Privacy notice

01Who is responsible

lotsback.com is operated by the person or business that runs it and pays your cashback. In this notice, LotsBack means that operator. LotsBack decides why and how your personal data is used, which makes it the controller.

Your broker is a separate controller. It decides how it uses the data it holds about you under its own privacy notice, and LotsBack cannot change that.

Privacy questions: support@lotsback.com, with Privacy in the subject. That mailbox is also the data protection contact.

02Who this notice covers

This notice covers you if you use the LotsBack website or application, hold a LotsBack account, invite someone or were invited, or appear in a report that a broker sends to LotsBack. Partner pages show only what a listed partner chose to publish about itself.

03What LotsBack collects

LotsBack collects only what the service needs. In outline:

• Account: your email address, display name, language and time zone, the version of the legal documents you accepted, and your notification preferences. Signing up asks for your email address and nothing else. A country is optional and is held only if you enter one yourself; LotsBack does not take it from your broker account and does not work it out from your IP address.
• Identity verification, once, before your first payout: your legal name, date of birth, country, the type of identity document you used and the last four characters of its number, plus the result. The full document number goes to the identity-verification provider and is not stored by LotsBack.
• Trading connections: the broker, platform, server and login identifier of each account you connect. For MetaTrader 5, the investor password you enter, which is read-only, is passed to the trading-data provider that opens the connection. For TradeLocker, the sign-in details you enter are used once to open the connection, and the renewable access token is kept encrypted so the connection can continue. LotsBack only ever reads.
• Trading activity: the closed positions read from your connected accounts, with instrument, direction, volume, open and close time and price, and any commission the broker reports; the account type; and the sync status.
• Broker reports: the attribution, volume and commission reports your broker sends about accounts introduced through LotsBack, including the broker's own client reference for you.
• Cashback and payouts: every cashback line and its state history, adjustments and their reasons, holds, your payout destinations, payout requests, fee quotes and receipts, and transaction hashes.
• Referrals: your referral code, who invited you or whom you invited, the status of each referral and any commission it produced.
• Tools: the journal entries, tags and mood notes you write; your chat conversations; which news posts you have read; and the estimate you carried in from the calculator.
• Support and notifications: messages you send, closure requests, replies, and the notifications LotsBack sent you.
• Technical and security data: your IP address and the time of every sign-in and of every action that changes something, the reference id of each request, whether two-factor authentication is set up, and error reports from your browser when something breaks.
• Staff access records: when a member of LotsBack staff views your account in read-only mode to help with support, that session is recorded.

04Where it comes from

Most of it comes from you, when you register, connect an account, add a destination, write in the journal or chat, or contact support.

The rest comes from your broker and from the trading-data providers that read your connected accounts; from the payout provider and the public blockchain, which confirm each payout; from the person whose invite link you used; and from your browser, which sends technical data with every request.

05Why LotsBack uses it, and the legal basis

Data protection law requires a legal basis for each purpose. LotsBack relies on the contract with you, on its legitimate interests, on legal obligations and, for marketing only, on your consent.

• To run your account, connect trading accounts, check cashback under the published rules, verify it against broker reports and pay it out: the contract with you.
• To provide the journal, the chat, the calendar, news and signals: the contract with you.
• To answer your support requests, look into your account and keep your account records accurate, with the help of the AI services named under Chat: the contract with you.
• To verify your identity before the first payout, and to hold or reject amounts that do not meet the published conditions: the contract with you, and LotsBack's legitimate interest in paying only the right person for genuine trading. Where a law requires identity checks, that legal obligation.
• To detect manufactured volume, self-referral, shared accounts and other abuse, which includes comparing IP addresses and display names between a referrer and the person they invited, and matching the client references in broker reports: LotsBack's legitimate interest in protecting the cashback pool and the brokers it works with. Referral signals are saved for a person to review and do not act on their own.
• To keep an audit trail of who did what, when and from which address, so that money movements can be reconstructed and disputes settled: LotsBack's legitimate interest, and the legal obligation to keep financial records.
• To keep the service secure, monitor errors and measure performance: LotsBack's legitimate interest in a service that works.
• To send service messages about your account, cashback, payouts and security: the contract with you.
• To send marketing, if LotsBack ever does: your consent, which you would give in Settings and could withdraw at any time.
• To answer a regulator, a court or a lawful request from an authority, and to establish or defend legal claims: legal obligation and legitimate interest.

