Coinrule

GDPR overview

Coinrule's privacy notice, served through Termly and last updated 13 April 2023, applies the GDPR and UK GDPR explicitly: it sets out the legal bases relied on, names a Data Protection Officer at privacy@coinrule.com, and lists rights of access and copy, rectification, erasure, restriction, portability, objection and non-subjection to automated decisions, alongside withdrawal of consent and a data subject access request route. Complaints may be filed with a member state authority, the UK regulator or the Swiss FDPIC. Zdenek Hofler is named as EEA representative, but at a London address, outside the EEA. Coinrule never states in so many words that it is GDPR compliant. One contradiction stands out: the MCP documentation declares the services are not intended for, directed at or marketed to EU/EEA residents and that Coinrule holds no MiCA CASP licence, while the privacy notice still appoints an EEA representative.

Who owns the data?

Coinrule Limited acts as the data controller under European and UK data protection law, determining the purposes and means of the processing it carries out. A Data Protection Officer is reachable at privacy@coinrule.com and at the London head office, and Zdenek Hofler is named as both EEA and UK representative. Payment card data is processed and stored by Checkout.com, which Coinrule states it does not access. Ownership of what members build is less clear-cut: article 9.3 of the Terms grants Coinrule a free, worldwide, transferable, sublicensable and irrevocable right of use and exploitation over all User Content, explicitly including the trading strategies users create and their parameters.

Reuse rights

Coinrule states it collects personal data to create and authenticate accounts, deliver and administer the service, communicate with users, secure the platform against fraud and meet legal obligations, relying under the GDPR and UK GDPR on consent, performance of the contract, legitimate interests, legal obligations and vital interests. Collected items include email addresses, usernames, passwords, card numbers, contact and authentication data, contact preferences, and automatically gathered IP, device, usage and location data, the latter possibly from GPS through the mobile apps. Financial data is treated as sensitive and processed with consent, and social logins with Facebook, X, LinkedIn or Google pull profile data. Sharing is described only by categories of third parties, such as advertising networks, analytics, hosting providers, payment processors and marketing tools, with Checkout.com the sole named recipient; Coinrule states it collects no information from third parties. Nothing published says whether customer data feeds AI model training, and no clause sets out what users may or may not do when reusing their own exported data.

Data retention & training

Hosting summary

No hosting country or region is disclosed in Coinrule's published documents. The privacy notice lists Website Hosting Service Providers and Cloud Computing Services among the categories of third parties it may share data with, but names none of them. The only named processor is Checkout.com, which handles and stores payment card data, and which Coinrule states it does not access. The pricing page distinguishes a Shared Server on the lower plans from a Dedicated Server on the Pro plan, under a Data Compliance row, which describes execution infrastructure rather than a storage jurisdiction. The domain is served behind Cloudflare (AS13335), which says nothing about where data is actually stored. The publisher is Coinrule Limited, a company based in London, which points to the United Kingdom as the governing jurisdiction, but no storage location, no transfer mechanism and no data processing agreement are published.