Privacy policy

Last updated: August 2026.

This policy explains what www.rentabilio.com collects about you, why it collects it, who else ever sees it and how to make us delete it. It covers this website, the checkout, the account area and the support tickets. The site is operated by Marbo Technologies OÜ, company registration number 17424371, of Tornimäe tn 5, 10145 Tallinn, Estonia.

1. The short version

We collect the least we can get away with and still run a store. Your name and email when you buy, the data the license needs to know which computers are using it, whatever you write in a support ticket, and an anonymous count of page visits. There are no tracking cookies, no analytics scripts from anybody else, no advertising pixels and no data sold to anyone, ever. The rest of this page is the long version, with the details that make those sentences checkable.

2. What we collect, and why

At checkout. Your name and email address, the items in the order, the amount, the currency and the order reference. We need the email to send your license key and to give you access to your account; we need the name for the invoice. Your card number never reaches us. See section 6.

License and activation data. Your license key, the seats it carries, and for each computer running the software a machine fingerprint (an identifier derived from the machine, not your name and not your location), the software version, an optional nickname you can give the machine yourself, and the date it last checked in. This is the only way to enforce a seat limit without asking you to log in every morning, and it is what lets a seat release itself after 21 days of silence. When a seat is released, we log that it happened, when, and from which IP address, because that is the only way to tell somebody replacing a laptop from somebody rotating a key among friends.

Support tickets. Your name, email, the category, the subject, everything you write in the thread, anything you attach, and the IP address the message was sent from. The IP is kept as an anti-abuse measure against automated spam, nothing else. Please do not paste passwords, card numbers or brokerage credentials into a ticket. We never need them, and we will ask you to change anything you send us by accident.

Signing in. A one-time six-digit code, stored hashed, with the IP that asked for it and a short expiry. See section 5.

Traffic measurement. An anonymous count of page views, with no cookie and no identifier that outlives the browser tab. Section 4 describes exactly what it records, because "anonymous" is a word people abuse.

3. What we do not collect

• No card numbers, expiry dates or security codes. They go straight to Stripe.
• No passwords, because the site does not use passwords at all.
• No brokerage or prop-firm credentials. We never ask for them and could not use them.
• No access to your trading account, your positions, your balance or your results. The software runs on your computer and reports nothing about your trading back to us.
• No advertising identifiers, no cross-site tracking, no data bought from data brokers, no profiles built about you.
• No sensitive personal information as U.S. privacy laws define it: no race, health, religion, precise geolocation, biometrics or government identifiers.

4. The traffic counter, in detail

We count visits with our own software, not with an analytics product from somebody else. What that means concretely:

• It uses no cookies. None. That is why this site has no cookie banner. See the cookie policy.
• It stores no identifier that survives closing the tab. The counter puts a random string in the browser's sessionStorage so it can tell that three page views belong to one visit. The browser erases it when the tab closes, it is not readable by any other site, and it cannot be used to recognize you tomorrow or anywhere else.
• Your IP address is never stored in the clear. What is stored is a short hash of the IP mixed with the current date, so it works for catching a robot requesting forty pages in three minutes and stops working entirely the next day. The original IP is not kept and cannot be recovered from the hash.
• Alongside that we record the page path and title, the referring page if the browser sends one, the browser's language and time zone, the window width, whether it is a phone, whether the visitor moved or scrolled at all, and how many seconds the page was open. The time zone is used to guess a country for a chart in our admin panel. That is the entire list.
• Nothing here is shared, sold, exported to an ad network or joined to your customer record. The counter cannot tell whether a visitor is a customer.

The contact form is protected by a captcha we built ourselves for the same reason: reCAPTCHA and hCaptcha would put a third party's script on the page and send it your IP and your behavior. Ours runs entirely on this server and sends nothing anywhere.

5. Signing in without a password

The account area has no passwords. You type your email, we email you a six-digit code, you type the code and you are in. The code is stored hashed, expires after a few minutes, works once, and is rate-limited by email address and by IP address, which is why the IP that requested it is recorded briefly. Old codes are deleted automatically. The practical benefit is that we hold no permanent secret of yours: there is nothing here for an attacker to steal and reuse on the site where you reused that password.

