Privacy Policy — as of 03 June 2026
Between:
Bayomi UG, Winterhuder Weg 31, 22085 Hamburg, Germany, Commercial Register HRB 199083 Local Court Hamburg, represented by Managing Director Jonathan Jakob Greiter (hereinafter “Provider”)
and:
The User of the Products (hereinafter “User”)
§ 1 Scope
This Privacy Policy applies to all Products of the Provider distributed via the Whop platform. “Products” include the trading software (Expert Advisor / EA) under the name “VISION ALERTS”, the associated license keys, the offered market or trading signals as well as all subscription models (“Subscriptions”).
This Privacy Policy supplements the Provider’s Terms of Service, EULA, and Return Policy.
§ 2 Controller and Contact
Controller for data processing:
Bayomi UG
Winterhuder Weg 31
22085 Hamburg
Germany
Commercial Register HRB 199083 Local Court Hamburg
represented by Managing Director Jonathan Jakob Greiter
Email (for privacy requests): info@vision-alerts.com
Privacy requests will only be processed via this email address. Postal inquiries are also possible but may result in longer processing times.
The Provider does not have a statutorily appointed Data Protection Officer. Please direct privacy requests to the email address above.
§ 3 What Data Is Processed
A. Data that Whop Transmits to the Provider
In the course of contract performance via Whop, the Provider receives the following personal data from the User:
| Data Category | Specific Data | Purpose |
|---|---|---|
| Master Data | Whop username, email address | Identification of the User, provision of access |
| Subscription Data | Active subscription status, subscription type (monthly/annual), duration | Verification of entitlement, access management |
| Payment Data | Payment status (completed/pending/failed), chargeback status | Deactivation of access in case of default of payment |
Legal Basis: Art. 6 para. 1 lit. b GDPR (contract performance)
B. Data Processed by the Provider Itself
| Data Category | Specific Data | Purpose |
|---|---|---|
| Access Data | Access credentials, activation status, timestamp of activation | Provision and management of access |
| Device Data | Device ID, IP address (during access verification), operating system version | Technical protective device (verification every 5 seconds), prevention of misuse |
| Trading Account Data | Trading account name | License management (prevention of use by third parties) |
| Discord Data | Discord User ID (if User joins the community via the software) | Automatic access management to the Discord community |
Legal Basis: Art. 6 para. 1 lit. b GDPR (contract performance) and Art. 6 para. 1 lit. f GDPR (legitimate interest in preventing misuse)
C. Data Not Processed by the Provider
The Provider does not process the following data:
- Trading data (trades, positions, account balances, trading history)
- Strategy data (parameters, Setups, software settings)
- Broker access data (login, password, API keys)
- MetaTrader access data
- Payment data (credit cards, bank account details) – these remain with Whop/Stripe
§ 4 Purposes of Data Processing
The Provider processes the User’s data for the following purposes:
- Contract Performance:
- Provision of access to the Products
- Activation and deactivation of access (including 5-second verification with the license server)
- Management of subscription status
- Technical Protective Device (legitimate interest):
- Prevention of misuse (transfer of access to third parties)
- Deactivation in case of default of payment or chargeback
- Support and Communication:
- Answering support inquiries (via Discord community or Whop messaging)
- Management of access to the Discord community
- Legal Obligations:
- Retention of contract data for tax purposes (10 years pursuant to § 147 AO – German Fiscal Code)
- Fulfillment of information obligations to supervisory authorities
§ 5 Automated Decision-Making / License Server
(1) The Provider uses an automated technical protective device (license server). It performs the following automated checks at regular intervals of five (5) seconds:
- whether the User’s subscription is still active,
- whether the payment status is current (no default of payment, no chargeback).
(2) If the result of any of these checks is negative, access is automatically and immediately deactivated. The Product immediately ceases operation.
(3) Legal Basis: Art. 6 para. 1 lit. b GDPR (contract performance) and Art. 6 para. 1 lit. f GDPR (legitimate interest in preventing misuse). The User may request a manual review of the automated decision (see § 10).
§ 6 Recipients of Data / Disclosure to Third Parties
A. Disclosure to Whop Inc.
Whop Inc. (USA) acts as the Merchant of Record for your purchases. The Provider transmits the following data back to Whop:
- Access status (active/deactivated)
- Subscription status of the User
Purpose: Payment processing, subscription management, handling of refund applications (via Resolution Center). Legal Basis: Art. 6 para. 1 lit. b GDPR (contract performance)
B. Disclosure to Stripe Inc.
Whop uses Stripe Inc. (USA) as its payment service provider. The Provider has no direct access to payment data. These are processed exclusively between Whop and Stripe.
C. Disclosure to Discord Inc.
If the User joins the Discord community via the software, the following data is transmitted to Discord Inc. (USA):
- Discord User ID (via the Provider’s bot)
- Server and role information
Purpose: Automatic access management to the Discord community. Legal Basis: Art. 6 para. 1 lit. b GDPR (contract performance)
D. Disclosure to VPS/Hosting Provider
The Provider’s license server is operated by an external hosting provider with server location London, United Kingdom. The Provider has concluded a Data Processing Agreement (DPA) with the hosting provider that complies with the requirements of Art. 28 GDPR.