06What LotsBack never does with it

LotsBack does not sell personal data or use trading records to build advertising profiles. If you choose Accept all, limited visit identifiers and registration conversions are shared with the measurement and advertising providers described below, and PostHog also receives your account email and name and session replays. Your trading records are used to check and verify cashback and to run the tools.

07Chat

The chat answers questions about your own cashback and trading records. To answer, it reads the records LotsBack already holds for you: positions, cashback lines and their states, cycles, the rules in force, broker costs, profit and loss per trade and per month as your broker reported it, and your journal entries; for a question about a market it also reads public headlines from the news feed, which contain nothing about you. Your questions and its replies are stored so that you can return to the conversation.

LotsBack has three AI features, and they work differently. The coach chat runs only when you connect your own AI provider key; your question and the records needed to answer it then go to that provider under your own account and that provider's terms, which decide where it processes them and how long it keeps them. Without a key of your own the coach chat is off. The support assistant, in the app's support chat and in replies to support email, runs on LotsBack's own keys with the AI services of OpenAI and Anthropic; a console setting decides which of their models answers, and the purpose is to answer your support request and keep your account records accurate. To answer, it sends that provider your question, the public help pages and, for a question about your account, a summary of your own records: your connected accounts with logins shortened, recent trades by week and how they counted, your wallet, your payouts with addresses shortened, your invites and your open tickets. The summary is read with your own access rights, so it can hold nothing about anyone else, and it carries no email address or name, no password, no two-factor secret, no broker sign-in details, no full wallet address and nothing from your identity check. Your Support PIN is taken out of the text before it is stored or sent. By email, that summary is used only after you send your Support PIN.

The staff console assistant is used by LotsBack staff, not by you. Staff use it to look up traders' accounts and to answer questions about them and about support cases. It runs on LotsBack's own keys with the AI services of OpenAI and Anthropic, and a console setting decides which of their models answers. It reads only what the staff member's role can already see in the console, and it cannot change anything. To answer, it sends that provider the staff member's question, which can contain your name, email address or account number, with the earlier questions and answers of the same conversation, and what it looks up about you: your email address shortened to its first letter and its domain; your user id; whether your account is restricted or on hold; your connected trading accounts with the broker, the account type, whether each is connected and earns and why not, and, in some answers, the full account number; your trades and lots by week and how they counted; money figures: cashback earned, owed and paid, your bonus progress, your wallet balances and your payouts by reference, amount, asset and network; the people you invited, with their email addresses shortened, and what their trading earned you; your support tickets by reference, subject line, status, channel and the date of the last message; and how many times a connection failed on a wrong password, with any sign-in or connection lock in force and when it ends. It sends no password, no two-factor secret, no broker sign-in details and nothing from your identity check. It also sends no payout wallet address, no IP address and not the messages in your support tickets. LotsBack does not store the question or the answer; it records which staff member asked, which lookups ran and which records they read.

The three features above are the only ones that send personal data to an AI model. LotsBack may also use AI models of its own to help run the service, for example to review risk and fraud signals, in the cloud or on its own systems. Those models are kept apart from your personal data: they never receive information that identifies you and never expose information about you.

The chat never tells you what to trade. A reply that would encourage more trading is blocked before you see it and flagged for a person at LotsBack to review; that review is recorded. A person at LotsBack can also read a conversation when you ask support for help with it. Support chats are stored too, and the support chat says that LotsBack staff may read them to help you; a member of staff opening one is recorded, and that member of staff can take the conversation over and answer you in place of the assistant. Conversations are kept for the period under How long it is kept.

