1. Who we are
Pipsocket is run by WILIER LABS PTY LTD (ABN 57 681 703 328), a company based in Brisbane, Queensland, Australia. In this policy “Pipsocket”, “we” and “us” mean that company.
This policy covers pipsocket.com, the dashboard at app.pipsocket.com, our docs, our REST, WebSocket and MCP APIs, TradingView hooks, and the MetaTrader terminals we host for you. It explains how we handle personal information under Australia’s Privacy Act 1988 and the Australian Privacy Principles and, where they apply to you, the EU and UK General Data Protection Regulations (GDPR). For the GDPR, we are the controller of the personal information described here.
Questions or requests go to support@pipsocket.com.
2. What we collect
Your account
Your name, email address and password when you sign up. We store the password only as a one-way hash, so we can’t read it. We also keep whether your email is confirmed, your workspaces, your role in each one, and invitations: the email address of someone you invite, which we get from you rather than from them. The invitation email tells them who invited them and links to this policy.
Your broker accounts
To run a terminal for a MetaTrader account, we need its login, server and password. The login and server are stored in our central database. The password is not: it goes to the server that runs your terminal and is stored there encrypted. Once running, the terminal holds what MetaTrader holds on any computer: balance, positions, orders, deal history and price data, as your broker sends them.
What you send through us
- Trade requests sent through the dashboard, API or MCP server, and your broker’s answer to each.
- TradingView alerts: the full message, the IP address it came from, and what happened on each account.
- Settings and rules you set up, such as hooks, managed stops and the kill switch.
- API keys and hook URLs. We keep only a hash of each API key and its last four characters. Hook URLs are kept as a hash plus an encrypted copy, so owners and admins can view them again after re-entering their password. Like any web address, a hook URL also appears in our request logs (below).
Records of what happens in a workspace
An activity log of sensitive actions, such as viewing, rotating or deleting a hook URL, releasing positions from a hook, or settling a request by hand. Each entry records who did it and when. When a request is settled by hand, the name and email of the person who settled it are stored with that request.
Technical information
- Your IP address and browser details, stored with each signed-in session.
- IP addresses used to limit repeated sign-in and hook attempts.
- Request logs kept by Cloudflare, our hosting provider: the address requested, time and response. An address can include a secret, such as a hook URL or a password reset link.
- Server logs from the machines that run terminals. These record account ids and statuses, not logins or passwords.
Billing
When you pay for Pipsocket, the payment is handled by Stripe, through Stripe’s payment form shown in the dashboard and its billing pages. Card numbers go straight to Stripe and never reach our servers. Stripe keeps your billing details and shares them with us: your billing name, email and address, any tax ID you give, your card’s brand, last four digits and expiry date, and your invoices and whether they are paid. We also record your workspace’s subscriptions, how many slots it has paid for, and where it stands with payments.
Support
Whatever you include when you email us.
You need to give us your name, email address and a password to have an account, and a broker login, server and password to connect a broker account. To pay, Stripe needs your card and billing address. Without them we can’t provide the service. Everything else is optional, such as a tax ID, or is created as you use the service.
We don’t ask for identity documents or information about your health, beliefs or other sensitive categories, and we don’t need them. Please don’t send them to us.
3. How we use it
We use your information only for the purposes below. For people in the EU or UK, each purpose is listed with its legal basis under the GDPR.
- Run the service: sign you in, run your terminals, carry out your requests and the rules you set, and show you the results
- Needed to perform our contract with you
- Send service emails: confirming your address, resetting your password, workspace invitations, hook alert digests, and billing notices such as a failed payment or a slot bought
- Contract. Invitations rely on the legitimate interest of the workspace that sends them
- Keep the service secure: stop abuse, limit repeated attempts, investigate problems and fix bugs
- Our legitimate interest in a safe, working service, and yours
- Help you when you contact us
- Contract, or our legitimate interest in answering you
- Bill you and keep tax and accounting records
- Contract, and our legal obligations
- Understand how the service is used, from counts and timings that don’t identify you
- Our legitimate interest in running and improving Pipsocket
We don’t:
- sell personal information, or share it for advertising;
- use your trading data to trade, to build strategies, or to give anyone signals;
- use your information to train AI models;
- use your broker password for anything except logging your terminal in to your broker.
We don’t send marketing email. If that changes, we will ask first where the law requires it, and every message will have an unsubscribe link.
No one at Pipsocket, and nothing we run, makes decisions about you with legal or similarly significant effects from your information alone. The automatic steps the service takes, such as placing an order when your alert arrives or moving a trailing stop, follow rules you set. Sign-in limits and alert quotas are fixed limits that apply to everyone the same way.
