Privacy Policy

Stampede Ltd, a company registered in Cyprus under number HE 494949, with its registered office at Nikis 1, Anthoupoli, 2350 Nicosia, Cyprus, operates Stampede at stampedeprop.comand is the organisation responsible for personal data collected through it (the controller, in GDPR terms). We process personal data in accordance with the EU General Data Protection Regulation (Regulation (EU) 2016/679, the “GDPR”) as implemented in Cyprus by Law 125(I)/2018 and, where they apply to you, the UK GDPR and US state privacy laws.

For privacy requests, including access, correction, and deletion, contact privacy@stampedeprop.com. That address reaches the person responsible for ensuring our compliance with the GDPR and Cyprus data protection law (Law 125(I)/2018). For anything else, contact support@stampedeprop.com.

This policy covers personal data collected through the Website (stampedeprop.com), the Stampede dashboard and checkout (app.stampedeprop.com), our support chat and support email, the MCP connector, and the affiliate program. It does not cover third party websites we link to, or LHFX, which is a separate brand and service with its own privacy policy.

We collect the data below from you, from your use of the service, and from the providers named in Section 8. We do not buy, rent, or append personal data from data brokers.

We collect, use, and disclose personal data only for the purposes set out below, each with a legal basis under the GDPR as implemented in Cyprus (Law 125(I)/2018). Where the UK GDPR or a US state law applies to you, the equivalent basis applies.

• Providing the service you buy, scoring evaluations, operating funded accounts, paying you, and answering support requests (GDPR: contract).
• KYC, sanctions screening, and anti money laundering record keeping (GDPR: legal obligation).
• Fraud prevention and enforcement of the prohibited practices rules, including cross-account analysis (GDPR: legitimate interests, balanced against your rights).
• Measuring website traffic, finding and fixing problems in the dashboard and checkout, including through session recordings (GDPR: legitimate interests).
• Measuring and improving our advertising, using the analytics and advertising tools described in Section 5 (GDPR: legitimate interests).
• Service emails about your account, purchases, rule events, and payouts (GDPR: contract). These are not marketing and you cannot unsubscribe from them while your account is open.
• Emails about our products and offers, and invitations to review us (GDPR: legitimate interests). You can stop these at any time from your dashboard settings or with the unsubscribe link in each email.
• Showing your username, country, and payouts on the leaderboard and, if you turn it on, your public profile (GDPR: legitimate interests for the leaderboard, which you can opt out of; consent for the public profile).
• Sharing a payout you agree to share. After a payout we ask whether we may show it on our X account, on stampedeprop.com and on its verify page. If you say yes, we show the amount, the date and your account, plus only the details you tick: your country, username, first name and last initial, full name, or payout certificate image (GDPR: consent). You can change this or turn it off at any time from your Payouts page. It comes off the verify page straight away, and we take down our posts of that payout within 7 days.
• Sharing your account data with a third party AI client you choose to connect through the MCP connector, as described in Section 10 (GDPR: contract, performed at your request).

We do not use personal data for automated decisions producing legal effects other than the mechanical scoring of evaluations against published rules, which is the service itself. Our fraud systems flag activity automatically, but a person reviews a flag before any account is actioned.

The Website and the dashboard use cookies and similar browser storage. Each falls into one of these groups:

You can block or delete cookies in your browser settings, and control the ads you see in your Meta, Reddit, and Google ad settings. Blocking the strictly necessary cookies stops sign-in from working.

We record how the dashboard and checkout pages are used (pages viewed, clicks, scrolling, and what the page looked like) so our team can find and fix problems. Recording runs automatically on those pages.

• Text you type into forms is masked and never recorded, and so are your email address and codes.
• Sign-in, sign-up, settings, profile, and identity verification pages are not recorded. On payout pages we record actions only, not what the page shows.
• Recordings can be watched only by our staff in support, marketing, and administrator roles.
• Replays are deleted after 14 days. The summary of a session (pages visited and actions taken) is deleted after 90 days.

The public leaderboard shows your username, country, and payout amounts. You are listed by default once you have a username, and you can switch to private in your dashboard settings at any time. You can also choose to turn on a public trader profile, which shows your username, country, the date you joined, your lifetime payouts (which you can hide), any social links you add, and your badges. We never show your name or email publicly, unless you agree to share a payout with your name, as described below.

Each paid payout has a private verify link showing its amount, the date it was paid and the account. Anyone you give the link to can see it. It shows your name, username, country or certificate only if you agreed to share them, and it is not listed in search engines.

