Last updated: 11 October 2026
This Privacy Policy explains how Propel Audit (“Propel,” “we,” “us,” or “our”) collects, uses, stores, and protects personal data when you use our website and web application. It applies to users worldwide. Where regional laws (including the GDPR, UK GDPR, and CCPA/CPRA) grant additional rights, those rights apply as described below.
Propel is operated by Marcell Lőrinczi (Sole trader), of 1135, Budapest, Lehel utca 39, Hungary. You can reach us at legal@propelaudit.com.
We are the data controller for the personal data described in this policy. Privacy questions, and any request to exercise the rights in section 6, should be sent to legal@propelaudit.com and are answered within one month (or longer where the law permits for complex requests).
We have not appointed a Data Protection Officer, because the scale and nature of our processing does not require one under GDPR Article 37. If that changes we will publish the contact details here.
If the operating entity changes in the future (for example, from sole trader to a limited liability company), we will update this section and notify you of the change as described in section 11.
Account data: your email address, your name or display name, and authentication identifiers, handled on our behalf by Clerk. We never receive or store your password. Account registration and sign-up take place through our website.
Workspace data: the trading accounts, payouts, expenses, prop-firm spending, trades (with any tags and ratings), journal and notebook entries, pictures you attach to journal days, a P&L card background image if you upload one, and tax settings you enter. This describes your trading activity and we treat it accordingly.
Billing and subscription data: a Whop membership and payment reference (or, for a subscription started through Stripe, a Stripe customer and subscription reference), your plan, your subscription status, and the billing confirmations the payment provider shares with us so we can activate and manage your access. Payment instruments (card numbers, bank details, crypto wallets used for payment, and the like) are collected and processed exclusively by Whop or Stripe and their payment partners; they are never sent to or stored by us. Invoices and receipts are issued by the payment provider that billed you.
Payout wallets, only if you add one: the public wallet address, the transfers into it that we find on the public blockchain, and what you tell us about each sender (for example, which account a firm’s payouts belong to).
Files you import: the CSV exports and statements you choose to upload from your broker, prop firm, or platform. We read them to create your trades, payouts, and ledger rows. We do not connect to brokers or prop firms, and we do not request or store their login credentials, API keys, or session tokens (see also our Terms of Service, Section 6).
Operational data: request logs, error reports, and a security audit trail of events such as account deletion, role changes, and subscription changes.
Referral data, only if you arrive through a referral link: the referral code, and a keyed hash of your IP address and browser used to prevent self-referral fraud. We do not store the raw IP address.
Messages and support requests you send us: if you use the contact form, the name, email address, topic and message you enter (linked to your account if you were signed in); if you email us, your address and what you write; if you ask for help in our Discord server, your Discord username and the messages you post there. We use them solely to answer you (and, if you ask for your plan’s role in our Discord server, to check your plan and give you that role), and for nothing else.
AI and automated processing: every feature of Propel Audit, including calculations, performance analytics, tax simulations, and any AI-assisted outputs, is delivered by our own application code hosted on Render. We do not transmit your workspace data to any third-party AI provider or external large language model service, and no user trading data leaves our infrastructure for the purpose of AI processing.
To provide the service and perform our contract with you (GDPR Article 6(1)(b)): authenticating you, storing and displaying your workspace data, running the calculations you ask for, and applying your subscription plan.
To take payment and keep accounting records (Article 6(1)(b) for the payment itself, and Article 6(1)(c) for the tax and accounting records we are legally required to keep). Payments and invoices are handled by Whop, or by Stripe for a subscription started there; we receive only the limited subscription and status data needed to grant and manage access, and we retain the records our own tax and accounting obligations require.
To keep the service secure and prevent abuse, including the audit trail and the anti-fraud checks in the affiliate programme (Article 6(1)(f), our legitimate interest in protecting the service and other users, balanced against the limited and largely pseudonymised data involved).
To communicate with you about your account, such as service and billing notices (Article 6(1)(b)). We do not send marketing email; if we ever do, it will be on the basis of consent you can withdraw at any time.
To answer a message or support request you send us, through the contact form, email, our Discord server, or another support channel (Article 6(1)(b) where it concerns your account, otherwise Article 6(1)(f), our legitimate interest in replying to a question you chose to ask us).
We do not sell your personal data, we do not share it for cross-context behavioural advertising, and we do not use your trading records to train advertising or third-party models. Under the CCPA and CPRA this means we do not “sell” or “share” personal information as those terms are defined, and there is nothing for you to opt out of.
No decision producing legal or similarly significant effects about you is made by automated means.
We use a small number of processors, each under a data processing agreement (or equivalent contractual safeguards) and each acting only on our instructions: Clerk (authentication and account identity, United States); Whop (payments, subscription billing, invoicing, and related customer references, United States, together with its payment partners); Stripe (payments and subscription billing for subscriptions started before checkout moved to Whop, United States); Render (application hosting and the PostgreSQL database, United States).
If you add a payout wallet, we read the public blockchain through a blockchain node provider, which receives that public address with each request and nothing else about you.