08Automated decisions and holds

Cashback is checked by rules that run without a person. The published conditions decide whether a position is eligible, and the broker's report decides whether a line is verified. A line that fails a condition is rejected automatically, with the reason shown next to it. Each weekly cycle is then approved by a person before any amount becomes Available.

Some holds are also automatic. If a broker report shows the same client behind more than one LotsBack account, payouts and referral commissions for those accounts pause until a person at LotsBack has reviewed the match. A hold is shown to you with its reason, except where the law forbids saying more than compliance review.

These rules exist to perform the Cashback terms you agreed to. You can ask a person to review any rejection or hold, give your side and contest the result: open a case from the line itself or write to support@lotsback.com. LotsBack makes no other decision about you by automated means and does not profile you.

09Referrals and partners

If you joined through an invite link, the person who invited you can see that someone joined, your email address with most of its characters hidden, the status of the referral and any commission it produced. They never see your trading, your balances or your payouts.

If you invite others, they see your referral code. Partner pages show only what a listed partner chose to publish, and a partner is paid by the broker, not by LotsBack.

10Who receives your data

LotsBack shares personal data only where the service needs it:

• Your broker, to attribute your account to LotsBack and to verify the positions it reported. The broker is a separate controller.
• Trading-data providers, which open and maintain the read-only connection to your trading account and return your closed positions.
• The identity-verification provider, which checks the details you submit before your first payout.
• The payout provider, which receives the destination address, asset, network and amount for a payout you requested; and the public blockchain, on which the transaction is visible to anyone.
• AI service providers, currently OpenAI and Anthropic, which provide the AI services the support assistant and the staff console assistant run on, on LotsBack's own accounts. They act as processors on LotsBack's instructions and receive only what the Chat section lists. The coach chat runs on such a provider only with your own key, as the next item says. Before LotsBack uses another AI provider with personal data, that provider is added to this list.
• An AI model provider, only where you have connected your own provider key for the chat, as described above; it then acts under your account and its own terms, not on LotsBack's instructions.
• PostHog, the product-analytics provider, which receives your account email and name and, during a visit for which you chose Accept all, what is on your screen as session replays. It acts as a processor on LotsBack's instructions.
• Hosting, database, authentication and email providers, and error-monitoring and telemetry services, each under contract and only on LotsBack's instructions.
• Professional advisers, and a successor operator if lotsback.com is transferred, under the same commitments.
• Regulators, courts and law-enforcement bodies where the law requires it. Each such disclosure is written to LotsBack's audit log.

11International transfers

Your broker, the providers above and LotsBack itself may be in different countries, so your data may be processed outside the country you live in, including outside the United Kingdom and the European Economic Area.

Where a processor is located outside the country you live in, LotsBack relies on that processor's own contractual safeguards for the transfer. OpenAI and Anthropic are United States companies, so what the support assistant and the staff console assistant send to their AI services is processed outside the United Kingdom and the European Economic Area on that basis. The same applies to any other AI service provider added to the list under Who receives your data.

12Cookies and similar technologies

LotsBack sets first-party cookies. The essential ones, listed below, are what the service needs to work: the law does not require consent for them and they are set whatever you choose. Cookies that measure traffic and advertising are not essential, and they are set only if you choose to allow them.

The cookie bar offers two choices. Accept all allows measurement and advertising cookies as well as the essential ones. Essential only keeps just the essential cookies; measurement and advertising stay off. Both choices are kept in the lb-consent cookie for 12 months and, when you are signed in, on your profile. You can change your choice with Cookie preferences on this page or in Settings. Withdrawing consent stops future measurement and clears this browser's analytics identifiers; it does not erase events already received by a provider.