5. Where it is stored
Our central database runs in Cloudflare’s Western Europe region and is served through Cloudflare’s global network. Each terminal, and the encrypted broker password and data that go with it, lives on a server in the location chosen for that account: the United States, the United Kingdom, France, Australia, Japan or Singapore. Stripe processes payments in the United States and Ireland. Our team works from Australia.
Under Australian law, we take reasonable steps to make sure overseas providers handle your information in line with the Australian Privacy Principles.
If you are in the EU or UK, your information goes to countries the EU or UK has not found to give adequate protection, including Australia and the United States. Where our providers receive it, we rely on the European Commission’s standard contractual clauses and the UK’s addendum to them, or another safeguard the GDPR allows. Ask us for a copy.
6. How we protect it
- Broker passwords are encrypted (AES-256-GCM) with a key made on, and never leaving, the server that runs the terminal. They are never stored in our central database.
- Sign-in passwords, API keys and hook URLs are stored as hashes. Hook URLs are also kept as an encrypted copy, so owners and admins can view them again.
- Terminal servers run no public services. Each one dials out to our network, and the only way in is administrator access over SSH, which needs a key.
- Your connections to Pipsocket, and our terminal servers’ connections to our network, are encrypted (HTTPS and WSS). Your terminal talks to your broker over MetaTrader’s own connection, as it would on any computer.
Some limits you should know about:
- A running terminal must hold your password to log in, and MetaTrader keeps its own account files on the server.
- The few people who administer our servers could, technically, decrypt what is stored on them. Access is limited to people who need it to run the service.
- When you ask for help, our staff may sign in to your workspace as you, only to look into the problem.
No system is perfectly secure. If a breach is likely to cause you serious harm, we will tell you and the regulators the law requires, and tell you what to do, such as changing your broker password.
7. How long we keep it
- Your account, workspaces and settings
- While your account is open. We delete them within 30 days of you asking
- Broker login and server in our central database
- Until you remove the account from your workspace
- Broker password, login, server and terminal files on the terminal server
- Removing an account stops its terminal straight away. The encrypted password, the login and server, and the terminal files stay on that server until we clear them. Ask us and we will delete them within 30 days. Changing your broker password also makes the stored copy useless
- Trade requests and your broker’s answers
- 7 days after the outcome is known
- TradingView alerts and what happened to them
- 30 days after every account has finished with the alert
- Workspace activity log
- While the workspace exists
- Sign-in sessions, with their IP address and browser details
- A session stops working after 7 days, renewed while you use the dashboard. The record stays while your account is open
- Email confirmation and password reset links
- Stop working after 24 hours and 1 hour. The records stay while your account is open
- Invitations, including the invited person’s email
- Stop working after 7 days. The record stays while the workspace exists, and we delete it if the invited person or the workspace asks
- Record of emails we sent you
- 1 day, to limit how many we send
- Cloudflare request logs
- Up to 7 days
- Server logs
- The oldest entries are removed automatically as the server’s log space fills. We delete an account’s entries with its other data on request
- Billing records
- 5 years, as Australian tax law requires
- Support emails
- As long as we need them to help you
We may keep something longer if the law requires it or it is needed for a legal claim, and only for that purpose.
8. Your rights
You can ask us to:
- give you a copy of the personal information we hold about you;
- correct it;
- delete it;
- send it to you in a format you can reuse;
- stop or limit using it, where you object to how we use it.
Where we rely on your consent, you can withdraw it at any time. That doesn’t affect anything we did before.
Email support@pipsocket.com from the address on your account. We will answer within 30 days, and it costs nothing. We may need to check it’s you. If we can’t do what you ask, we will say why: for example, we must keep billing records for tax law.
If you’re unhappy with how we handled your information, email support@pipsocket.com with what happened. We confirm we have it within 7 days, look into it, and give you a written answer, with what we will do about it, within 30 days.
You can also complain to a regulator:
- in Australia, the Office of the Australian Information Commissioner, if you’re not satisfied with our answer or haven’t had one within 30 days;
- in the UK, the Information Commissioner’s Office, at any time;
- in the EU, the data protection authority where you live or work, or where you think the problem happened, at any time.
10. Children
Pipsocket is for adults who trade. You must be 18 or older to use it, and we don’t knowingly collect information about anyone younger. If you think a child has given us information, tell us and we will delete it.
11. Changes to this policy
When we change this policy, we update the date at the top. If a change matters, for example a new kind of information or a new provider in a new country, we will email you before it takes effect.
12. Contact us
WILIER LABS PTY LTD (ABN 57 681 703 328), trading as Pipsocket
Based in Brisbane, Queensland, Australia
Registered office: Level 1, 268 Rosslyn Street, West Melbourne VIC 3003, Australia
support@pipsocket.com