This policy explains what personal data DMG TIM, d.o.o. (“we”) collects when you use Spectar FX Gold, why we collect it, and what rights you have. The data controller is DMG TIM, d.o.o., Frankopanska ulica 8, 1000 Ljubljana, Slovenia (reg. no. 6381529000, VAT SI86596462), reachable at [email protected].
| Data | Why | Legal basis |
|---|---|---|
| Email address | send your licence key and service notices | performance of a contract |
| MetaTrader account number (you enter it at checkout; Stripe passes it to us with your order) | your licence key is bound to it, so it can be tied to one account | performance of a contract |
| Record of your four checkout confirmations: each of the four confirmations separately (Terms, Privacy Policy and age; risk warning; immediate delivery and loss of the right of withdrawal; where you live), the version and date of the Terms you confirmed, the time of the confirmation, the address of the page you confirmed on, the plan and billing period, and a random reference number | to be able to show that the confirmations required by consumer law were given before your purchase: the burden of proving this is on us as the seller (Article 130 of the Slovenian Consumer Protection Act, ZVPot-1), and the right of withdrawal for digital content lapses only if those confirmations were in fact given (point 13 of Article 135 ZVPot-1) | performance of a contract, and compliance with a legal obligation |
| Your browser language and your browser identification string (user agent, up to 300 characters), sent together with that record | to show which language version of the Terms you were shown, and on what device the confirmation was given | compliance with a legal obligation |
| Your IP address and the country derived from it (both added by our server when the record arrives) | the same proof, and a record of where you confirmed from — which matters for the declaration about restricted jurisdictions | compliance with a legal obligation, and our legitimate interest in preventing false residence declarations |
| Data from your MetaTrader 5 terminal and from the application, your profile, your licence key and the IP address of your computer, sent while the application runs (section 2) | to run the trading rules of our server for your account and return their results to your application | performance of a contract |
| Licence check: licence key, MetaTrader account number, an identifier of your computer (section 2c) | to confirm that your subscription is valid and bound to one account and one computer | performance of a contract, and our legitimate interest in preventing one licence from being used by several people |
| Support messages you send us, including any log files you attach (the application’s log files contain your account number, broker server name, balance, positions and trade results) | answer you | performance of a contract |
That record is sent to our own licence server
(licence.spectarfx.com) the moment you press the order button,
before you reach the payment page, and is stored there. The code that travels to Stripe with
your order is only a random reference number: it does not contain the confirmations
themselves, it points to the record we hold. How long we keep it is set out in section 4.
Name, billing address, billing country and payment details: collected by our payment provider, not by us — see section 3 on roles.
Referral codes. If you enter a referral code at checkout, we record which code was used with your order, so that we can calculate the commission of the code owner (performance of a contract, and our legitimate interest in paying commissions correctly); the code owner does not receive your name, email address or account data from us.
While it runs, the application continuously sends our server the data listed in section 2. Without those data the trading rules cannot be applied to your account, so the Service does not work without them.
The application keeps two permanent, encrypted connections to our server: one carries the snapshot of your terminal (2.1), the status of the application (2.2) and your profile (2.3) to our server and the results of the rules back to the application; the other carries decision requests (2.4) and their answers. Each connection starts with your licence key (2.5). Our server accepts nothing else from the application before your subscription has been confirmed, and it accepts only these named files; any other file is refused.
Only for gold (XAUUSD), in three parts:
| How often | What is sent |
|---|---|
| About once per second | the current price (bid, ask, last, volume, time, flags, real volume); the ticks of the last few seconds with all their fields; the last three candles of each timeframe (one minute, five minutes, fifteen minutes, one hour, four hours, one day); your XAUUSD deals of the last two hours; your account; the offset of your computer’s clock from UTC |
| Every 30 seconds | 1,700 one-minute candles, 300 five-minute, 200 fifteen-minute, 200 one-hour, 200 four-hour and 100 daily candles; your XAUUSD deals of the last four days; your account |
| Every 30 minutes | 10,080 one-minute candles; your XAUUSD deals since 1 January 2026; your account |
Candles carry time, open, high, low, close, tick volume, spread and real volume. Deals carry all fields MetaTrader returns: ticket, order, time, type, entry, magic number, position ID, reason, volume, price, commission, swap, profit, fee, symbol, comment and external ID. Deals in any other symbol are not sent, and neither are deposits or withdrawals (MetaTrader records them without a symbol). Account means only these four fields: account number (login), balance, equity and the name of your broker’s server.
