01Who we are
AlgoDesk is operated by System Elements FZ LLC, a free zone company licensed in Ras Al Khaimah, United Arab Emirates (“we”, “us”). We decide how and why the personal data described here is used, which makes us its controller.
System Elements FZ LLC · licence no. FDRK4288
Compass Building, Al Shohada Road
Al Hamra Industrial Zone-FZ
Ras Al Khaimah, United Arab Emirates
desk@algo-desk.com
This policy covers the website at algo-desk.com, your AlgoDesk account, the AlgoDesk Desktop app’s connection to our servers, checkout, support and our contact forms. It does not cover the services of brokers, exchanges, data providers, AI tools or anyone else you connect AlgoDesk to: their own policies apply.
We handle personal data in line with the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021) and, where they apply to you, the EU and UK General Data Protection Regulations.
02In short
- Your account holds your email, a hash of your password, your plan, your machine ID and your invoices, plus your name and company if you add them.
- Your trading data, strategies, scripts, broker credentials and API keys stay on your machine. The Desktop app does not send them to us.
- No advertising, no analytics, no tracking cookies, no newsletter. We do not sell or rent personal data.
- Stripe handles payments; your card details go to Stripe, not to us.
- You can ask to see, correct or delete your data at desk@algo-desk.com.
03What we collect
Your account
- Your email address, which is also your licence identity.
- Your password, stored only as a one-way hash. We cannot read it.
- Your name and company, if you add them; they appear on your invoices.
- When you accepted these terms, created the account, last changed your password and last signed in, and a count of failed sign-ins used to lock the account against password guessing.
- Internal notes our staff may keep on your account to help with support and billing.
Your licence and the Desktop app
- Your plan, its status and its dates, including your free month.
- Each time it starts, the app sends us your email, your password, your machine ID and a random one-time value. We check the password against its hash and do not store what was sent. The app itself stores no password.
- Your machine ID: a fingerprint the app derives from your computer. We record it at the app’s first sign-in, keep a record of each successful app sign-in (its time and the machine ID), and record each machine a free month has run on, so that one machine carries only one free month.
- When the app checks for a newer build it sends only a random value; no account details.
Payments
- Your plan, orders, amounts, promotion codes used, invoices and the payment status Stripe reports to us, and the ID of your customer record at Stripe.
- Your card details are entered into Stripe’s own form and go directly to Stripe. We never see or store your full card number.
Support and contact
- Support tickets: your messages, the files you attach, our replies, and when each was sent.
- Talk to us and the Offers page form: your name, email, company, role, the options you tick and your message. The puzzle on these forms runs on our own server; no third-party captcha service sees you.
- Emails you send us, and the emails we send you: sign-up and password-reset links, support notifications and, from Stripe, receipts.
Technical data
- Our servers record technical details of requests, such as IP address, date and time, the page or address requested, the browser’s user agent and errors, to run the service, keep it secure and limit abuse.
- Download links are signed, short-lived links to our file storage at Amazon Web Services, which records the requests it serves.
04What stays on your machine
AlgoDesk Desktop runs on your computer, and your work stays there. The app does not send us your workspaces, presets, strategies, scripts, backtest or trading results, positions, orders, account balances, market data, or the logins and API keys you use for brokers and data providers. Connections to brokers and data providers go from your machine to them, not through us.
One sign-in passes by on its way: when you connect AlgoDesk Desktop to Tradovate, Tradovate sends its sign-in answer to a page on our website made for it, algo-desk.com/tradovate/callback/, and a script on that page passes it straight on to the app on your computer. Our website does not read, store or log that answer.
We only see such things if you choose to send them to us, for example by attaching them to a support ticket. Please remove secrets before you do.
05Why we use it
We use personal data only for these purposes. Where the GDPR applies, the legal basis for each is in brackets.
- To run your account and licence: signing you in on the website and in the app, the free month, the one-machine rule, downloads, release notes. (Performing our contract with you.)
- To take payments and keep accounts: plans, renewals, invoices, refunds, tax and accounting records. (Contract; legal obligation.)
