where it comes from |
|---|---|---|
| Identity and contact | Name, email address, country | You, at sign-up |
| Sign-in | User ID, sign-in method, session records, multi-factor settings | You, and our sign-in provider |
| Preferences | Notification settings, time zone, display settings | You |
| Billing | The plan and products you subscribe to, your billing period, any add-ons, renewal dates, reminders sent, and any refunds or guarantees used | Our own systems |
| Payment | Card brand, last four digits, expiry, billing country and address, tax status | Our payment processor |
| Broker connection | Which broker, account identifier or nickname, account type, connection state, and the prop firm you selected | Your Local Application, and you |
| Your trades | Orders, fills, positions, profit and loss, fees and balances | Your broker, relayed by your Local Application |
| Strategies and indicators | What you build, its settings and version history, and the scripts we write for you | You, and our own systems |
| Conversations with the assistant | What you type, what it replies, any script you paste in, and which part produced each rule | You, and the assistant |
| Weekly counts | How many times your own setup appeared in a week: the number, which indicator it belongs to, and the week | Counted on your device (section 3) |
| Saved tests | The tests you choose to save, within the limits shown in the product: settings, the chart file's name, figures and trades, and any decisions and notes you make while testing | You |
| Error reports | When you report a problem with a script: the script and what you tell us went wrong | You |
| Usage | Pages viewed, features used, which setup steps you have completed, device, browser and IP address | Our own application |
| Diagnostics | Errors, logs, timing, and any diagnostic bundle you choose to send | Our own application, and you |
| Security | Sign-in attempts, IP addresses, records of administrative actions | Our own systems |
| Support | Your emails to us and bug reports | You |
2.1. **What you must give us.** We need your email address to create your
account, and payment details for a paid plan. Without them we cannot provide
the service. Everything else in the table is collected as you use Wildflower.
2.2. **The assistant.** The assistant is run for us by an AI provider (section
6), so what you type to it is sent to that provider to produce each reply. We
keep your conversations with your account, beside the strategy or indicator
they produced, so you can see where each rule came from. Our AI provider's
business terms do not allow it to train its models on your conversations.
Please do not type your broker password, card details or anything else you
would not want stored.
2.3. **We do not ask for** special category data (such as health, religion
or biometrics), identity documents, or your location, beyond an approximate
country worked out from your IP address for tax, security and eligibility. If
you choose to write something like that in a note or a message, it is kept
only as part of your own record, and you can delete it.
---
## 3. What never reaches us
3.1. **Your market data.** Quotes, bars, order book and any other market data
stay on your device. They are not sent to us in diagnostics, error reports or
any other channel, and we do not store, relay or resell market data.
3.2. **Your chart files.** A chart file you load, or bars fetched from your own
broker, to preview an indicator, run a test or use Replay, are read and kept on
your device. We never receive the file or the prices in it. When we tell you how often your setup appeared, your device does
the counting and sends us only the number, which indicator it belongs to and
the week.
3.3. **Your broker credentials.** Your broker usernames, passwords, keys and
tokens are held in the Local Application's protected storage on your own
device. We do not receive them, we cannot see them, and we cannot recover them
for you.
3.4. **Your money.** We never hold customer money. It stays in your broker
account.
3.5. The record of your own trades does reach us: a fill price on a contract
you traded is your account activity, not market data. Diagnostic bundles are
filtered on your device to remove market data and credentials.
---
## 4. Why we use your data, and our lawful basis
| What we do | Lawful basis |
|---|---|
| Create and run your account and provide Wildflower, including your journal, reporting and history | Contract |
| Run the assistant, keep your conversations and build your indicators and scripts (this applies to the free parts of Wildflower as well as the paid ones) | Contract |
| Take payment and manage your subscription and refunds | Contract |
| Send the alerts you set up, provide support and investigate faults | Contract |
| Email you each week with how often your own setups appeared | Legitimate interests (a service message about your own indicators), with an unsubscribe link in every email and a setting to turn it off |
| Send safety and system notices, such as a defect affecting trading, a security incident or a broker outage | Legitimate interests (keeping customers safe); legal obligation where a breach notice is required |
| Keep Wildflower secure, prevent and investigate misuse, and keep audit records | Legitimate interests (security of the service) |
| Understand how Wildflower is used and performs, so we can decide what to fix and build | Legitimate interests (improving our product) |
| Produce internal business figures, such as active customers and connection health | Legitimate interests (running our business) |
| Publish counts about Wildflower (section 5) | Legitimate interests (telling people about our service) |
| Send marketing email about Wildflower | Consent, or the soft opt-in for existing customers where the law allows |
| Meet legal, tax and accounting obligations | Legal obligation |
| Establish, exercise or defend legal claims | Legitimate interests (protecting our legal position) |
4.1. "Contract" means we need the data to provide the service you signed up
for. Where we rely on legitimate interests, we have weighed them against your
rights; you can ask for a summary, and you can object (section 9).
4.2. Where we rely on consent, you can withdraw it at any time, for example by
pressing unsubscribe or emailing privacy@wildflower.money. Withdrawing does
not affect anything we did before.