The numbers you set in the panel: ladder, maximum number of legs, lot size after the ladder, scope of the trailing stop, reverse level, reverse loss, trailing trigger and step, profit floor, chain trigger and chain limit, daily loss limit and daily profit target. Our server checks only that each value is a valid number.
| Request | What is sent |
|---|---|
| Trailing stop | profit or loss per lot of the open position, the highest profit per lot so far, spread per lot, trailing trigger and step |
| Reverse | direction of the position, profit or loss per lot, market indicators received earlier from our server, recent five-minute candles, time of the last reverse, current time |
| Limits for a lot size | the lot size |
| First-entry check | broker label, direction (buy or sell), price |
At the start of each connection the application sends your licence key and the broker label you entered in your configuration. Our server checks the key with our licence server (section 2c) — without the identifier of your computer — and keeps your data in a folder named after a one-way hash of your key, not after the key itself. Like any network connection, the connection also reveals to our server the IP address of your computer and the times at which it connects.
For your account, our server runs the trading rules as separate processes over the data from your own terminal and your profile, and returns their results to your application: whether an entry is allowed, whether a position is held, trailed, reversed or closed, and which limits apply. In your folder it keeps the latest version of the data in sections 2.1 to 2.3, the working state and the logs of the rules for your account, statistics of your trades and an archive of your XAUUSD deals. The data of each subscription are kept separately, and one customer’s application cannot read or overwrite another customer’s data.
Automated decisions. The trading rules make decisions on your account automatically, within the numbers you set — for example whether an entry is allowed and when a position is trailed, reversed or closed. They use only the data in sections 2.1 to 2.4: prices from your terminal, the state of your account and positions, and your profile; they use no other information about you. This processing is necessary for the contract you conclude with us (Article 22(2)(a) GDPR). You set the numbers and choose the plan (in MANUAL and SEMIAUTO no entry is made without you), and you can switch the application off at any time. You can also write to [email protected] to express your point of view on a decision, to contest it and to have it reviewed by a person.
Purpose and legal basis. We use these data only to provide the Service to your account and to keep it working. The legal basis is performance of our contract with you (Article 6(1)(b) GDPR): the Service cannot apply its rules to your account without them. We do not use them for advertising and we do not sell or rent them.
The application can send you a message when something happens on your account: a position opened, a position closed, a reverse, a trailing stop activated or hit, the daily stop, a position reduced or restored, the bot stopping, or an order that failed. Three channels are available — Telegram, WhatsApp (through the CallMeBot service) and email (through an SMTP mail account you configure; if you leave the server field empty the application uses Gmail’s SMTP server with your own login).
All three are off by default. Each one works only after you enter your own credentials — your Telegram bot token and chat ID, your CallMeBot key and phone number, or your own SMTP details. We never see those credentials and we do not operate any of these services.
If you switch a channel on, the application sends that provider, from your machine:
| Event | What the message contains |
|---|---|
| Position opened | direction, lot size, entry price, stop loss, ticket number, mode; the email version also carries the order’s magic number and a timestamp |
| Position closed | profit or loss, account balance, room left before your daily stop, number of trades that day, win rate; the email version also carries entry and exit price, open and close time, duration, balance before and after the trade, the day’s total and start-of-day balance, and the reason for closing, with your broker’s name in the subject line |
| Reverse | new direction, anchor price, lot size, profit or loss of the closed leg and of the chain so far |
| Trailing stop activated / hit | trigger level, lot size, locked profit, best profit seen |
| Daily stop, bot stopped, position reduced or restored, failed order | the reason and the profit or loss at that moment |
Each channel receives your own access details together with the message: Telegram receives your bot token and chat ID; CallMeBot receives your phone number and API key as part of the request address; your mail server receives your SMTP login. None of them receives your MetaTrader account number or broker password.
That data goes to the provider you chose, not to us. Their own privacy policy applies to it. If you would rather no message left your machine, leave all three switched off. This does not stop the data in section 2 from being sent to our server, which the Service needs in order to work.