When measurement is enabled and you choose Accept all, LotsBack uses PostHog to understand navigation, feature use and completed product steps; Google Analytics to measure acquisition and selected conversions; and Meta to measure advertising visits and selected registration conversions. An opaque user identifier, browser identifiers and browser technical information connect consented visits with confirmed outcomes; when you are signed in, PostHog also receives your account email and name, so that a visit is linked to your account. We do not include passwords, authentication tokens, wallet addresses, private journal or coach text, trading records or money amounts in these event payloads. With Accept all, PostHog also records session replays: what is on your screen as you use LotsBack, including your account email, name, account numbers, trades, journal and coach text, and figures. Passwords, one-time codes, your authenticator set-up code and your Support PIN are never recorded. No replay is recorded on the withdrawal, payout destination, security, authenticator or unsubscribe pages or in the staff console. PostHog keeps recordings for as long as LotsBack keeps its analytics data there. You can withdraw consent with Cookie preferences at any time, and recording stops at once. Operations pages are excluded. Browser acquisition context is retained for up to 30 days of inactivity; provider event retention depends on the configured provider settings.

Non-essential browser storage may include lb-analytics-v1 in local storage, PostHog identifiers beginning ph_, Google identifiers beginning _ga or _gcl_, and Meta's _fbp and _fbc identifiers. These are used only after Accept all. Choosing Essential only does not affect the cookies needed for sign-in, referrals, security or payouts.

The essential cookies:

• Sign-in session: keeps you signed in after the magic link. Removed when you sign out or the session expires.
• lb-onboarded: remembers that you finished registration, so the app does not check on every page. 30 days.
• lb-ref: keeps the referral code from the first invite or partner link you opened, so the person who invited you is credited. 30 days, or until you finish registration; a later link does not replace or extend it. It is read once, at registration, and for nothing else; if you did not mean to use an invite link, clear this site's cookies before you register.
• lb-estimate: carries the estimate you built in the calculator into registration. 24 hours.
• lb-consent: your cookie choice, Accept all or Essential only, with the date. 12 months.
• lb-view-as: set only in a LotsBack staff member's browser during an audited read-only support session, never in yours.
• Not cookies, but stored by your browser: a request reference shown on error pages, so you can quote it to support, and a timestamp that stops a stale page reloading in a loop. Error monitoring runs in your browser and sends a report to the error-monitoring provider when something breaks; it is configured not to send your email address or other identifiers.

13Emails and notifications

LotsBack sends messages about your account, your cashback, your payouts, your security and the tools you use. They are part of the service. You choose which of them arrive by email or in the app under Settings; security messages always appear in the app.

LotsBack does not send marketing email. If that ever changes, marketing will be optional, off until you turn it on, and every such email will carry an unsubscribe link; this notice will say so before the first one is sent.

14How long it is kept

LotsBack keeps personal data only for as long as one of the purposes above needs it. The main periods, and where a fixed period is not possible, the rule that decides:

• Account and profile: while your account is open, then for as long as the financial records below need them.
• Trading connections and stored access tokens: removed when the connection is removed or the account is closed.
• Positions, broker reports, cashback lines, ledger, payouts, receipts, adjustments and the audit trail, including the IP address recorded with each action: at least six years from the end of the year of the transaction, because they are the financial record. These records are append-only and are reviewed for deletion only after that period.
• Identity verification summary: as long as the financial records it supports.
• Chat conversations: 90 days by default, and LotsBack may set the period anywhere between 7 and 365 days; a sweep then clears the stored text and keeps the row. A conversation handed to a member of staff becomes a support case and is kept with that case. Journal entries: until you delete them or the account is closed.
• Support cases, notifications and preferences: while your account is open; on closure, support removes what is not part of the financial record.
• Server logs and telemetry: 30 days. Error reports: 90 days. Both are set at the providers that hold them.
• Cookies: the lifetimes listed under Cookies.
• A payout on a public blockchain is permanent. The transaction, the destination address and the amount cannot be deleted or altered by LotsBack or by anyone else. Your broker keeps its own records under its own rules.
• Where deletion is not yet automatic, LotsBack does it by hand at closure or on request; the periods above are the longest data is kept before it is reviewed.