If you ask for help in our Discord server, Discord, as the platform, processes your username and what you post under its own terms and privacy policy. We use only what we need to respond to you.
Payment data is processed by Whop, or by Stripe for a subscription started there, under that provider’s own terms and privacy policy. We receive only the limited information needed to provision your plan.
We do not otherwise disclose your data, except where we are legally required to, or where it is necessary to establish, exercise, or defend a legal claim.
Our processors listed above are established in the United States (and the payment partners of Whop and Stripe may process data in additional jurisdictions), so your personal data is transferred outside the European Economic Area, the United Kingdom, and other regions with data-protection laws that restrict such transfers.
Those transfers are made under the European Commission’s Standard Contractual Clauses, together with the UK International Data Transfer Addendum where the UK GDPR applies, incorporated into our agreement with each processor. Where a processor is certified under the EU-US Data Privacy Framework (or any successor), that certification also applies.
You can request a copy of the safeguards in place for a given transfer by writing to legal@propelaudit.com.
If the GDPR or UK GDPR applies to you, you have the right to access your data, to correct it, to erase it, to restrict or object to its processing, and to receive it in a portable, machine-readable format. Where processing rests on consent, you may withdraw that consent at any time without affecting the lawfulness of processing carried out beforehand.
Two of these rights are immediate and self-service. Access and portability: Settings contains a download that produces everything we hold about you as a single JSON file. Erasure: Settings also contains account deletion, which removes your records from the production database, subject to the retention periods in section 7.
For correction, restriction, objection, or anything else, write to legal@propelaudit.com. We answer within one month and will tell you if we need longer, as the law permits for complex requests.
You also have the right to complain to a data protection supervisory authority. Ours is the Hungarian National Authority for Data Protection and Freedom of Information (NAIH), and you may also complain to the authority where you live or work.
If you are a California resident, you have equivalent rights of access, deletion, correction, and portability under the CCPA as amended by the CPRA, and we will not discriminate against you for exercising them. Use the same controls and the same address.
Users in other jurisdictions may have additional or different rights under local law. We will honour those rights to the extent required. Write to legal@propelaudit.com if you wish to exercise a right under the law of your country of residence.
Workspace data is kept while your account is open. When you delete your account, your records are removed from the production database immediately, and from encrypted backups within 35 days as those backups age out.
Billing and accounting records that we receive from our payment providers, or that we generate for our own tax compliance, are kept for as long as tax law requires us to keep them, which is commonly between six and ten years depending on the country, and they are kept for that purpose alone. Whop and Stripe keep their own payment and invoice records according to their own policies.
The security audit trail survives account deletion, because an entry recording that an account was deleted has to outlive the deletion it records. The email address in those entries is replaced with a keyed pseudonym after twelve months, which is the end of the typical chargeback and dispute window, so the trail remains useful without remaining identifiable.
Referral click records, which contain only hashed identifiers, are kept for two years. Server request logs are kept for 30 days.
Contact-form messages and support emails are kept for two years after we answer them, so a follow-up can be read against the original, then deleted. A contact-form message sent while signed in is deleted with your account. Messages you post in our Discord server stay there until you delete them or we remove them; ask us and we will remove your support messages from our server. You can ask us to delete any message sooner at any time.
Traffic is encrypted in transit. Access to production data is limited to those who need it to operate the service, and administrative actions are recorded in the audit trail.
No system is perfectly secure. If a breach affects your personal data we will notify the relevant supervisory authority within 72 hours where the law requires it, and we will notify you directly where the breach is likely to result in a high risk to your rights and freedoms.
We use only cookies and similar technologies that are strictly necessary for the web application to work (for example, the authentication session cookies provided by Clerk, and the referral cookie set when you arrive through a referral link), plus preferences you choose yourself, which stay in your browser. Our Cookie Policy lists every one.
We do not use advertising cookies, cross-site tracking pixels, or third-party marketing trackers. If we ever introduce optional analytics cookies, we will ask for your consent where required by law and give you a clear way to refuse them.
Propel is intended for users who are at least 18 years old. We do not knowingly collect personal data from anyone under 18. If you believe a person under 18 has provided us with personal data, please contact us at legal@propelaudit.com and we will delete it promptly.
If we change this policy materially, we will announce it in the app, and in our Discord server, and ask you to accept the new version before you continue. We record which version you accepted and when. The “Last updated” date at the top of this page always reflects the current version.
If the business is transferred (for example, the sole trader operation is moved into a limited liability company, or the service is sold or merged), personal data may be transferred to the new entity as part of that transaction. We will ensure the new entity continues to protect the data under terms consistent with this policy, and we will notify you of any material change in the identity of the controller.
We may disclose personal data if required to do so by law, regulation, legal process, or governmental request, or if we believe in good faith that disclosure is necessary to protect our rights, the safety of users, or to investigate fraud or security issues. Where legally permitted we will notify you of such requests.
For questions about this Privacy Policy, contact us at legal@propelaudit.com. You may also reach support at support@propelaudit.com.
This Privacy Policy should be read together with our Terms of Service and Cookie Policy, available at https://www.propelaudit.com/legal/terms and https://www.propelaudit.com/legal/cookies.