Privacy Policy
Last Updated: August 4, 2026 · Document Version: LEG-2026-V1
1. Data Controller & Contact Details
The Data Controller responsible for your personal data under the UK General Data Protection Regulation (UK GDPR) and Data Protection Act 2018 is Black & Rowan Management Group Limited t/a Drawdown.
Data Privacy Contact: privacy@drawdown.trading
Correspondence Address: Chesterfield, Derbyshire, United Kingdom
Note: Given the scale and nature of our processing operations, Drawdown is not required to appoint a formal Data Protection Officer (DPO). All privacy queries are handled directly by our designated privacy team.
2. Categories of Personal Data We Process
We collect personal data that you provide directly, data generated automatically through platform usage, and payment metadata from our secure payment processors.
- Identity & Contact Data: Name, email address, country of residence, user account ID.
- Subscription & Payment Metadata: Payment status, currency, billing cycle, Stripe customer ID (raw card details are processed directly by Stripe).
- Trading & Journal Data: Trade journal logs, strategy notes, uploaded CSV statement files, risk parameters, and indicator preferences.
- AI Analysis & Prompts: Text prompts and trade metadata submitted to AI trade analysis tools.
- Technical & Session Logs: IP address (hashed where applicable), browser type, device identifiers, session timestamps, and security access logs.
- Marketing & Consent Records: Newsletter opt-ins, email preferences, cookie consent timestamps, and versioned terms acceptance records.
3. Processing Purposes & Lawful Bases Table
| Processing Purpose | Data Used | Lawful Basis (UK GDPR) | Key Processors |
|---|---|---|---|
| Account Creation & Authentication | Name, email, password hash | Contract Execution (Art 6(1)(b)) | Supabase |
| Subscription Billing & Invoicing | Payment metadata, billing address | Contract Execution (Art 6(1)(b)) & Legal Obligation (Art 6(1)(c)) | Stripe |
| AI Trade Journal Analysis | Pseudonymised journal entries & setups | Contract Execution (Art 6(1)(b)) | Anthropic, OpenAI |
| Transactional Emails & Security Alerts | Email, name, delivery status | Contract Execution (Art 6(1)(b)) | Resend |
| Direct Marketing Updates | Email, marketing consent record | Consent (Art 6(1)(a)) | Resend |
| Security & Fraud Prevention | IP address, session logs, User Agent | Legitimate Interests (Art 6(1)(f)) | Supabase, Vercel |
4. AI Processing, Privacy & Model Safeguards
When you use our AI Trade Journal or Strategy tools, pseudonymised setup parameters are processed via API endpoints powered by Anthropic and OpenAI.
Our AI Data Principles:
- Zero Public Model Training: Your trade journals, private strategies, and broker statements are NOT used to train public AI models.
- Pseudonymisation: Prompts strip personal contact identifiers before processing.
- No Automated Decisions with Legal Effects: AI tools provide analytical feedback only. Drawdown does not execute automated trades or make credit decisions.
5. International Data Transfers
Where third-party service providers process data outside the UK (such as US-based API endpoints), transfers are protected using UK adequacy decisions, the UK International Data Transfer Agreement (IDTA), or the UK Addendum to the EU Standard Contractual Clauses (SCCs).
6. Data Retention Schedule
We retain personal data only for as long as necessary to fulfill processing purposes:
- Active Account Data: Duration of your active account subscription.
- Closed Account Operational Data: Purged within 30 days of confirmed account deletion.
- Billing & Financial Transaction Records: Retained for 6 years to satisfy UK statutory tax obligations.
- Support Correspondence: Retained for 2 years following closure of the request.
- Security & IP Access Logs: Retained for up to 12 months.
- Encrypted Backups: Rotated and deleted within a maximum 90-day cycle.
7. Your Rights Under UK GDPR
Under UK GDPR, you have the following rights regarding your personal data:
- Right of Access (Subject Access Request): Request a copy of the personal data held about you.
- Right to Rectification: Request correction of inaccurate personal data.
- Right to Erasure (Right to be Forgotten): Request deletion of your account and personal data.
- Right to Restrict Processing: Request restriction of processing under specific circumstances.
- Right to Data Portability: Export your data in a structured, machine-readable format (JSON/CSV).
- Right to Withdraw Consent: Withdraw consent for marketing emails at any time via email footer links.
To exercise any right, email us at privacy@drawdown.trading. We respond to valid requests within one calendar month free of charge.
8. Self-Service Data Export & Account Deletion
Data Export Tool
You can download your complete account profile, trade journal logs, and saved preferences at any time from Account Settings → Data Export.
Account Deletion Workflow
To permanently delete your Drawdown account and associated operational data, navigate to Account Settings → Security → Delete Account or email privacy@drawdown.trading.
9. Security Controls & Incident Reporting
We implement technical and organizational security measures including TLS encryption in transit, encrypted storage, row-level database authorization, and secret management.
To report a potential security issue or vulnerability, email security@drawdown.trading. We commit to working constructively with responsible security researchers.
10. Right to Complain to the ICO
If you have concerns about how we handle your personal data, you have the right to lodge a complaint with the UK Information Commissioner’s Office (ICO).
We encourage you to contact us first so we can resolve any privacy concerns promptly.