Legal

Privacy policy

Javlot’s privacy policy: the data collected, its purposes, its retention and the rights of individuals.

In force since September 27, 2026

Publisher Javlot, SAS

1. Introduction

Javlot places great importance on protecting personal data and respecting user privacy.

This Privacy Policy explains:

  • what personal data is collected,
  • why it is collected,
  • the legal basis for processing,
  • how it is protected,
  • and the rights of users under the General Data Protection Regulation (GDPR – EU 2016/679).

2. Data controller

The data controller is:

Javlot Simplified joint-stock company (SAS) Registered office: 50 avenue des Champs-Élysées, 75008 Paris, France

Contact: support@javlot.io

3. Personal data collected

Javlot collects only data strictly necessary for providing its services.

Collected data may include:

  • identification data (name, email address),
  • contact information (including phone number, if you choose to provide it),
  • technical usage data,
  • billing-related information,
  • onboarding and service configuration data,
  • brokerage account identifiers (MetaTrader 5 login, server name, broker name),
  • trade history and periodic balance snapshots for billing and performance reporting purposes,
  • hashed identifiers used for fraud prevention (trial abuse detection).

Payment data. Payments are processed by third-party payment providers: a card's full number, its security code and the bank details the user pays their subscription with do not pass through Javlot's servers and are not stored there. To warn the user before their card expires and to tell them why a payment was declined, Javlot keeps the type of the payment method that pays the subscription and, for a card, its brand, its last four digits and its expiry date, as well as the reason for the last declined payment when the payment provider gives it. This information is deleted at the end of the subscription. The notifications already sent to the user that mention them stay in their history until their account is deleted.

The payout details of Partners and Providers. To pay their commissions to referral Partners and their remuneration to strategy Providers, Javlot stores the payout details they enter: an IBAN, a PayPal address or a crypto-asset wallet address, depending on the payout method chosen. A Partner's payout details are deleted with their account; a Provider's are kept for as long as the Provider is listed on the platform.

The brokerage account password. Connecting a brokerage account requires its password. It is encrypted in the user's browser before it is sent, decrypted in memory by Javlot's servers for the time needed to establish the connection, then transmitted to the Technical Replication Provider, which retains it for as long as the account stays connected. It is stored in no Javlot database, neither at connection time nor afterwards. A password change by the user follows the same path.

The password of a Provider's source account. When a user connects a brokerage account as a strategy Provider, the password of that account is, by contrast, retained by Javlot in encrypted form, because it serves several operations over time: it is transmitted to the Technical Replication Provider for the reproduction of operations, to the MetaTrader terminal connection provider used for the strategy's live chart, and to the account history import service operated by Javlot on its own hosting. It is deleted at the end of the provider agreement.

For technical and billing purposes, Javlot accesses account information in read mode transmitted by the Technical Replication Provider and by the broker, such as balance, equity, and operation history. This access does not allow Javlot to access user funds. Outside the cases provided for in the Activating a strategy and Interruption and limitation of copying articles of the Terms of Sale, Javlot initiates no order and modifies no position on a user's account.

For fraud prevention purposes, Javlot may retain a cryptographic hash (SHA-256) of the user's email address and the associated brokerage account identifier. These records are retained indefinitely and are used solely to prevent repeated trial abuse.

4. Purpose of data processing

Personal data is processed for the following purposes:

  • account creation and management,
  • service delivery and operation,
  • connection of the brokerage account and automated reproduction of the operations of the strategy chosen by the user,
  • making available to the strategy's Provider the data needed to monitor its subscribers and answer their questions,
  • technical support and communication,
  • contacting users about our services (phone or WhatsApp), for users who have chosen to share a phone number,
  • billing and payment management,
  • service improvement and security,
  • compliance with legal obligations.

5. Legal basis for processing

Data processing is based on:

  • performance of a contract (Terms of Use / Terms of Sale),
  • legal obligations,
  • Javlot's legitimate interests (security, service improvement),
  • user consent where required.

6. Data recipients

Personal data may be shared with the following recipients, each limited to the data necessary for its function; the allocation of roles between them is described in the Who does what article of the Terms of Sale:

  • Mirala GmbH (Miralago 571, 7743 Brusio, Switzerland), publisher of MetaCopier, Technical Replication Provider: connection of brokerage accounts, automated reproduction of operations, and technical execution data. Receives the brokerage account credentials, including the password, and retains them for as long as the account stays connected.
  • The broker chosen by the user: it holds the user's account and funds, under its own contract with the user, and executes the operations transmitted to that account.
  • The Provider of the strategy the user follows, an independent third party acting as a processor on Javlot's behalf: accesses, in its own workspace, the name and contact address of its subscribers, their subscription status, the number of connected accounts, and the strategies they follow, solely to monitor its strategies and answer its subscribers' questions. It accesses neither balances, nor results in currency, nor brokerage credentials, nor payment methods.
  • Stripe, Inc. (United States): payment processing.
  • Supabase, Inc. (United States / European Union): database hosting and authentication.
  • Vercel, Inc. (United States): website hosting and delivery.
  • Agilium Labs LLC (30 N Gould Street, Suite 6200, Sheridan, WY 82801, United States), publisher of the MetaApi service: connection to a Provider's source account for the strategy's live chart. Receives that account's credentials, including the password. Does not concern subscribers' accounts.
  • Fly.io (United States, instances hosted in Paris): hosting of related technical services, including the import of Providers' source account history.
  • Resend, Inc. (United States): sending transactional and lifecycle emails.
  • Cloudflare, Inc. (United States): object storage and file delivery (invoices, documents, media).

These recipients operate under appropriate safeguards in compliance with GDPR. Javlot may use one or more Technical Replication Providers, replace one, or split technical functions between several; this list is then updated and users are informed.

Javlot does not sell or rent personal data.

7. Data retention

Personal data is retained only for the duration necessary to fulfill the purposes for which it was collected and in accordance with applicable laws.

Data is then deleted or anonymized.

8. Data security

Javlot implements appropriate technical and organizational measures to ensure data security, including:

  • restricted access,
  • encryption where appropriate,
  • secure infrastructure,
  • regular audits and controls.

9. User rights

Under the GDPR, users have the following rights:

  • right of access,
  • right to rectification,
  • right to erasure,
  • right to restriction of processing,
  • right to object,
  • right to data portability.

Requests can be sent to: support@javlot.io

10. Cookies

Javlot.io may use cookies necessary for website operation, analytics, and user experience improvement.

Users may manage cookie preferences via browser settings or on-site tools.

11. International data transfers

Some of Javlot's service providers are located outside the European Union, including in the United States and in Switzerland. The broker chosen by the user, and the Provider of the strategy they follow, may also be established outside the European Union; their jurisdiction is stated on the broker's page and on the Provider's public profile respectively.

When such transfers occur, appropriate safeguards are applied, such as Standard Contractual Clauses (SCCs) approved by the European Commission, or reliance on adequacy decisions where applicable.

12. Policy updates

Javlot reserves the right to update this Privacy Policy at any time. Users will be informed of any significant changes.

13. Contact and complaints

For any questions regarding personal data protection, users may contact: support@javlot.io

Users also have the right to lodge a complaint with their local data protection authority.