01 · Who this policy covers
This policy applies to mtradecraft.com, the BrainTrust membership (Free and Premium), the security tools we make available to members, and our email communications. It describes how MTradecraft LLC (“MTradecraft,” “we,” “us”) handles the information of website visitors, members, and prospective and current clients. Information handled inside a separate signed consulting engagement is governed by that engagement’s confidentiality terms; this policy governs the website, membership, and tools.
02 · Our approach
Two principles drive everything below:
- Data minimization. We collect only the information we need to run the membership, deliver the tools, communicate with you, and meet our legal obligations — and no more.
- We keep our own house in order. Wherever practical we self-host and reduce our reliance on third parties — our email list runs on our own server, our website analytics are privacy-first and cookieless, and assessment data sits on infrastructure we control. We apply to our own systems the safeguards we advise clients to maintain under the SEC’s Regulation S-P (Reg S-P).
03 · What we collect
Information you give us. When you create a BrainTrust account or contact us, we collect your name, business email, firm name, and role, and any message or details you choose to send. If you subscribe to Premium, our membership platform collects your billing details (see Section 04).
Assessment information. For members who use our security tools, we hold the internet-facing assets (such as domains) you identify for assessment, and the results our tools generate about those assets. These results are built from publicly available information and are described in Section 07.
Usage and activity information. When you are signed in to BrainTrust, we log activity such as sign-ins and which materials you view or download. We use this to operate the service, understand which resources are useful, provide support, enforce the single-firm license, and detect misuse. We are telling you this plainly because we think a privacy policy should.
Email engagement. When we send you an email, our email system may record whether it was delivered, opened, or clicked, so we can gauge interest and keep our lists healthy.
Information collected automatically. Like any website, our servers record standard technical data — IP address, browser type, pages requested, and timestamps — in access logs used for security and troubleshooting. Our analytics are described in Section 06.
04 · Payment information
Premium billing is handled by our membership platform (Memberful) and its PCI-compliant payment processor. Your subscription payment is entered directly with that processor. MTradecraft never receives or stores your full payment card number. We receive only the limited billing confirmation we need to manage your subscription — such as your plan, status, and the fact that a payment succeeded.
05 · How we use your information
We use the information above to:
- Create and administer your account and verify who is signed in.
- Provide the materials, tools, and assessment results available under your tier.
- Process subscriptions and manage renewals and cancellations.
- Respond to your questions and provide support.
- Send you service messages and, where you have opted in, newsletters and updates.
- Understand how the service is used so we can improve it.
- Protect the service — detecting misuse, enforcing the license, and maintaining security.
- Meet our legal, tax, and recordkeeping obligations.
We do not sell your personal information, and we do not share it with advertising networks or use it for third-party advertising.
06 · Cookies and analytics
We use only the cookies needed to make the site work — principally the session and login cookies that keep you signed in to your account. We do not use third-party advertising or cross-site tracking cookies.
For website analytics we use a privacy-focused, self-hosted tool that does not set advertising cookies and does not share your browsing with any advertising network. You can control cookies through your browser settings; blocking session cookies may prevent you from signing in.
07 · Assessment data and tool outputs
Our security tools (such as the External Exposure Snapshot) analyze the internet-facing assets you identify using only passive, non-intrusive review of publicly available information — we do not access the inside of your systems. The full scope and authorization for this are set out in Section 06 of the BrainTrust Member Policy.
The assets you identify and the reports we produce are stored on infrastructure we control, are treated as confidential, and are provided to you for your firm’s internal compliance use. We do not publish them, sell them, or share them with anyone outside MTradecraft except as needed to deliver the service to you or as required by law. You may ask us to remove an asset from scope or to delete your assessment results at any time.
Our interactive tools — the Reg S-P IRP Builder, the Incident Response Assistant, and the Mock SEC Cyber Exam — run entirely in your browser. The information you enter into them is processed locally on your own device and is not transmitted to or stored on MTradecraft servers.
08 · When and with whom we share
We share information only in these limited situations:
- Service providers who help us operate — for example our website host, our membership and payment platform, our email delivery systems, and our business systems — and only to the extent they need it to perform that function for us.
- Legal and safety — when we are required to by law, regulation, subpoena, or court order, or where necessary to investigate misuse, protect our rights, or protect the safety of others.
- Business transfer — if MTradecraft is ever involved in a merger, acquisition, or sale of assets, information may transfer as part of that transaction, subject to this policy.
We do not sell or rent your information, and we do not disclose it for anyone else’s marketing.
09 · How we protect your information
Security is not a footnote for us; it is our practice area. Our safeguards include:
- Encryption in transit. The website and our tools are served over HTTPS/TLS, and administrative access to our servers uses encrypted, key-based authentication rather than shared passwords.
- Least-privilege access. Access to member and assessment data is limited to our principal and authorized personnel, on a need-to-know basis.
- Reduced third-party exposure. We self-host sensitive functions where practical — including our email list and our assessment infrastructure — so your information passes through fewer hands.
- Segregation and monitoring. Assessment data sits on dedicated infrastructure, and we monitor our systems for misuse using the same class of tooling we deploy for clients.
- The Reg S-P standard, applied to us. We hold our own environment to the administrative, technical, and physical safeguards we advise SEC-registered firms to maintain.
If we ever experience a security incident affecting your personal information, we will investigate it, take steps to contain it, and notify affected members and any authorities as required by law. No system can be guaranteed perfectly secure, but we treat your information as carefully as we ask our clients to treat theirs.
10 · How long we keep it
We keep information only as long as we need it. Account and profile information is retained while your membership is active and for a reasonable period afterward for records and legal purposes. Assessment data is retained for the duration of your membership so we can show change over time, and we delete or anonymize it within a reasonable period after your membership ends — or sooner at your request. Server and security logs are kept for a limited period. Financial and tax records are kept as long as the law requires.
11 · Your choices and rights
You may, at any time:
- Access or update your account information from your account, or by contacting us.
- Ask us for a copy of the personal information we hold about you, or ask us to correct or delete it.
- Ask us to remove an asset from assessment scope or delete your assessment results.
- Unsubscribe from marketing email using the link in any such message; we will still send essential service messages about your account.
Depending on where you live, you may have additional rights under laws such as the California and Texas privacy statutes or the EU/UK GDPR. We honor those rights and do not discriminate against you for exercising them. To make any request, email support@mtradecraft.com; we may need to verify your identity before acting.
12 · Where your information is stored
MTradecraft is based in the United States. We and our service providers store and process information on servers located in the United States and the European Union. Wherever it is processed, your information is protected under this policy.
13 · Children
The website, membership, and tools are intended for financial firms and their personnel and are not directed to children. We do not knowingly collect personal information from anyone under 18.
14 · Third-party links
Our site and materials may link to third-party websites and services. Their privacy practices are their own, and we are not responsible for them. Review their policies before providing information.
15 · Changes to this policy
We may update this policy from time to time. The current version and its effective date will always appear at the top of this page. Material changes will be communicated through the site or by email where appropriate, and your continued use after a change takes effect constitutes acceptance of the updated policy.
16 · Contact us
Questions about this policy, or requests about your information, can be directed to support@mtradecraft.com — MTradecraft LLC, Dallas, Texas.