Data Protection & Security

Protecting the Information You Entrust to Grayrock

Grayrock builds software that may contain personal, financial and trading information. Protecting that information is an important part of how we design, operate and maintain our products.

Grayrock Capital Pte. Ltd. is based in Singapore and is responsible for personal data handled through Grayrock products in accordance with applicable data protection requirements, including Singapore’s Personal Data Protection Act 2012 (“PDPA”).

This page explains our general approach to data protection, security, hosting, international data transfers, backups and user control.

For complete information about how we collect, use, disclose and retain personal data, please also read our Privacy Policy.

1. Information Grayrock May Process

The information processed by Grayrock depends on the product and features you choose to use.

Grayrock Money

Grayrock Money may process information such as:

• account names and account details entered by you;
• account ownership and classifications;
• opening and current balances;
• income and expense transactions;
• transfers;
• currencies;
• categories and subcategories;
• tags;
• budgets;
• financial goals;
• recurring transactions and commitments;
• reconciliation information;
• imported financial records;
• reports;
• attachments and associated metadata;
• backup and export information; and
• other financial information you choose to enter or import.

Grayrock Money is designed as money-management software. It is not intended to provide banking, payment, accounting, tax, investment-advisory or wealth-management services.

Grayrock Trading Journal

Grayrock Trading Journal may process information such as:

• broker or trading-account identifiers;
• trading-platform information;
• completed trade history;
• instruments and symbols;
• trade direction;
• quantities or lot sizes;
• entry and exit prices and times;
• profit and loss;
• commission, swap and available fees;
• strategies and setups;
• tags and notes;
• trading mistakes;
• discipline and psychology observations;
• performance metrics;
• reports;
• chart images;
• imported trading files; and
• other journal information you choose to record.

Grayrock Trading Journal is designed for trade journaling, performance analysis and structured review. It does not provide brokerage services, execute trades or provide personalised investment recommendations or trading signals.

2. Grayrock Sync and Broker Credentials

Grayrock Sync is designed to synchronize completed trading history from supported MetaTrader 4 and MetaTrader 5 terminals into Grayrock Trading Journal.

Grayrock Sync does not require you to provide Grayrock with your broker master password or investor password.

The connector operates locally within the compatible MetaTrader terminal in which you are already authenticated and is designed to read completed-trade history for journaling purposes.

Grayrock Sync is read-only by design. It is not designed to:

• place orders;
• modify orders;
• close positions;
• manage your brokerage account; or
• trade on your behalf.

Trading authority remains within your trading platform and brokerage environment.

3. Where Grayrock Data Is Hosted

Grayrock Capital Pte. Ltd. is based in Singapore.

Grayrock uses infrastructure located outside Singapore to operate its software services. Our current primary server infrastructure is hosted in the Netherlands with Worldstream.

Worldstream states that its dedicated private-server infrastructure is hosted in its own Dutch data centres.

Other service providers used by Grayrock may process limited information in other jurisdictions where necessary to provide functions such as email delivery, authentication, payments, monitoring, support or other operational services.

The location of a service provider does not change Grayrock’s responsibility to handle personal data in accordance with applicable data-protection requirements.

4. International Data Transfers

Because Grayrock is a Singapore company and some of our infrastructure and service providers are located outside Singapore, personal data may be transferred to and processed in other countries.

Singapore’s PDPA requires organisations transferring personal data outside Singapore to take appropriate steps to ensure that the transferred data receives a standard of protection comparable to that required under the PDPA.

Where Grayrock transfers personal data outside Singapore, we take appropriate steps designed to maintain appropriate protection, which may include:

• assessing the service provider and processing arrangement;
• reviewing applicable contractual and data-protection obligations;
• limiting processing to purposes necessary for providing the relevant service;
• applying appropriate technical and organisational safeguards; and
• reviewing service providers and processing arrangements when appropriate.

5. Our Security Approach

Grayrock applies technical and organisational measures designed to protect personal, financial and trading information against unauthorised access, collection, use, disclosure, copying, modification, loss or similar risks.

Singapore’s PDPA requires organisations to make reasonable security arrangements to protect personal data in their possession or under their control.

Depending on the system and environment, Grayrock’s security practices may include measures such as:

• encrypted HTTPS connections;
• authentication and access controls;
• workspace and tenant separation;
• restricted administrative access;
• role-appropriate permissions;
• protection of application secrets and credentials;
• secure database access;
• audit and security logging;
• rate limiting and other application protections;
• controlled software deployment;
• security updates and patch management;
• infrastructure monitoring;
• backup procedures; and
• recovery planning.

Security practices evolve as Grayrock products and infrastructure develop.

No internet-connected system can be guaranteed to be completely secure. We therefore combine preventive controls with monitoring, backups, recovery planning and ongoing security improvement.

6. Access to User Data

Access to user information is restricted according to operational need.

Grayrock personnel or authorised service providers should only access personal data where access is reasonably required for purposes such as:

• operating or securing the service;
• investigating technical problems;
• responding to authorised support requests;
• preventing abuse or security incidents;
• maintaining infrastructure;
• complying with applicable law; or
• protecting Grayrock, our users or others from harm.

Administrative access should not be used to inspect user financial or trading information without a legitimate operational, security, support or legal purpose.

7. Backups and Recovery

Grayrock uses backup and recovery practices designed to reduce the risk of permanent data loss following technical failure, operational error or other incidents.

Infrastructure backups and product-level backup/export features serve different purposes.

Where Grayrock products provide users with backup or export functionality, those features give users additional control over their own information. They do not replace Grayrock’s internal infrastructure protection and recovery processes.

Users should also maintain independent copies of important exports or backups where the relevant product provides that capability.

Backup copies may remain for a limited period after information is changed or deleted until the relevant backup reaches the end of its retention cycle.

