These Data Minimisation Principles explain how TRAXAU translates its Privacy Policy into product decisions. They are public commitments and design guidance, not a substitute for the legal policy.
Collect the minimum
Each field, event and integration should have a documented service, security, billing or compliance purpose. Optional fields should be identified as optional. We avoid speculative collection and prefer aggregated or anonymised information where it can achieve the same result.
Keep data tied to its purpose
Account data supports identity and access. Subscription data supports billing. User-originated trade plans and journals support the review tools the user requests. Support and feedback data supports the relevant conversation. We do not repurpose private journal content for third-party behavioural advertising.
A new use requires a compatibility and legal-basis review, updated notice and consent where required.
Build safer, accessible forms
Forms should use explicit labels, keyboard-accessible controls, clear required and optional status, practical length limits, and notices at the point of collection. Consent requests should be specific and separate from optional permission to contact a person.
The public feedback form requires acknowledgment of the Privacy Policy, separately offers optional follow-up contact, and warns users not to submit secrets or unnecessary sensitive information.
Keep secrets out of ordinary fields
TRAXAU's ordinary website, journal and feedback fields are not designed to receive passwords, broker credentials, API secrets, private keys, seed phrases, full card numbers, identity documents or unrelated health, biometric or other highly sensitive data.
Where an approved integration needs a credential, it should use a dedicated encrypted secret flow or provider authorisation process with restricted access—not free text.
Use privacy-preserving measurement
The marketing website currently runs no client-side analytics. If measurement is enabled, our preference is aggregate, cookie-free analytics that does not use local storage or fingerprint visitors. Analytics payloads must not include email addresses, account IDs, trade-form content, journal entries, feedback text or sensitive URL parameters.
Advertising pixels, session replay and cross-site tracking require a separate privacy, security and consent review before deployment.
Limit providers and embeds
Third-party scripts and embeds add data flows and security risk. They should be used only when they provide a clear benefit that cannot reasonably be delivered first-party, and only after documenting the provider, data, purpose, location, retention, contract and removal process.
The public marketing website currently loads no third-party iframes, social widgets, maps, video players, analytics tags or advertising pixels. Its external font request should remain subject to privacy and security review.
Delete or anonymise on schedule
Every production data category should have a retention rule based on service need, legal duty, dispute handling and security risk. When the purpose ends, information should be deleted or irreversibly anonymised, subject to limited backup cycles and records that law requires us to keep.
Give users meaningful control
Users should be able to correct account information, withdraw optional consent, cancel renewals and request privacy rights through a clear channel. Choices must not be bundled or manipulated. Where optional tracking needs consent, reject must be as accessible as accept.
Review access, geography and change
Access should follow least privilege, with sensitive actions logged and periodically reviewed. Supported jurisdictions are deny-by-default: TRAXAU is initially supported in Singapore only, and technical access from another country does not make that country supported.
New countries, integrations, AI providers, payment flows, analytics tools and data fields require a documented privacy and legal review before release. Security incidents and near misses should feed back into product controls.
Question a collection choice
If a TRAXAU field or process appears to request more information than necessary, contact privacy@traxau.com.