FillEdge — Privacy Policy

Controller: Eazy SLU (trading as "FillEdge") Effective date: 2 June 2026 Last updated: 2 June 2026

1. Who we are

This policy explains how Eazy SLU, 90 Avinguda Joan Martí, Encamp AD200, Andorra (operating the FillEdge brand), collects and uses personal data when you use filledge.com, the FillEdge dashboard, the Service, and the EA.

Eazy SLU is the data controller. For privacy matters: privacy@filledge.com. Supervisory authority: the Andorran Data Protection Agency (APDA).

2. The data we collect

Scope. The Service is for your own-account trading only (Terms §3.4 and §6.1). It is not to be used to provide signals to, or trade for, third parties, and we do not knowingly process the personal data of any such third-party end-users through your use of the Service. The data below relates to you and your own trading.

2.1 Data you give us

Email; password (stored only as a bcrypt hash); display name; timezone; two-factor (TOTP) secret (encrypted at rest) and hashed backup codes; notification/marketing preferences; support messages.

2.2 Billing data

Plan and subscription status, and a billing identifier. Payment is processed by Paddle as Merchant of Record; Paddle collects your payment details directly. We do not receive or store your full card number.

2.3 Data generated by your use of the Service

What we do NOT collect or store: your broker login/password or investor password; your funds; your withdrawal methods. The EA connects to your broker directly on your own machine — your broker credentials never reach us.

2.4 Cookies and analytics

• Google Analytics 4 — website/traffic analytics. Loaded only after you accept the Analytics purpose in our cookie banner.
• PostHog (EU) — product analytics (usage, session replay). Loaded only after you accept the Analytics purpose.
• Strictly necessary auth/session cookies (always on; no consent required).
• We use a consent banner (Cloudflare Zaraz) to manage these choices; you can change them anytime via "Cookie settings".

3. How we use your data and our legal bases (LQPD / GDPR-aligned)

We do not sell your personal data, and we do not use your strategies or signals to trade for our own account or to build competing strategies.

4. Sharing and recipients

For Paddle's handling of your payment data, see Paddle's own Privacy Policy and GDPR documentation (paddle.com/legal/privacy and paddle.com/legal/gdpr). We may also disclose data to comply with law, enforce our Terms, protect rights/safety, or in a merger/asset sale (with notice where required).

5. International transfers

As an Andorran controller, we benefit from the EU's adequacy recognition of Andorra for EU→Andorra flows. For transfers to recipients outside the EEA/Andorra, we rely on appropriate safeguards (e.g. Standard Contractual Clauses or adequacy).

6. Retention

• Account data: for the life of your account; deleted/anonymized within 90 days of closure, except where retention is required.
• Billing/tax records: kept for the period required by Andorran law (typically several years).
• Signal/position/diagnostic data: kept 12 months for reconciliation, support, and audit, then deleted/aggregated.
• Audit logs: append-only for 12 months.

7. Security

Encryption in transit (TLS); passwords as bcrypt hashes; TOTP secrets encrypted at rest; per-user isolation (application scoping + database row-level security); credential redaction in logs; rate limiting; required/strongly-encouraged 2FA; dependency scanning; append-only admin audit logging with user-approved, time-limited support access. No system is perfectly secure. We will notify the APDA of qualifying personal-data breaches within 72 hours and affected individuals where required.

8. Your rights

You may access, rectify, erase, restrict, or object to processing; request portability; and withdraw consent. Contact privacy@filledge.com; we respond within the legal timeframe (e.g. one month). You may complain to the APDA (Andorra) or, if you are an EU/UK resident, your local data-protection authority.

8.1 California (CCPA/CPRA)

California residents may request to know, delete, and correct personal information, and to opt out of "sale"/"sharing." We do not sell personal information. We will not discriminate for exercising rights.

9. Children

Not for anyone under 18; we do not knowingly collect minors' data.

10. Changes

We may update this policy and will post a new "Last updated" date; material changes will be notified.

11. Cookie summary

12. Contact

Eazy SLU (FillEdge) — data controller 90, Avinguda Joan Martí, Encamp AD200, Andorra Privacy: privacy@filledge.com · Supervisory authority: APDA (Andorra)