Note on the United Kingdom: Following Brexit, the United Kingdom is no longer an EU member state. However, the EU Commission has issued an adequacy decision for the UK under Art. 45 GDPR (Adequacy Decision for the United Kingdom, valid until June 27, 2025, with option for renewal). The transfer to the United Kingdom is therefore treated as equivalent to an EU member state for data protection purposes.
E. No Disclosure to Other Third Parties
The Provider does not disclose personal data to other third parties, in particular not to:
- Brokers
- MetaQuotes Ltd. (MetaTrader)
- Advertising networks
- Data brokers
§ 7 Transfers to Third Countries
(1) The Provider is based in Germany (EU). The following services and platforms are based in third countries (outside the EU) or process data there:
| Service | Location | Adequacy Decision | Data Protection Guarantees |
|---|---|---|---|
| Whop Inc. | USA | EU-US Data Privacy Framework (since July 10, 2023) | Certified |
| Stripe Inc. | USA | EU-US Data Privacy Framework | Certified |
| Discord Inc. | USA | EU-US Data Privacy Framework | Certified |
| VPS/Hosting Provider | United Kingdom | EU Commission Adequacy Decision for the UK (valid until June 27, 2025, with option for renewal) | Adequacy Decision |
(2) The Provider ensures that for all transfers to third countries, either an adequacy decision of the EU Commission exists or appropriate safeguards (in particular Standard Contractual Clauses – SCCs) have been agreed.
§ 8 Storage Period
The Provider stores personal data only for as long as necessary for the purposes set out above or as required by statutory retention obligations.
| Data Category | Storage Period | Justification |
|---|---|---|
| Access Data | For the duration of the active subscription + 30 days | Deletion after deactivation (for reversal processing) |
| Contract Data | 10 years | Statutory retention obligation (§ 147 AO – German Fiscal Code) |
| Discord User ID | For the duration of the active subscription | Automatic removal from community upon subscription expiry |
| Device Data (IP, Device ID) | For the duration of the active subscription + 90 days | Prevention of misuse, fraud prevention |
| Support Communication (Discord/Whop) | 2 years | Documentation of support inquiries |
After expiry of the storage period, the data will be deleted or anonymized.
§ 9 Your Rights as a Data Subject
As a data subject, you have the following rights:
| Right | Description |
|---|---|
| Access (Art. 15 GDPR) | You may request confirmation of whether and what data concerning you is being processed. |
| Rectification (Art. 16 GDPR) | You may request the rectification of inaccurate data. |
| Erasure (Art. 17 GDPR) | You may request the erasure of your data, provided no statutory retention obligations apply. |
| Restriction (Art. 18 GDPR) | You may request the restriction of processing. |
| Data Portability (Art. 20 GDPR) | You may receive your data in a machine-readable format. |
| Objection (Art. 21 GDPR) | You may object to processing on grounds relating to your particular situation. |
| Withdrawal of Consent (Art. 7 GDPR) | To the extent processing is based on consent, you may withdraw it at any time. |
Contact for Data Subject Rights: info@vision-alerts.com
Complaint to a Supervisory Authority (Art. 77 GDPR): You have the right to lodge a complaint with a data protection supervisory authority regarding the processing of your personal data by the Provider. A list of all German supervisory authorities and their contact details can be found at: https://www.bfdi.bund.de/EN/Service/Addresses/addresses_node.html. The supervisory authority competent for the Provider depends on the registered seat of the Provider (federal state). You can identify the competent authority via the link above.
Account Deletion
You have the right to request the deletion of your account and all associated personal data at any time. You can initiate account deletion in the following ways:
- In the App: You will find the account deletion option in your account settings. After confirmation, your account and all associated data will be deleted.
- Via the Website: You can also request deletion via the contact form on our website or by emailing us at info@vision-alerts.com.
We will delete your account and all associated data within a reasonable period (typically within 30 days), unless we are legally obligated to retain certain data (e.g., for tax or regulatory purposes). In such cases, we will inform you of the nature and duration of the retention.
Deleting your account will result in the loss of access to our services. Please note that once an account is deleted, this action cannot be reversed.
§ 10 Automated Decisions – Manual Review
(1) As described in § 5, the Provider uses an automated technical protective device (license server). This decides automatically on the deactivation of access.
(2) The User may request a manual review of an automated deactivation at any time. To do so, the User contacts the Provider via the Discord community or – for formal applications – via the Whop Resolution Center.
(3) The Provider will review the case manually and inform the User of the result within 14 days.
§ 11 Data Security
The Provider takes appropriate technical and organizational measures (TOM) to ensure data security:
- Encryption: The license server communicates exclusively via TLS-encrypted connections (HTTPS).
- Access Control: Only authorized persons (Provider, developer) have access to the license server.
- Pseudonymization: Where possible, data is processed in pseudonymized form (e.g., access credentials without direct personal reference).
- Regular Security Updates: The license server is regularly patched.
Despite these measures, the Provider cannot guarantee absolute security.
§ 12 Changes to this Privacy Policy
(1) The Provider reserves the right to change this Privacy Policy at any time to adapt it to changed legal requirements or new processing purposes.
(2) The current version can be viewed on the product page on Whop and via the software.
(3) For already concluded contracts, the version valid at the time of contract conclusion shall apply, unless the change is required by legal provisions.