Privacy and Analytics

To sell you a licence we need two things: an email address, so we can reach you about the order, and the MetaTrader 5 account numbers your Expert Advisor is compiled for. Both are stored with the order. The account numbers are also sent to the build service, which embeds a salted hash of each one in the binary — the plain numbers are not written into the file you download.

Payments in crypto are handled by NOWPayments. They tell us that an order was paid, with the coin, the amount and the on-chain transaction reference; we never see a card number, a wallet you own, or anything else about you. The MQL5 Market edition is bought and paid for inside MetaTrader under MetaQuotes’ own terms, and nothing about that purchase reaches this site.

The Expert Advisor itself sends us nothing, ever. It runs entirely offline and never calls this site, so nothing about how, where or when you trade reaches us.

We do not sell, rent or share any of this. It goes to the payment gateway and the build service because the sale cannot happen otherwise, and nowhere else.

When you first arrive, the site notes the campaign parameters in the link you followed — utm_source, utm_medium, utm_campaign, utm_term, utm_content and Google’s click identifiers gclid, gbraid and wbraid — along with the site that linked to you, the page you landed on and the time. They are held in your browser’s session storage and sent with a purchase, so we can tell which campaign paid for itself.

The query string itself is never stored: only the path you landed on. Nothing in this list identifies you, and it is not used to build a profile.

The free demo never asks for anything. After a download starts, the site offers to email you the setup guide and the backtest report; if you leave an address there, we store it with the demo you downloaded and send one email asking you to confirm. Nothing else is sent until you do.

Once confirmed, you get five plain-text emails over fourteen days: the setup guide, how to run the backtest, what the report means, how the licence works, and the offer. We send them with Resend’s open and click tracking switched off, so they carry no tracking pixel and their links go straight to the page, and we cannot tell whether you opened one. Every email has a one-click unsubscribe link.

If you start a checkout and leave it unpaid, we may send one reminder about that order a day or so later. One unsubscribe stops both: the link in a setup-guide email also stops checkout reminders, and the link in a reminder also ends the setup-guide emails. Emails about an order you have paid for still arrive.

The address is sent to Resend, the service that delivers our email, and nowhere else. An address that is never confirmed is deleted after seven days; one that unsubscribes or reaches the end of the series is deleted thirty days later. If you buy, the series stops and the address is deleted from the list about a month after you buy; your order is kept as described above.

So that an opt-out lasts after the list entry is gone, we keep a do-not-mail record: a one-way hash of your address, never the address itself, which is what both kinds of email are checked against. Asking us to delete your data removes it too, and after that you are simply a new contact.

Measurement runs through Google Analytics 4 and, for advertising, Google Ads. It records the moments of the funnel and nothing else: a page view, the pricing section coming into view, a button press with which button it was, the checkout dialog opening, an email and account numbers being submitted, a deposit address being issued with the coin chosen, a payment confirming, a build becoming ready, a download being pressed, the free demo being downloaded, and an address being left for the setup guide.

No event carries your email address, your MetaTrader account numbers, your name, your build reference or anything else that names you. A confirmed purchase carries a one-way code derived from your order reference — not the reference itself, and not something that can be turned back into it — along with the amount and the currency, because a sale has to be reported once and not twice, and that code is what makes the difference between the two. Enhanced conversions — which would mean sending Google a hashed copy of your email address — are switched off.

Google receives your IP address as part of any request your browser makes to them. Google Analytics uses it to place the visit in a country and then discards it.

If you are visiting from the European Union, the wider European Economic Area or the United Kingdom, nothing is measured until you say yes. Google Consent Mode starts denied for advertising storage, advertising user data, advertising personalisation and analytics storage, and the Google tag is not even fetched until you accept. A short banner asks; rejecting is one press, and it is the same size as accepting.

Elsewhere, measurement starts on. You can turn it off for this browser at any time, on this page, and it stays off until you turn it back on.

Your choice is kept in your own browser and nowhere else. Clearing site data clears it, and you will be asked again.

Analytics data is kept for the retention period configured on the Google Analytics property; Google’s own choices are 2 or 14 months, after which the event-level data is deleted.

Your choice about all of this is kept in your own browser and nowhere else, until you clear site data.

Orders, licences and builds are kept for as long as the licence is valid and for as long as we are required to keep a record of a sale. A free demo download is counted as a number per day and carries nothing about who downloaded it.

The campaign parameters of your visit are held in your own browser and are cleared when you close the tab; the copy stored with an order lives as long as the order does.

To ask what we hold about you, to correct it, or to have it deleted where we are not required to keep it, write to us. Say which email address you bought under, or asked for the setup guide with, so we can find it.

support@xaustack.com