- To give support and answer you: tickets, emails and the contact forms. (Contract, or steps you ask for before one; our legitimate interest in answering people who write to us.)
- To keep the service secure: preventing fraud, repeated free months, password guessing, licence sharing and abuse. (Our legitimate interest in protecting the service and our customers.)
- To tell you what you need to know: changes to these documents, your plan or the service. These are service messages, not marketing. (Contract; legal obligation.)
- To comply with the law and to establish, exercise or defend legal claims. (Legal obligation; legitimate interest.)
We do not send marketing emails or newsletters. If we ever want to, we will ask for your consent first.
The licence check is automatic: the app runs or not depending on your plan and your machine ID. If you think it has got something wrong, write to us and a person will look at it.
06Who else handles it
We share personal data only with providers that help us run the service, on our instructions and under contract, and only what each one needs:
- Stripe: payments, subscriptions, invoices, receipts, tax and fraud prevention. We give Stripe your email, your name and company if you added them, and our internal ID for your account. Stripe’s own privacy policy also applies to what you enter in its payment form.
- Amazon Web Services: sending our emails (Amazon SES) and storing and serving the installers and documentation (Amazon S3).
- Our hosting provider: the servers that run the website and its database and keep support attachments.
- Our email provider: the mailboxes that receive your emails and contact form messages.
We may also disclose personal data to professional advisers such as lawyers and accountants; to authorities, courts or regulators when the law requires it or to protect our rights, our customers or others; and to a buyer or successor if the business is reorganised or sold, who would then be bound by this policy.
We do not sell or rent personal data, and we do not share it for advertising.
07Where it is processed
We are based in the United Arab Emirates. Our providers process data in other countries, including member states of the European Union (our Amazon S3 storage is in Sweden) and the United States (Stripe). Where data leaves the country you are in, we rely on the safeguards the law requires, such as the European Commission’s standard contractual clauses or an adequacy decision, as offered by our providers.
09How long we keep it
- Account, licence and app sign-in records, support tickets and attachments: while your account exists. When it is closed we delete them within 30 days, apart from what follows.
- Orders, invoices and payment records: as long as tax and accounting law requires, currently up to seven years after the year of the transaction.
- Contact form messages and emails: as long as the conversation needs, and no more than two years after the last message unless it leads to an agreement with you.
- Server and security logs: a limited time for security and troubleshooting, then deleted or overwritten.
We may keep data longer where the law requires it or while it is needed for a legal claim.
10Security
The website and the app’s connection to it use HTTPS only. Passwords are stored as one-way hashes, accounts lock after repeated failed sign-ins, and the server signs each licence answer so the app can tell it is genuine. Access to personal data is limited to the people who need it to run the service. No system is perfectly secure; if a breach affects your data in a way the law requires us to report, we will tell you and the relevant authority.
11Your rights
Depending on where you live, you can ask us to:
- confirm whether we hold data about you and give you a copy;
- correct data that is wrong or incomplete;
- delete your data, or close your account;
- restrict how we use it, or object to a use based on our legitimate interests;
- give you the data you provided in a portable format; and
- withdraw consent, where we rely on it.
Write to desk@algo-desk.com, from the address on your account if you have one, so we can check it is you. We reply within 30 days. Some data we must keep, such as invoices, even after you ask us to delete it; we will tell you if so.
If you are not happy with our answer, you can complain to the data protection authority where you live or work; in the UAE, the UAE Data Office.
12Children
The service is for adults. It is not meant for anyone under 18 and we do not knowingly collect data about children. If you think a child has given us personal data, write to us and we will delete it.
13Changes to this policy
We will update this policy when what we collect or how we use it changes. The date at the top shows when it last changed. If a change materially affects you, we will email the address on your account before it takes effect.
14Contact
Questions about this policy or your data: write to us.
System Elements FZ LLC · licence no. FDRK4288
Compass Building, Al Shohada Road
Al Hamra Industrial Zone-FZ
Ras Al Khaimah, United Arab Emirates
desk@algo-desk.com