Who we are
1.1Propper. Propper, LLC ("Propper", "we", "us", "our") operates the website proppertrading.com and provides white-label proprietary trading platform software to prop firms. We are a limited liability company incorporated in the State of Delaware, United States, with our address at 2810 N Church St STE 88163, Wilmington, DE 19802, United States.
1.2Applicable law. We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and the Dutch UAVG (Uitvoeringswet AVG).
1.3Contact. For any privacy-related question, contact us at [email protected].
Controller and processor roles
2.1Why this matters. The role in which we process data determines who is responsible for it.
2.2Propper as controller. For our own website, including contact form submissions and analytics, and for the account, onboarding, and billing data of our prop firm customers, Propper acts as the data controller. This Privacy Policy governs that processing.
2.3Propper as processor. For data inside a prop firm's white-label platform, including trader accounts and trading activity, the prop firm is the data controller and Propper acts as a data processor on the prop firm's behalf, under a Data Processing Agreement with that firm. In that case, the prop firm's own privacy policy governs how that data is used, and requests from traders should be directed to the prop firm first.
What data we collect
3.1Contact form submissions. Name, e-mail address, company name (optional), and the content of your message.
3.2Prop firm account and onboarding data. When a prop firm subscribes, we process business and contact details, login credentials (passwords are hashed), agreement and signature records from our digital onboarding process, and identity verification information collected through Stripe to enable payments. Identity documents submitted for verification are handled by Stripe and are not stored by us directly.
3.3Trader account data. When a trader signs up through a prop firm using our platform, we process name, e-mail address, hashed password, trading activity, and, where used, AI assistant conversations within the platform. We process this data as a processor on behalf of that prop firm, as described in Section 2.3.
3.4Analytics data. Pages visited, referring source, approximate location, and device and browser type. Only collected if you accept analytics cookies.
3.5Technical data. IP address and basic request metadata, logged for security and abuse prevention.
Why we process your data
4.1Responding to you. To respond to contact requests (legal basis: consent).
4.2Providing the service. To provide, operate, secure, and improve our platform and services (legal basis: performance of a contract where you are a customer, and otherwise our legitimate interest in operating and protecting our services).
4.3Payments and verification. To process payments and verify the identity of prop firms (legal basis: performance of a contract and compliance with legal obligations).
4.4Analytics. To measure and improve our website (legal basis: consent).
4.5Legal compliance. To comply with legal obligations, such as financial and tax record keeping where applicable (legal basis: legal obligation).
How long we keep your data
7.1General principle. We keep personal data only as long as necessary for the purpose it was collected for.
7.2Contact form messages. Up to 24 months.
7.3Trader and platform account data. For the duration of the prop firm's subscription. When a prop firm leaves Propper, the associated data is moved to a separate, read-only archive so that migration away from our platform is possible without data loss, and is retained there for up to 12 months, unless migrated or deleted earlier on request.
7.4Payment and identity records. Retained by Stripe according to Stripe's own retention and legal obligations. We keep only the records needed for our own accounting and legal compliance.
7.5Analytics data. Up to 14 months (GA4 default).
7.6Server logs. Up to 90 days.
Your rights
8.1Your rights under the GDPR. You have the right to: access the personal data we hold about you; correct inaccurate or incomplete data; request deletion of your data ("right to be forgotten"); restrict or object to our processing; receive your data in a portable format; and withdraw consent at any time.
8.2Complaints. You have the right to lodge a complaint with a data protection supervisory authority, such as the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or the supervisory authority of your own EU member state.
8.3Data inside a prop firm's platform. For data held inside a prop firm's platform where Propper acts as a processor, please direct your request to the relevant prop firm, who is the controller. We will assist them in responding.
8.4Exercising your rights. To exercise any of these rights, e-mail us at [email protected]. We respond within 30 days.
Security
9.1Measures. We protect your data with industry-standard measures: encrypted connections (HTTPS), encryption at rest (AES-256), hashed passwords, row-level security to isolate tenant data, multi-factor authentication via passkeys and authenticator apps, platform-wide activity logging, and restricted internal access. No method is 100% secure, but we continuously improve our safeguards.
Processing register
10.1What this section is. Article 30 of the GDPR asks a controller and a processor to keep a record of what they process. This is that record. Where Propper acts as a processor for a prop firm, that firm keeps its own register and the table below describes what our systems hold on its behalf.
| Category | What we hold | Legal basis | Retention |
|---|---|---|---|
| Account details | Name, e-mail address, phone number, profile picture and language preference. | Performance of a contract | For as long as the account exists |
| Login credentials | Password as a bcrypt hash, two-factor secret and recovery codes, and active sessions. | Performance of a contract, and our legitimate interest in securing accounts | Sessions expire after 120 minutes; credentials live as long as the account |
| Identity verification | The verification session and report reference held at Stripe, the outcome and the date. The identity documents themselves are handled by Stripe and never reach our database. | Legal obligation of the prop firm, and performance of a contract | For as long as the account exists; documents follow Stripe's own retention |
| Payments | The transaction reference at the payment provider, amount, currency, the method type such as card or iDEAL, and the status. No card numbers. | Performance of a contract, and legal obligation | Seven years, for accounting purposes |
| Payouts | The bank account or wallet a trader is paid to, the amount, and who reviewed the request. The payment details are encrypted in the column. | Performance of a contract, and legal obligation | Seven years, for accounting purposes |
| Trading activity | Trading accounts, orders, positions, results, and any notes a trader writes in their journal. | Performance of a contract | For as long as the account exists |
| Device and network data | IP addresses with first and last seen, a browser fingerprint, the user agent, and whether the session looks automated. | Our legitimate interest in preventing fraud and duplicate accounts | For as long as the account exists |
| Activity log | Who did what and when, with IP address, user agent, and the old and new value of a change. | Our legitimate interest in accountability and security | For as long as the account exists |
| Support and e-mail | Tickets, messages and attachments, and the mail a prop firm sends and receives through the platform. | Performance of a contract | Until removed under the prop firm's own retention rules |
| Affiliate data | Partner details, referral clicks with their source, commissions, and payout details. The payout details are encrypted in the column. | Performance of a contract, and legal obligation | Seven years, for accounting purposes |
10.2How it is stored. Every record carries the identifier of the prop firm it belongs to, and the database enforces that separation itself through row level security: the application connects as a role that can only see rows of its own prop firm, so a query that forgets the filter returns nothing rather than somebody else's data. Passwords are hashed with bcrypt. Bank details, two-factor secrets and provider credentials are encrypted in the column, not only on the disk. Every environment has its own database, and no test ever runs against production data.
10.3What we deliberately do not hold. Identity documents and card numbers are never written to our database. Both stay with Stripe and we keep only a reference to them, which means a breach on our side cannot expose a passport or a payment card.
Changes to this policy
11.1Updates. We may update this policy as our services evolve. Material changes will be announced on this page with a new "last updated" date. If you have an account, we will also notify you by e-mail.