We share personal data only with the providers and recipients needed to run the service. Our service providers act under contracts that restrict their use of it:

• Render (application hosting), Supabase (database and file storage), and Cloudflare (network security, bot checks, and approximate location from IP address).
• Match-Trader, the trading platform, which processes your simulated accounts and trading activity.
• BridgerPay and CryptoRocket, for challenge fees by card and crypto, and CryptoRocket for USDC payouts.
• Didit, for identity verification and sanctions screening.
• Twilio SendGrid, for sending and receiving email, checking that an email address can receive mail, and recording email opens and clicks.
• Anthropic, the AI model provider behind our support chat and some internal tools (see Section 9), and TypeSafe, which checks AI-written text before it is used.
• Slack, for internal notifications to our team about purchases and support requests.
• Google (Analytics and Ads), Meta, and Reddit, for analytics and advertising as described in Section 5.
• Trustpilot, which receives your email address after a payout or when your funded account starts, and a copy of a support reply when our staff ask Trustpilot to invite you, so it can invite you to review us.
• Professional advisers, and authorities where a law, court order, or sanctions obligation requires disclosure.
• Group entities, only as needed to operate the Real-Capital Program for invited traders, and never for third party marketing.
• If you connect one: the third party AI client you authorise through the MCP connector, and its model provider. They receive data at your direction, they are not our processors, and Section 10 explains exactly what this means.

Our support chat is answered first by an AI assistant powered by Anthropic. What you write in the chat is sent to Anthropic to produce a reply, and the conversation is stored so our team can review it and take over when needed. Anthropic processes it on our behalf and does not use it to train its models. We also use Anthropic to help our staff draft replies and search our own records. The AI never makes decisions about your account, payouts, or rule enforcement.

Stampede offers an MCP connector (mcp.stampedeprop.com) that lets you connect a third party AI client, such as an AI assistant application, to your Stampede account. Nothing in this section happens unless you choose to connect one.

We are a Cyprus company. Our main database is hosted in the European Union (Ireland), but several of our providers, including our hosting, email, AI, analytics, and advertising providers, are based in the United States, so personal data crosses borders. We transfer personal data outside the European Economic Area only where the recipient is covered by an adequacy decision (such as the EU-US Data Privacy Framework), standard contractual clauses, or another lawful transfer mechanism.

• Account and dashboard data: while your account is open, then two years.
• Purchase, payout, KYC, and sanctions screening records: five years after the relationship ends, the standard record keeping period under Cyprus and EU anti money laundering law.
• Trading activity on simulated accounts: five years, because it evidences evaluation outcomes, payouts, and rule enforcement.
• Support chats and emails: two years after the conversation or ticket closes.
• Device, login, and access logs, and the MCP audit log: twelve months.
• Session recordings: 14 days for replays and 90 days for session summaries.
• Our own measurement cookies: 30 days in your browser.

We delete or anonymise personal data when the purpose for which it was collected, and any legal retention obligation, has ended. Where a live dispute or legal obligation requires longer retention, the affected records are kept until it ends.

Under the GDPR you may request access to the personal data we hold about you and information about how it has been used and disclosed, and request correction of errors. We respond within the timelines the GDPR sets, normally within one month, and access is provided free of charge except where a request is manifestly unfounded or excessive.

You also have the rights to:

• erasure of data we no longer need, including closing and deleting your account on request;
• restriction of processing while a dispute about it is resolved;
• portability of data you provided to us, in a machine readable format;
• object to processing based on legitimate interests, including analytics, advertising, and marketing emails; and
• withdraw consent at any time, without affecting prior processing.

Rights requests go to privacy@stampedeprop.com. We will verify your identity before acting on a request, using no more data than verification needs. Records we must keep under anti money laundering law are kept for the required period even after an erasure request.

If you live in California, Colorado, Connecticut, Texas, Virginia, or another US state with a comprehensive privacy law, you may have rights to know, access, correct, and delete personal data, and to opt out of its sale, of targeted advertising, and of its sharing for cross-context behavioural advertising.

We do not sell personal data for money. The advertising tools in Section 5 do count as sharing for cross-context behavioural advertising, and as targeted advertising, under several state laws. To opt out, email privacy@stampedeprop.com from the address on your account. You can also block third party cookies in your browser. We will not discriminate against you for exercising a privacy right.

We protect personal data with measures appropriate to its sensitivity: encryption in transit, hashed credentials, access controls limiting staff access to what their role requires, and contractual security obligations on every service provider. Identity document images are held by the verification provider, not on our own systems. If a data breach creates a risk of significant harm, we will notify the Office of the Commissioner for Personal Data Protection in Cyprus and, where required, affected individuals, as the GDPR requires, and any other regulator whose law applies.

The service is for adults. We do not knowingly collect personal data from anyone under 18, and we delete it if we learn we have. KYC at the payout stage enforces this for every funded trader.

We will update this policy as the service changes. Material changes will be announced to registered users by email or in the dashboard. The current version always lives at this address with its date in the header.

If you have a complaint, contact us first and we will try to resolve it directly. You may also complain to the Office of the Commissioner for Personal Data Protection in Cyprus, to your local supervisory authority where GDPR applies, or to your state Attorney General in the United States.