1. Controller
The TCC operator is the controller of personal data processed by the service. Full legal identification will be published once legal review is complete.
2. Data processed
- Authentication and identity: email and optional MFA. Authentication credentials are managed by the authentication provider. TCC does not access or store passwords in readable form.
- Profile: display name and preferences.
- Trading accounts entered by the user.
- Operation records, results, withdrawals, goals, and journal entries created by the user.
- Subscription and billing status (plan, period, status).
- Technical identifiers required for operation (internal IDs).
- Sanitized operational logs, without exposing raw PII.
- Auditable administrative actions, when applicable to the user.
3. Purposes
- Provide the contracted service.
- Keep the account secure and prevent fraud.
- Process the subscription through the payment operator.
- Comply with applicable legal, accounting, and tax obligations.
- Improve platform stability and quality.
4. Candidate legal bases
Contract performance, compliance with legal obligations, and legitimate interest are the most likely candidate legal bases. Final confirmation depends on legal review.
5. Retention
- Operational data: while the account is active.
- Financial and tax data: for the legally required period.
- Security logs: for a reasonable period for incident investigation.
- After account closure, data may be anonymized when compatible with the purpose.
6. Sharing with operators
TCC uses external operators only when necessary to run the service.
Stripe processes the contact, billing, and payment data required for checkout. TCC keeps only technical references and the minimum financial state required for subscription, reconciliation, support, and audit. TCC does not store full card numbers or CVC. Stripe acts as a payment processor and does not take on the formal seller-of-record role.
- Database and authentication infrastructure (Lovable Cloud / Supabase).
- Payment processing (Stripe).
7. International transfers
Some operators may process data outside Brazil. Where applicable, TCC will adopt safeguards compatible with the LGPD.
8. Security
TCC applies controls such as in-transit encryption, row-level access policies (RLS), optional multi-factor authentication, and log sanitization.
9. Data subject rights
- Confirmation that processing exists.
- Access and correction of data.
- Portability when applicable.
- Deletion within legal limits.
- Objection and consent withdrawal when applicable.
10. Privacy channel
Official channel in preparation. The privacy email will be published once legal identity is defined.
11. Minors
The service is not intended for anyone under 18 and does not intentionally collect data from minors.
12. Incidents
In the event of a relevant incident, TCC will follow applicable notification obligations to the ANPD and data subjects when required.
13. Updates
This policy may be updated. Material changes will be communicated inside the service.
14. TCC · Market Collector extension
The Market Collector is an optional, separately distributed and free browser extension that fetches quotes, news and the economic calendar from public sources using the user's own device connection. It exists because the TCC does not redistribute market data: the trader's device is what fetches it, and the TCC only displays what the device already holds.
The extension does not collect browsing history, does not read the content of pages the user visits, and does not inject scripts into any site other than the TCC's own addresses. On those pages, the message exchange carries only the name of the requested area, the user's list of symbols and — when they use instrument search — the term they typed themselves — and, for the chart, the key of the chosen window (“1 day”, “30 days”…), from a closed list. Never the address of an open page: the extension is what builds the request address, from a closed list of sources.
What the extension collects from public sources stays on the device and, when the user is signed in, is written to their TCC account so the phone can see what the computer collected. That data is isolated per user in the database (RLS) and follows the same retention and deletion rules as the rest of this policy.
The extension carries no advertising and no analytics of its own, and the TCC neither sells nor hands over to third parties what it collects. Uninstalling the extension stops collection immediately; records already written to the account are deleted with the account or on request through the privacy channel.
15. Cookies, pixels and visit origin
Necessary cookies (login, language, preferences) are always on. The others only work with your consent in the cookie banner, which you can change at any time through the "Cookie preferences" link in the footer.
We store in your browser where your first visit and your last visit with a known origin came from (campaign parameters such as utm_source, referring site, landing page and referral code). This does not identify you and only reaches our servers when you create an account, so we know which channels bring customers (legitimate interest).
- Measurement (with consent): an anonymous browser identifier that links visits to the account created. Withdrawing consent deletes the identifier.
- Advertising (with consent): Meta (Facebook and Instagram) and TikTok pixels, which receive events such as visit, sign-up and subscription start, to measure ads and show TCC to past visitors. These processors handle data under their own policies.
- Without consent, no ad script is loaded.