---
## 5. What we publish
5.1. We may publish figures about Wildflower, such as how many people use it
or how many trades it has placed. Published figures are counts only, for our
whole customer base or a group of at least 50 people, never broken down so far
that someone could be picked out.
5.2. **We never publish performance.** No profit and loss, win rate, returns or
average results, for any group or any person. We do not publish, share or sell
your individual trading results, and we do not use them in marketing.
---
## 6. Who we share it with
6.1. We use service providers to run Wildflower. They process personal data
for us only on our instructions, under written data processing terms. We name
them by the kind of service they provide, so that changing a supplier does not
change what happens to your data:
| Kind of provider | What they do | What they handle |
|---|---|---|
| Payment processing | Payments and subscription billing | Identity, billing and payment details |
| Sign-in and account security | Sign-in, sessions and multi-factor settings | Identity and sign-in data |
| Real-time messaging | Messages between the app, our servers and your Local Application | Broker connection details, trade records and control messages. No market data |
| Cloud hosting and database | Running our servers and storing our data | All data held on our servers, including the usage data we record ourselves |
| The AI assistant provider | Runs the assistant | What you type or send to the assistant, any script you paste in, and what it produces |
| Error monitoring | Error and crash reporting | Diagnostics, logs, user and device identifiers |
| Email delivery | The emails the product sends you, and marketing email if you have agreed to it | Identity and email content |
| Phone notification services, run by the company that makes your phone's operating system | Push notifications to your phone | Device token and notification content |
You can ask for the current list of providers by emailing
privacy@wildflower.money.
6.2. We use no third-party analytics or support tool. Usage data is recorded
in our own database, and support runs by email.
6.3. **Your broker.** Your orders go from your Local Application to your broker
over your own connection, under your own credentials, and your broker's reports
come back the same way. Your broker is a separate controller of the data it
holds about you. We send nothing to your charting platform.
6.4. We may also disclose personal data where the law, a court or a regulator
requires it; for legal claims; to our professional advisers in confidence; to
report suspected market abuse; and to a buyer of the business, under
confidentiality, in which case we will tell you.
6.5. We do not sell your personal data, and we do not share it for
cross-context behavioural advertising.
---
## 7. International transfers
7.1. Our servers and database are in London. Some of our service providers
(section 6) are in the United States or process data outside the UK and the
EEA.
7.2. When personal data leaves the UK or the EEA, we rely on a safeguard the
law recognises, such as an adequacy decision or the standard contractual
clauses approved for the purpose, set out in the provider's data processing
terms.
7.3. You can ask for a copy of the safeguards that apply by emailing
privacy@wildflower.money.
---
## 8. How long we keep it
**The general rule: within 30 days of you closing your account, we delete your
personal data, or remove your name, email address and sign-in link from the
records we keep.** The table sets out the exceptions and the reasons.
| Data | How long | Why |
|---|---|---|
| Account and identity data | While your account is open. Your name, email address and sign-in link are removed when it closes | Running your account |
| Billing, tax and accounting records | 6 years from the end of the accounting period | UK company law and HMRC require it |
| Broker connection details | While the connection exists, then kept, marked as removed, beside the trade history | Keeping your trade history complete |
| Your trade history | While your account is open, then kept without your name, email address or sign-in link | A complete record of real orders placed in real markets |
| Audit records | While your account is open, then kept without your name, email address or sign-in link | Security |
| Strategies, their versions and the conversations that built them | While your account is open, then kept beside the trade history they produced, without your name, email address or sign-in link | Each trade records the exact version of the strategy that placed it |
| Journal notes and chart notes | While your account is open, then deleted when it closes | Your own notes |
| Indicators, their versions and scripts | While your account is open, then deleted when it closes | So you can go back to them while you are with us |
| Other conversations with the assistant | While your account is open, then deleted when it closes | The record of what you asked and what it answered |
| Weekly counts | While your account is open, then deleted within 30 days of closure | Your weekly email |
| Saved tests | While your account is open, within the limits shown in the product, then deleted when it closes | So you can compare your own tests |
| Usage data | While your account is open, then kept without anything that links it to your account | Product analysis |
| Diagnostics and application logs | 90 days | Investigating faults |
| Security logs | 12 months | Detecting and investigating attacks |
| Support conversations | 2 years from the last message | Context if you come back with the same question |
| Marketing consent records | 6 years from withdrawal | Evidence that we handled your consent correctly |
8.1. **Removing a broker account.** A removed broker account stops trading,
but its trade history stays in your journal, so your record stays complete.
8.2. **Closing your account.** Ask us from Settings, then Your data, or by
emailing privacy@wildflower.money. A person carries it out, and we confirm
within 3 working days. We switch off your strategies and your broker
connections, cancel your subscription, and delete your data or remove your
name, email address and sign-in link from it, as the table says. We do not
close an open position for you, so please be flat first. Your right to erasure
(section 9) does not reach billing and tax records we must keep by law, or
records we need for a legal claim until the limitation period ends. Records we
keep without your name, email address or sign-in link are still protected as
personal data. Export anything you want to keep before you close your account.