8. User Backup and Export

Grayrock believes users should have practical ways to retain access to information they have created or imported.

Where supported by the relevant product and plan, Grayrock may provide functionality for:

• workspace backups;
• readable financial exports;
• report exports;
• trading-history exports; or
• other portable data formats.

Available backup and export functionality may differ between Grayrock products and subscription plans.

Exported files and backups may contain sensitive personal, financial or trading information. Users are responsible for protecting copies they download and should avoid storing them in insecure or publicly accessible locations.

9. Data Retention

Grayrock retains personal data only for as long as reasonably necessary for the purposes for which it was collected or processed, to provide and secure our services, meet legitimate operational or business requirements, resolve disputes and comply with applicable legal obligations.

Singapore’s PDPA requires organisations to stop retaining personal data, or remove the means by which it can be associated with particular individuals, when the information is no longer required for business or legal purposes.

Retention periods may differ depending on the type of information and the reason it is retained.

For example, different retention practices may apply to:

• active workspace data;
• cancelled or expired subscriptions;
• deleted accounts or workspaces;
• transaction and trading records;
• imported source files;
• attachments;
• security and audit logs;
• support records;
• payment and subscription records; and
• database or infrastructure backups.

Where information is deleted from the active service, residual copies may remain temporarily in backup systems until those backups expire through their normal retention cycle.

10. Account Closure and Deletion

Users may request account or workspace closure in accordance with the functionality and procedures available for the relevant Grayrock product.

Where a deletion request is valid and Grayrock is not required or reasonably entitled to retain particular information for legal, security, dispute-resolution or legitimate business purposes, Grayrock will take reasonable steps to delete or anonymise the relevant personal data in accordance with our retention practices.

Deleting an account may be irreversible.

Users should export or back up information they wish to retain before requesting permanent deletion where appropriate functionality is available.

11. Access and Correction Requests

Subject to applicable law and exceptions, individuals may request access to personal data held by Grayrock and may request correction of inaccurate or incomplete personal data.

Singapore’s PDPA includes obligations relating to access and correction of personal data.

Requests may be subject to identity verification before Grayrock provides access to or changes personal information.

To submit a data-access or correction request, contact our Data Protection contact using the details below.

12. Service Providers

Grayrock may use third-party service providers to support the operation of our products and website.

These may include providers supporting:

• server and infrastructure hosting;
• storage and backups;
• authentication;
• email delivery;
• payment processing;
• monitoring and security;
• website analytics;
• customer support; and
• other operational functions.

We seek to provide service providers only with the information reasonably required for their function and to use appropriate contractual, technical or organisational safeguards where required.

Grayrock remains responsible for its own obligations under applicable data-protection law when engaging service providers to process personal data on its behalf.

13. Worldstream Infrastructure

Grayrock’s current primary server infrastructure is hosted with Worldstream in the Netherlands.

Worldstream describes itself as a Dutch infrastructure provider and lists data centres in Naaldwijk, the Netherlands.

Worldstream also states that its unmanaged infrastructure model does not ordinarily provide it with logical access credentials to customer-managed infrastructure or active knowledge/control over customer content.

Grayrock remains responsible for configuring, securing and operating its own server environment and applications.

The use of Worldstream infrastructure does not transfer Grayrock’s data-protection responsibilities to Worldstream.

14. Payment Information

Where Grayrock offers paid subscriptions, payments may be processed by third-party payment providers.

Grayrock does not need to receive or store full payment-card details where those details are handled directly by the applicable payment processor.

Payment providers may independently process information required to authorise transactions, prevent fraud, manage subscriptions and comply with their legal obligations.

The applicable payment provider’s own privacy and security terms may also apply to information processed directly by that provider.

15. Cookies and Website Technologies

The Grayrock website may use cookies and similar technologies for functions such as:

• essential website operation;
• preferences;
• security;
• analytics; and
• other functions described in our Cookie Policy.

Where required, visitors are provided with choices regarding non-essential cookies through our cookie-consent system.

For more information, please read our Cookie Policy.

16. Security Incidents and Data Breaches

Grayrock maintains procedures for identifying, investigating, containing and responding to suspected security incidents involving personal data.

Where a personal-data breach occurs, Grayrock will assess the incident in accordance with applicable law.

Singapore’s PDPA includes breach-notification obligations where applicable thresholds, including significant harm or significant scale, are met.

Where notification is legally required, Grayrock will notify the relevant authorities and/or affected individuals as required by applicable law.

17. Your Responsibilities

Security is a shared responsibility.

Users should:

• use a strong and unique password;
• protect the email account associated with their Grayrock account;
• keep devices and browsers secure and updated;
• avoid sharing login credentials;
• sign out of devices they do not control;
• protect downloaded reports, exports and backups;
• review account activity where relevant;
• keep MetaTrader and other connected software secure;
• never send passwords or confidential credentials through ordinary support messages; and
• contact Grayrock promptly if they suspect unauthorised account access.

18. Data Protection Officer and Privacy Contact

Grayrock Capital Pte. Ltd. designates responsibility for overseeing personal-data protection and compliance with applicable data-protection requirements.

Singapore organisations are required to designate at least one individual responsible for data protection and make the business contact information available to the public.

Data Protection & Privacy Enquiries

Grayrock Capital Pte. Ltd.
Singapore

Email: privacy@grayrock.asia

For ordinary product or account support, please use:

support@grayrock.asia

For security-related reports, we recommend:

security@grayrock.asia

19. Changes to This Page

Grayrock may update this Data Protection & Security page as our products, infrastructure, security practices or legal obligations evolve.

Material changes may also be reflected in our Privacy Policy or other applicable legal documents.

The latest version published on the Grayrock website will apply from its stated effective date.