1. Data controller
The controller of your personal data is [FIRMA: nazwa], [ADRES], Poland, NIP [NIP]. Contact for all privacy matters (including our data-protection contact point): [EMAIL_KONTAKT].
2. What we process and why
- Account data (email, name, password hash, plan) — to create and run your account. Legal basis: performance of a contract (GDPR art. 6(1)(b)).
- Billing data (Stripe customer/subscription IDs, invoice history) — to process payments and meet tax/accounting obligations. Legal basis: contract + legal obligation (art. 6(1)(b), (c)). Card data never touches our servers — it goes directly to Stripe.
- Product analytics (feature usage, aggregate performance) — to improve the service. Legal basis: legitimate interest (art. 6(1)(f)); cookie-based measurement only with consent (see Cookie policy).
- Affiliate attribution (referral code, HMAC-hashed IP and user-agent — never plaintext) — to credit referrers. Legal basis: legitimate interest + consent where cookies are involved.
- Support correspondence — to answer your tickets. Legal basis: legitimate interest / contract.
- Broker API keys you connect — stored encrypted, used only to sync your portfolio or execute your explicit orders. Legal basis: contract.
3. Subprocessors
- Stripe (payments) — USA; SCCs + EU-US Data Privacy Framework.
- Resend (transactional email) — USA; SCCs.
- Cloudflare (CDN, edge cache, DDoS protection) — global edge network; DPF.
- Hetzner (application hosting, databases) — Germany/Finland (EU).
- RunPod (GPU inference for ML models) — USA/EU regions; SCCs. No account PII is sent for inference — only market data and anonymized features.
4. Retention
Account data: for the life of the account, deleted or anonymized within 30 days of account deletion. