Privacy Policy

1. Who is responsible for your data?

The operator and data controller for MT5 Robot Lab / ea-lab.dev is aRCadeRally S.C., Idzikowice 23K, 46-113 Wilków, Poland. Tax identification number (NIP): 7521471639; REGON: 544500661. For privacy requests, contact ea@ea-lab.dev or write to the address above.

2. Data, purposes and legal bases

• Website operation and security: IP address, request time, browser and device information, requested URLs and security events may be processed in server and security logs. Our legitimate interests under Article 6(1)(f) GDPR are operating and protecting the website, preventing abuse and investigating incidents.
• Contact and support: your email address, message and details you choose to provide are used to answer enquiries and resolve problems. The basis is Article 6(1)(b) GDPR for steps requested before a contract or contractual support, or Article 6(1)(f) for other correspondence and legitimate support interests.
• Accounts, orders and licenses: when these services are used, we process registration and contact details, billing details, order and payment status, download records and the trading-account identifiers needed for license activation. This supports the contract under Article 6(1)(b), legal accounting obligations under Article 6(1)(c), and fraud prevention or legal claims under Article 6(1)(f). We do not need your trading-account password.
• Optional analytics: with your consent under Article 6(1)(a), Google Analytics 4 can process cookie identifiers, page views, interactions, approximate location and device/browser details to measure website use. Analytics is blocked until you allow statistics cookies. You may withdraw consent through Cookie settings.
• Consent preferences: we store your choices and the policy version to respect and demonstrate your privacy preferences.

Information needed for an account, a purchase or a support request is necessary to provide that service; without it we may be unable to do so. Optional analytics consent is not required to browse or use the basic service. Do not include credentials or unnecessary sensitive data in a message.

3. Cookies and external links

Necessary cookies support login, sessions, shopping-cart functions and consent preferences. Optional statistics cookies require your choice. Read the Cookie Policy for purposes and storage periods. You can reopen Cookie settings to change or withdraw your consent; withdrawal does not invalidate earlier lawful processing.

Our social-media buttons are external links. Following them takes you to a separate provider with its own privacy practices. If external media is embedded on a page, it must be subject to the applicable consent controls before optional tracking is activated.

4. Who receives data?

Authorized people operating this service and providers of hosting, email delivery, technical support and security process information needed for their functions. WordPress and WooCommerce support website, account and order operations; Wordfence provides website security; Complianz manages cookie choices. Google receives analytics data only when you permit statistics. Where a Stripe payment is available and you choose it, Stripe processes payment and fraud-prevention information under its own applicable terms and privacy information. We do not store full payment-card numbers or security codes in this website.

Relevant data may also be provided to accounting or legal advisers, or authorities where required by law. We do not sell personal data.

5. International processing

Some providers, including Google and Stripe, may process information outside the European Economic Area. Where such transfers occur, applicable safeguards must be used, such as an applicable adequacy decision or standard contractual clauses with any required additional safeguards. Contact us for information about safeguards relevant to your data. Provider information is available in Google’s privacy policy and Stripe’s privacy policy.

6. How long is data kept?

We keep information for the purpose for which it was collected and the applicable legal period. Account data is kept while the account is maintained, subject to deletion requests and any records needed for obligations or claims. Contact records are retained for handling the enquiry and any related complaint or claim. Order, invoice and tax records are retained for statutory accounting and tax periods. Security logs are retained as needed to investigate and prevent incidents. Cookie lifetimes are listed in the Cookie Policy; Google Analytics data retention is managed separately from cookie expiry. Data no longer needed is deleted or anonymized, subject to legitimate backup recovery cycles and legal holds.

7. Your rights

Depending on the legal basis and circumstances, you may request access, correction, erasure, restriction and data portability, object to processing based on legitimate interests, and withdraw consent at any time. We may need proportionate information to verify your identity. Requests can be sent to ea@ea-lab.dev. You may complain to the Polish supervisory authority, the President of the Personal Data Protection Office (UODO), or another competent supervisory authority. See uodo.gov.pl.

8. SOCIAL AUTOPILOT and connected social-media accounts

SOCIAL AUTOPILOT is our administrator-operated tool for scheduling and publishing approved videos for MT5 Robot Lab / EA LAB and ArcadeRally. It uses YouTube API Services and, where connected and enabled, the Facebook and Instagram APIs. This section supplements the website privacy information above.

Information accessed and purposes

With the account owner’s authorization, the tool reads the selected Google Drive READY folders and their MP4 files, including file names, file identifiers, creation dates, sizes and checksums. It uses YouTube read-only and upload permissions to verify the selected channel and upload approved videos with their titles, descriptions and publication settings, then check upload and processing status. It processes channel identifiers and names, video identifiers, upload status, publication times and links. The current YouTube integration does not request Gmail access or use YouTube comments, subscriber lists or viewing history for its publishing workflow.

For connected Facebook and Instagram accounts, the tool uses the authorized page and professional-account identifiers and access tokens to publish approved videos and check their processing status. The administrator controls the source folders, publishing modes and schedule; authorization alone does not enable automatic publication. These operations support the authorized publishing service and our legitimate interests in operating and securing our own channels. You may withdraw platform authorization at any time.

Storage, access and sharing

Project settings, source-file metadata, captions, job records, remote video identifiers, publication results and operational events are stored in an administrator-controlled Google Sheets panel. OAuth refresh/access tokens and application secrets are stored in Google Apps Script Script Properties rather than spreadsheet cells. Access is limited to authorized administrators and service providers needed to operate the tool. We do not request or store your Google or YouTube account password. We do not sell API data or use it for advertising profiles or AI-model training.

Google Drive, Sheets and Apps Script process data for storage and execution. YouTube receives the video and publication metadata when a YouTube upload is enabled. Meta receives the video and caption when Facebook or Instagram publishing is enabled. An isolated media service on our hosting provides temporary MP4 download links for Instagram processing; those links expire after 24 hours. Expired temporary copies are removed during subsequent media uploads, so link expiry does not itself mean immediate file deletion. Source files remain in the administrator’s Drive until removed there. Publicly published videos and captions can be viewed by platform users according to the chosen visibility. Google and Meta also process information under their own policies; international processing is covered by section 5 above.

Retention, disconnection and deletion

Connection credentials are retained while the integration is authorized and needed. Source metadata and publishing records support scheduling, error diagnosis and duplicate prevention. YouTube API data is refreshed or deleted within the applicable 30-day period, and continued authorization is checked when the tool accesses the channel. To request disconnection and deletion of stored connection credentials or API data, contact ea@ea-lab.dev and identify the relevant project or channel; do not send a password or token. We will remove the relevant stored API data as soon as practicable and within 30 days of a verified request, subject to applicable legal obligations for records that are not YouTube API data.

In addition to requesting deletion from us, you can revoke SOCIAL AUTOPILOT’s access through Google account security permissions. Revocation prevents further authorized API access but does not itself delete our stored records. You can also remove Meta authorization in Facebook’s business-integration settings. Deleting records from SOCIAL AUTOPILOT does not automatically delete source files in Drive or videos already published on YouTube, Facebook or Instagram; manage those separately on the relevant platform or include them explicitly in your request.

For questions or complaints about SOCIAL AUTOPILOT’s privacy practices, contact ea@ea-lab.dev. See the Google Privacy Policy, YouTube Terms of Service, and Meta Privacy Policy.

9. Automated decisions, children and updates

We do not use website analytics to make automated decisions with legal or similarly significant effects on you. Trading software can execute rules configured by its user; that does not make website analytics a personal investment recommendation. The service is not directed at children. We update this policy when relevant services or practices change and show the update date above.