This page still contains unfilled placeholders, shown in amber below. Fill them in tools/gen-legal.py and re-run it, then have a lawyer review all four legal pages before launch. This banner disappears automatically once every placeholder has a value.
The short version. We collect your email address if you give it to us, and the purchase details our payment processor needs to sell you software. We do not sell your data, we do not share it for advertising, and we do not run advertising or analytics trackers on this site. You can be removed from everything at any time by emailing us.
1. Who is responsible
[ENTITY], a Virginia limited liability company trading as Holdfast, is the controller of personal data described in this policy.
[ENTITY]
[ADDRESS]
support@holdfastlevels.com
2. What we collect
| Data | When | Source |
|---|---|---|
| Email address | When you request a free tool, or when you buy something | You give it to us |
| Purchase records order ID, product, amount, date, country, license key |
When you buy something | Lemon Squeezy, our payment processor |
| Email engagement whether an email was opened or a link clicked |
If you are on our mailing list | Our email provider |
| Support correspondence | When you email us | You |
| Machine name and username e.g. DESKTOP-A1B2C3-mahlet |
When you activate a paid license | Your computer, via the software |
| Server and form logs IP address, browser type, page requested |
When you visit the site or submit a form | Our host, automatically |
We never receive your payment card details. Lemon Squeezy processes payment and we only see the order record afterwards.
We never receive your trading data. No positions, no orders, no account balances, no P&L, no broker credentials, no chart data. See section 6.
3. Why we use it, and our legal basis
| Purpose | Data used | Legal basis (GDPR) |
|---|---|---|
| Deliver a free tool you requested | Consent | |
| Deliver software, license keys, and receipts you purchased | Email, purchase record | Performance of a contract |
| Validate licenses and enforce activation limits | License key, machine name | Performance of a contract |
| Notify you of updates and important changes to software you own | Email, purchase record | Performance of a contract; legitimate interests |
| Send marketing emails about our products | Email, engagement | Consent |
| Answer support requests | Correspondence, purchase record | Legitimate interests; contract |
| Keep the site secure and working | Server logs | Legitimate interests |
| Meet tax, accounting, and legal obligations | Purchase records | Legal obligation |
We do not sell personal data, and we do not share it for cross-context behavioral advertising. We have never done so and have no plans to.
Every marketing email carries a one-click unsubscribe link and our postal address. Unsubscribing stops marketing email; you will still receive transactional email about software you have purchased, such as a license issue or a security-relevant update.
4. Who we share it with
We share the minimum necessary with service providers who process data on our behalf, under contract, and who are not permitted to use it for their own purposes:
- Lemon Squeezy — payments, invoicing, license key issuance. Merchant of record.
- Our email provider — stores the mailing list and sends email.
- Netlify — hosts the website and receives form submissions.
- Our accountant and, where required, tax authorities — purchase records only.
We will also disclose data if legally compelled, or where necessary to protect our rights or someone's safety. If our business is ever sold or merged, purchase and contact records may transfer as part of it; we would tell you before that happened.
5. Cookies and third-party requests
This website sets no cookies of its own. There is no advertising network, no analytics tracker, no pixel, and no cross-site profiling on this site.
One third-party request is made on every page: web fonts are loaded from Google Fonts. This means Google receives your IP address and browser information when a page loads, and its own privacy policy applies to that. It is used to render type, not to identify you, and we receive nothing from it.
If you would rather this did not happen at all, the fonts can be self-hosted, which removes the request entirely. It is on our list.
Lemon Squeezy sets its own cookies during checkout on its own pages, governed by its privacy policy.
6. What the software collects
This is worth being precise about, because it is trading software running on your machine.
The paid indicators transmit exactly one thing: when you activate a license, they send your license key and a machine identifier — your computer's machine name and username, joined together — to Lemon Squeezy's license API. That identifier exists so you can see which machines a key is active on and release one yourself. Validation repeats periodically, and the result is cached locally so a dropped connection does not lock you out mid-session.
The free tools transmit nothing at all. They have no license check and make no network requests.
No Holdfast software transmits any market, trading, or account information. Order book data, trades, positions, balances, instruments, chart configuration, and broker credentials never leave your machine. We could not see your trading if we wanted to.
Locally, the software writes a small cached license file and a temporary display cache into your NinjaTrader documents folder. Both stay on your computer.
7. How long we keep it
- Mailing list — until you unsubscribe or ask to be deleted. Addresses with no engagement for 24 months are removed in routine list cleaning.
- Purchase records — as long as required by tax and accounting law, generally seven years.
- License and activation records — for the life of the license, plus a short period afterwards to handle refunds and disputes.
- Support email — up to 24 months after the conversation ends.
- Server and form logs — short-term, per our host's default retention.
8. Your rights
Wherever you live, you may ask us to:
- Tell you what we hold about you, and give you a copy.
- Correct anything inaccurate.
- Delete your data, subject to records we must keep for tax and legal reasons.
- Stop marketing to you — instantly, via any unsubscribe link.
- Export your data in a portable format.
- Object to or restrict processing based on legitimate interests.
Email support@holdfastlevels.com and we will action it. We aim to respond within 30 days and will not charge you or make you justify the request. We will not discriminate against you for exercising any of these rights — your software keeps working and your price does not change.
9. EU and UK residents
Where the GDPR or UK GDPR applies, you have the rights in section 8 as statutory rights, plus the right to withdraw consent at any time (without affecting processing already carried out) and the right to lodge a complaint with your national supervisory authority. We would appreciate the chance to fix the problem first.
We do not carry out automated decision-making or profiling that produces legal or similarly significant effects.
10. US state privacy rights
Residents of California and other states with comprehensive privacy laws have rights to know, delete, correct, and opt out of sale or sharing, and to appeal a refusal.
We do not sell personal information and we do not share it for cross-context behavioral advertising, so there is nothing to opt out of — but the request mechanism in section 8 covers every other right, and you may use an authorized agent. We do not collect sensitive personal information as those statutes define it.
11. International transfers
We operate from the United States and our service providers are largely US-based, so data about you will be processed in the US and potentially elsewhere. Where data is transferred out of the EEA or UK, our providers rely on Standard Contractual Clauses or an equivalent approved mechanism.
12. Children
This site and our software are intended for adults trading their own capital. They are not directed at children, and we do not knowingly collect personal data from anyone under 16. If you believe a child has given us data, email us and we will delete it.
13. Security
The site is served over HTTPS. Payment processing and license storage sit with established providers rather than on our own infrastructure, which is deliberate — it is the single biggest reduction in risk available to a business this size. Access to the mailing list and order records is limited to us.
No system is perfectly secure. If a breach affecting your personal data occurs, we will notify you and any required regulator within the timeframes the law sets.
14. Changes
We will update this policy as the business changes. The effective date at the top always reflects the current version. For material changes we will notify anyone on our mailing list by email before they take effect.
15. Contact
Privacy questions, requests, or complaints:
[ENTITY]
[ADDRESS]
support@holdfastlevels.com