Cognito Markets (“Cognito”, “we”) runs the Cognito terminal and this website. This policy sets out what personal data we hold about you, why we hold it, and the rights you have over it. We keep it short because we collect little.
What we collect
Account data: the email address and password you register with, and the username you choose. Passwords are stored only as a salted hash by our authentication provider.
Billing data: your subscription plan, its status and renewal date, and the customer reference our payment processor assigns you. Card details never reach us; they are held by Stripe under its own privacy policy.
Your journal: the trading accounts and trades you enter or import. This is your data, stored so that only you can read it, and it is never used for anything but showing it back to you.
Your settings: which desks you follow and how you want alerts delivered.
Enquiries: the name, email address and message you send through the contact form or the support form in the terminal.
Technical data: server logs of requests to the service, including IP address and browser, kept for security and to diagnose faults.
What we do not collect
We do not run advertising or tracking pixels, we do not sell or share personal data with data brokers, and we do not profile you for marketing. The terminal stores a handful of preferences in your browser so that it opens the way you left it; those never leave your machine.
Why we hold it
To provide the service you have subscribed to, to take payment for it, to keep the service secure, to answer you when you write to us, and to meet our legal and accounting obligations. Under UK data protection law our bases are performance of a contract, our legitimate interest in running and securing the service, and, where we send you news about Cognito, your consent.
Who else sees it
The providers that run parts of the service on our behalf: our database and authentication provider, our payment processor, our email provider and our hosting provider. Each processes data only on our instructions and under its own security obligations. Some of these providers operate outside the United Kingdom; where they do, transfers are covered by the safeguards UK law requires.
We disclose personal data to no one else unless the law requires it.
How long we keep it
For as long as you hold an account, and then for as long as we must keep records for tax and accounting purposes. If you close your account, your journal and settings are deleted; billing records are retained for the period the law requires and then deleted.
Your rights
You can ask us for a copy of the personal data we hold about you, ask us to correct it, ask us to delete it, object to our processing of it, or ask us to restrict it. You can withdraw consent to marketing at any time by unsubscribing. To exercise any of these, contact us; we will respond within one month. You also have the right to complain to the Information Commissioner’s Office.
Security
Data is encrypted in transit and at rest. Access to production systems is limited to the people who need it to run the service. No system is perfectly secure, and we will tell you, and the regulator where required, if a breach ever affects your data.
Changes
If we change this policy in a way that matters, we will say so on this page and, for significant changes, by email to account holders. The date at the top is the date of the current version.
Questions about any of this: contact us.