15Closing your account

You can request closure from Settings. That opens a case with support, who reply by email within two business days. Until then nothing changes: your cashback, payouts and receipts stay as they are, and a payout already in progress completes. Request a payout of an Available balance above the network minimum before the account closes.

When support closes the account it disconnects your trading accounts, removes the stored access tokens so LotsBack stops reading them, retires your payout destinations and disables sign-in. Financial records, the audit trail and the identity verification summary are kept for the periods above, with enough of your profile to identify them and to stop a closed account being reopened. Ask in the same case and support also deletes your journal and chat conversations and switches off every notification; support confirms in the case when that is done.

16Your rights

You can:

• Get a copy of your data. Settings has a Data export that gives you a machine-readable file at any time; for anything not in it, write to support.
• Have inaccurate data corrected. Your display name, country and preferences are editable in Settings.
• Have data deleted where LotsBack has no remaining reason to keep it.
• Restrict or object to processing that rests on legitimate interests, including anti-abuse checks, and have a person consider the objection.
• Withdraw any consent you have given, at any time.
• Ask a person to review an automated rejection or hold.
• Complain to a supervisory authority. In the United Kingdom that is the Information Commissioner's Office; in the European Economic Area, the authority of the country you live in.

17How to use them

Write to support@lotsback.com with Privacy in the subject. LotsBack answers within one month, free of charge, and may ask you to confirm the request from the email address on the account before acting. Where a request is complex, the law allows up to two further months; LotsBack tells you if that applies. A refusal is always explained.

18If you live outside the United Kingdom and Europe

This notice is written to the standard of UK and EU data protection law and applies to everyone. Some countries add rules of their own:

• Canada: LotsBack relies on your knowledge and consent as described in this notice, and would send marketing only with the express consent Canadian law requires.
• Australia: you may complain to the Office of the Australian Information Commissioner. Where LotsBack sends data overseas, it takes the steps described under International transfers.
• Singapore: LotsBack collects, uses and discloses personal data for the purposes notified here, and you may complain to the Personal Data Protection Commission.
• Japan: personal data is used for the purposes stated here. Sharing with providers abroad is on the terms under International transfers; ask for details of the destination country's rules.
• United States: LotsBack does not sell or share personal information for advertising. Residents of states with privacy laws may exercise the rights above in the same way and will not be treated differently for doing so.

19Children

LotsBack is for adults. You must be 18 or over, and old enough to trade with the broker you choose, to use it. LotsBack does not knowingly collect data from anyone under 18.

If LotsBack learns that an account holder is under 18, it closes the account, stops any payout, and deletes the data it is not legally required to keep. If you believe a minor has an account, write to support@lotsback.com.

20Security

Access to personal data is restricted by role and by row-level rules in the database, and every time staff view your account it is logged. Money is only ever written by server-side commands that record who acted, why, and from which address. Ledger and audit records are append-only.

Two-factor authentication is required before a payout destination can be added or a payout requested, and a new destination waits through a cooling period before it can be used. Broker access tokens are encrypted with a key held outside the database. Data is encrypted in transit and at rest with the providers that hold it.

21If something goes wrong

If a security incident affects your data and is likely to put you at risk, LotsBack tells you without undue delay, explains what happened and what you can do, and reports it to the supervisory authority within 72 hours where the law requires.

22Changes to this notice

LotsBack may change this notice. A change is published here and takes effect when it is published. Using LotsBack after a change is published is your acceptance of the changed notice; there is no separate re-acceptance step and the application does not ask you to confirm it. If you do not agree with a change, stop using LotsBack and close your account from Settings.

You are asked to read this notice, not to agree to it, because the legal basis for using your data is set out above and does not depend on your acceptance. Where a change would need your consent, LotsBack asks for it rather than assuming it.

23Contact

support@lotsback.com, with Privacy in the subject.