To compute its rules, our server downloads public market data from: Yahoo Finance (prices of the US dollar index, US Treasury yields, silver, oil, VIX, Bitcoin, gold futures and the GLD ETF including its options open interest), Stooq (gold spot price), Forex Factory (the economic calendar) and the CFTC (weekly Commitments of Traders report). These requests are made by our server, not by your computer, and contain nothing about your account. These providers’ own privacy policies apply to them.
To confirm that your licence is valid, the application contacts our licence server
(licence.spectarfx.com) when it starts, and after that at most
once every six hours. Each request contains only:
| What is sent | Why |
|---|---|
| Your licence key | to find your licence |
| Your MetaTrader account number | your key is bound to one account; a key used on a different account is refused |
| An identifier of the computer (a one-way hash of hardware and user name, not the names themselves) | so the Application can run on up to three of your own machines; moving to another one is free and immediate |
| A random number generated for that request | so an old answer cannot be replayed to the application by someone else |
The answer is a signed yes or no, with your plan and the date your subscription runs to. Like any web request, the request also reveals your IP address to that server. Our trading-rules server asks the licence server the same question with your licence key (section 2.5).
What the licence check does not send: your balance, your open positions, your trade history, your results, your broker password or your broker credentials. Your balance, positions and XAUUSD deals are, however, sent to our trading-rules server through the separate connection described in section 2.
Without a connection to our trading-rules server the application does not start and opens no new position; an open position stays on your account with the stop loss placed at your broker. Legal basis: performance of our contract with you, and our legitimate interest in preventing one licence from being used by several people. We keep the licence record for as long as your licence exists and for 12 months after it ends; invoices and tax records are kept longer, as section 4 sets out.
licence.spectarfx.com), which stores licence and payment status records and the
record of your checkout confirmations. Processor.Some of these providers operate outside the EEA. Where that happens, transfers are covered by the European Commission’s Standard Contractual Clauses or an equivalent safeguard.
Under Regulation (EU) 2016/679 (GDPR) and the Slovenian Personal Data Protection Act (ZVOP-2) you have the right to access your data, correct it, delete it, restrict or object to its processing, receive it in a portable format, and withdraw consent where processing is based on consent. To exercise any of these, email [email protected]; we answer within one month. If you ask us to delete or restrict the data in section 2 while your subscription is active, we do so; the Service then cannot apply its rules to your account. You can stop the data being sent at any time by closing the application. For the data Stripe and Link control (section 3), you can also contact them directly. You also have the right to lodge a complaint with the Slovenian Information Commissioner (Informacijski pooblaščenec) or with the supervisory authority in your own country.
This website uses no advertising or analytics cookies and loads no Stripe script. Cloudflare may set a strictly necessary cookie for security and to keep the site available. When you tick the four confirmations, they are kept in your browser’s session storage for that tab and, when you press the order button, the record described in section 1 is also sent to our licence server and stored there. Only a random reference number is added to the checkout link; it does not contain the confirmations themselves.
When you continue to checkout you leave this website: the checkout page is operated by Stripe (buy.stripe.com). Stripe may collect personal data there, including via cookies and similar technologies, such as transactional data and identifying information about the devices that connect to its services, and uses it to operate its services, including for fraud prevention and detection and authentication. Stripe’s Privacy Policy applies there.
Our licence answers are signed cryptographically and the signature is verified on your own computer, so an answer from anyone but us is rejected. Our website, the licence check and our email are served over encrypted connections. Both connections between the application and our trading-rules server are encrypted in transit (TLS 1.2 or higher); before it sends anything, the application checks that the server presents a valid certificate for our server’s name, so a connection to a server that is not ours is refused. Our server accepts nothing before the subscription check in section 2.5, checks the subscription again at least every five minutes, and closes a connection whose subscription has ended. Decision requests can call only a closed list of functions. Access to customer records is limited to people who need it to run the service. No system is perfectly secure; if a breach affects your rights we will notify you and the relevant authority as required by law.
The Service is not offered to anyone under 18, and we do not knowingly collect data from children.
If we change this policy materially we will email subscribers and update the date above.
DMG TIM, d.o.o., Frankopanska ulica 8, 1000 Ljubljana, Slovenia — [email protected]