Sign up Sign in
Download Hangar

Privacy Policy

Effective 23 June 2026

Stratotank is operated by Van Coller Consulting (Pty) Ltd, a company registered in South Africa ("we", "us", "Stratotank"). This policy explains what personal information we collect, why we collect it, and what your rights are. It applies to stratotank.com and the trading products we sell through it.

1. What we collect

Account information

When you create an account, we collect your email address and the name and password you provide. Authentication runs on our self-hosted Logto service at auth-api.vancoller.com. Passwords are stored only as salted hashes; we never see your plaintext password.

Purchase information

When you buy a product, we record the transaction ID, the email address tied to the purchase, the product purchased, the amount, and whether the purchase is a one-off or a subscription. Payment is processed off-site by PayPal, or by Paystack when you pay in South African rand. Card numbers, CVV, and bank details never reach our servers; the payment provider handles those under their own privacy terms.

License-check pings

The trading software you install on your computer periodically pings our license API to confirm your entitlement is still active. Each ping records your email, the product slug, your IP address (used for rate-limiting and abuse detection), and a timestamp. We keep these logs for 90 days.

Site analytics

We use PostHog (EU region) to count visits and see which pages perform, with all analytics data kept in the EU. It sets no cookies. For the length of a single visit it stores a per-tab visitor identifier in your browser's session storage (cleared when you close the tab); if you arrive from one of our ads it also stores that ad's click identifier there. You are anonymous until you sign in, after which analytics are tied to your account. We do not run the Meta Pixel, Google Analytics, or any browser-based advertising tracker.

Advertising measurement

When you arrive from one of our ads and take a key action (signing up, starting a trial, or buying), we send a conversion event server-side to the advertising platform that referred you, currently Meta, and Google where we run Google ads, so we can measure which ads work. We share a one-way hashed (SHA-256, irreversible) version of your email address, the ad click identifier from the URL you arrived on, and your IP address and user agent. We never send your email, name, or any readable personal detail in plaintext to these platforms, and we do not load their browser pixels or cookies. Our legal basis is our legitimate interest in measuring and improving our advertising; you can object at any time (see Your rights).

Cookies

We set a single session cookie after you sign in, issued by Logto. It is httpOnly, encrypted, and Secure in production. We do not use advertising or cross-site tracking cookies.

2. Why we collect it

  • Operate the service: keep you signed in, deliver products you bought, verify entitlements.
  • Process payments: pass the bare minimum to PayPal or Paystack so they can charge you.
  • Prevent abuse: rate-limit license checks, block obvious fraud.
  • Contact you about your account: receipt emails, password resets, service notices.
  • Improve the site: understand which products and pages perform.

We do not sell your data, and we do not share readable personal information with advertisers. We do share a hashed, irreversible identifier with ad platforms purely to measure ad performance (see Advertising measurement above). We do not use your data to train AI models.

3. Who we share it with

We share personal information only with the following processors:

  • PayPal — payment processing for purchases in US dollars. Your name, email, and amount are passed at checkout. See paypal.com/privacy.
  • Paystack — payment processing for purchases in South African rand. Your email and amount are passed at checkout. See paystack.com/terms/privacy.
  • Railway — hosting infrastructure. Stores our application data on their servers; no direct access to user accounts.
  • Cloudflare — DNS, TLS, and edge caching. Sees request metadata (IP, URL) for security and performance.
  • Resend — transactional email delivery for receipts and account notifications.
  • PostHog (EU) — product analytics, and the server-side service that forwards the conversion events described above to ad platforms.
  • Meta (and Google Ads, where we run Google campaigns) — advertising measurement via their Conversions APIs. Each receives a hashed email, the ad click identifier, and request metadata to attribute conversions to ads. See Meta's privacy policy and Google's privacy policy.

Each is bound by its own privacy commitments. We do not use any other third-party services that receive personal data.

4. How long we keep it

  • Account & purchase records: as long as your account is active, plus up to 7 years afterwards for tax and accounting obligations under South African law.
  • License-check logs: 90 days, then deleted.
  • Analytics: aggregated only; individual visits not stored.

5. Your rights

Under South Africa's POPIA and (where applicable) the EU/UK GDPR, you have the right to:

  • Access the personal information we hold about you.
  • Correct anything that is wrong.
  • Ask us to delete your account and associated personal data.
  • Receive an export of your data in a common format.
  • Object to or restrict certain processing.
  • Lodge a complaint with the Information Regulator (South Africa) or your local data protection authority.

To exercise any of these, email [email protected]. We aim to respond within 30 days.

6. Security

All traffic to stratotank.com and api.stratotank.com (MT5 licence checks) is TLS-encrypted. The website account area also calls api.vancoller.com. Passwords are hashed. Payment data is handled by PayPal or Paystack under PCI DSS. License authentication tokens stay server-side and never touch the browser.

7. International transfers

Our hosting providers operate globally. Personal data may be processed on servers outside South Africa. We use providers that publicly commit to standard contractual clauses or equivalent safeguards.

8. Children

Stratotank is not intended for anyone under 18. We do not knowingly collect personal information from children.

9. Changes to this policy

We may update this policy. The effective date at the top will change. Material changes will be notified by email to the address on your account.

10. Contact

Van Coller Consulting (Pty) Ltd
South Africa
[email protected]