6. Who else handles your data

We keep the list of companies that touch your data as short as it can be:

That is the whole list. There is no analytics vendor, no advertising network, no marketing automation platform, no chat widget, no session recorder and no data enrichment service. If we ever have to add one, it will be named here before it goes live.

Beyond those, we disclose data only when a law or a valid legal process requires it, or when it is necessary to protect our rights or investigate abuse or fraud.

7. How long we keep it

• Orders and invoices: as long as accounting and tax law requires us to keep them, which is a matter of years and is not something we can shorten on request.
• Your account and license: for as long as the license exists, because it is what proves the key is yours.
• Activation records: the current seats while they are active; a released seat leaves a dated log entry.
• Support tickets: kept while they are useful history for your account, deleted on request unless they relate to an order we still have to keep.
• Sign-in codes: deleted automatically after a couple of days.
• Traffic records: aggregated counts with the daily IP hash, which is meaningless after the day it was made.

8. We do not sell your data

We have never sold, rented or shared personal information for money or for anything else of value, and we do not share it for cross-context behavioral advertising. There is no advertising on this site and no list to sell you onto. If that ever changed, it would require an update to this page and, where the law requires it, your explicit opt-in.

9. Seeing, correcting and deleting your data

Everything runs through the contact form, which is the only way to reach us. Ask for a copy of what we hold, a correction, or deletion, from the email address on the account so we can tell it is you. Most of it is visible to you already in your account area: your license, your seats and your tickets.

We answer within 30 days and usually much sooner. Deletion has one honest limit: records tied to a completed purchase (the invoice, the order) have to be kept for the legal retention period, so what we can do is delete everything else and freeze those until they expire. Deleting your account also ends your access to your license key and downloads, so we will confirm you mean it before doing it.

10. If you live in California

The California Consumer Privacy Act, as amended by the CPRA, gives California residents specific rights. In plain language, you have the right to:

• Know what personal information we have collected about you, where it came from, why we collected it and who we disclosed it to.
• Get a copy of that information in a portable form.
• Delete it, subject to the legal exceptions above (mainly records we must keep to complete your transaction and to comply with tax and accounting law).
• Correct anything we hold that is wrong.
• Opt out of the sale or sharing of your personal information. There is nothing to opt out of: we do not sell it and we do not share it for cross-context behavioral advertising, which is why you will not find a "Do Not Sell or Share My Personal Information" link on this site.
• Limit the use of sensitive personal information. Also nothing to limit: we do not collect any.
• Not be discriminated against for exercising any of these rights. Your price, your license and your support are identical either way.

To exercise any of them, send the request through the contact form from the email address on your account, or tell us the order reference. An authorized agent may act for you if they provide written proof that you asked them to. We may need to verify your identity before releasing or deleting anything, which for a store like this normally means confirming control of the email address the license was issued to. Verified requests are answered within 30 days.

For the categories the statute uses: over the past twelve months we have collected identifiers (name, email, IP address in the limited ways described above), commercial information (what you bought and when), and internet activity information (the anonymous page counts in section 4). We collected them to sell and support the software, and we disclosed them only to the processors listed in section 6.

11. If you live somewhere else

This site sells to the United States and this policy is written for a U.S. reader. That is not a way of ignoring anyone: we honor access, correction and deletion requests from wherever you are, through the same form, on the same timetable, without arguing about which statute applies. Other U.S. states with their own privacy laws grant rights close enough to the California list above that we simply apply the same process to everybody.

12. Children

This site and this product are not for anyone under 18. We do not knowingly collect personal information from children, and futures trading is not a minor's business in any case. If you believe a minor has given us information, tell us through the contact form and we will delete it.

13. Security

The site is served over HTTPS. Sign-in codes are stored hashed, not in the clear. The session cookie is HttpOnly and SameSite. Database queries are parameterized and forms are protected by a CSRF token and by our own captcha. Card data never touches our server, and administrative access is limited to the people who need it. None of this makes any system perfect (anyone who tells you their system is perfect is guessing), so if you spot something wrong, report it through the contact form and we will treat it seriously and quickly.

14. Changes to this policy

If what we collect or who processes it changes, this page changes first, with a new date at the top. Material changes affecting people who already have an account are announced by email to the address on the account. The current version is always the one published at this address.