---
## 9. Your rights
9.1. If UK or EU data protection law applies to you, you have the right to:
- **access** your personal data and get a copy of it;
- **rectification**: have inaccurate data corrected and incomplete data
completed;
- **erasure**: have your data deleted, subject to the limits in section 8.2;
- **restriction**: have us stop using your data while a question about it is
settled;
- **portability**: get the data you gave us in a machine-readable format, or
have it sent to another provider;
- **withdraw consent** at any time, where we rely on consent; and
- **complain** to the Information Commissioner's Office (section 13).
9.2. **Your right to object.** You can object at any time to our use of your
data based on legitimate interests. We will then stop, unless we have
compelling legitimate grounds that override your interests, or we need the
data for a legal claim. You can object to direct marketing at any time, for any
reason, and we will stop straight away.
9.3. **Getting a copy of your data.** Go to Settings, then Your data, and press
**Export my data** for one machine-readable file of your account: your
profile and settings, broker accounts, strategies and the conversations that
built them, indicators and their scripts, conversations with the assistant,
saved tests, orders, fills, trades, journal and account activity. The tables
are also offered as spreadsheets. Your broker credentials are not in it,
because we never hold them. Records kept outside your account, such as usage
records, diagnostics and support emails, are not in the file. Email
privacy@wildflower.money for those, or if you prefer, and we will send you your
personal data as a machine-readable file within 30 days.
9.4. We do not charge for exercising your rights and we will not treat you
differently for using them.
---
## 10. Your rights in the United States
10.1. If your US state has a consumer privacy law, you may have the right to
know, get a copy of, correct and delete your personal information, and to opt
out of its sale, targeted advertising and significant profiling. The
categories we collect and their sources are in section 2, our purposes in
section 4, and our recipients in section 6.
10.2. **We do not sell or share your personal information**, and have not in
the last 12 months. So a Global Privacy Control signal from your browser needs
nothing further from us: the opt-out it asks for is already how Wildflower
works.
10.3. To exercise these rights, email privacy@wildflower.money. We may need to
verify your identity, and you may use an authorised agent where the law
allows.
---
## 11. How to make a request
11.1. Email privacy@wildflower.money. For a copy of your data, you can use
**Export my data** in Settings instead.
11.2. We will reply within one month for UK and EU requests, and within the
time your state's law sets for US requests. If a request is complex we may take
longer, and we will tell you why.
11.3. We may ask you to confirm your identity. If we cannot do what you ask,
we will tell you why.
---
## 12. Cookies, security and other points
12.1. **Cookies.** We set only the cookies and local storage that Wildflower
needs in order to work: keeping you signed in (set by our sign-in provider),
holding your session, remembering your settings, and protecting against forged
requests.
We run no third-party analytics and no advertising cookies, in the app or on
our websites. Strictly necessary cookies need no consent, so there is no cookie
banner. If that ever changes, we will update this policy and ask for consent
before any other cookie is set.
12.2. **Messages.** Billing, security and incident notices, and important
changes to our terms, are part of the service and cannot be switched off. You
choose your trading alerts in settings. Every marketing email has an
unsubscribe link that works straight away.
12.3. **Automated decisions.** Wildflower carries out your strategies
automatically, but those are your instructions, not decisions about you. We
make no decisions about you based solely on automated processing that have
legal or similarly significant effects, and nothing is auto-suspended: a person
reviews anything that looks wrong, and any suspension is a person's decision
that you can ask us to look at again.
12.4. **Security.** We use encryption in transit and at rest, access limited
to those who need it, logging of administrative actions and regular updates.
We hold no third-party security certification. If a breach puts your rights at
risk, we will tell the Information Commissioner's Office within 72 hours where
required, and tell you where the law requires it. Report a security concern to
security@wildflower.money.
12.5. **Children.** Wildflower is for adults aged 18 and over. We do not
knowingly collect data from anyone younger, and we will delete it if we find
that we have.
12.6. **Changes.** For an important change to this policy we will email you
and show a notice in the app at least 30 days before it takes effect, unless
the law requires it sooner or it only works in your favour. Previous versions of this policy are
published at `wildflower.money/legal/versions`, newest first, with the date
each took effect. Nothing is ever removed from that list. They are also kept in
our public change record, and if you email privacy@wildflower.money with a date
we will send you the version that applied.
---
## 13. Contact and complaints
Page Ventures Ltd, Office 7283, 58 Peregrine Road, Hainault, Ilford, Essex,
IG6 3SZ, United Kingdom
- Privacy: privacy@wildflower.money
- Security: security@wildflower.money
- Everything else: support@wildflower.money
13.1. If you are unhappy with how we have handled your data, please tell us
first so we can put it right.
13.2. You have the right to complain to the Information Commissioner's Office,
the UK supervisory authority: ico.org.uk, 0303 123 1113, Wycliffe House, Water
Lane, Wilmslow, Cheshire SK9 5AF. If you are in the EEA you can complain to
your local supervisory authority, and if you are in the US you can contact your
state Attorney General.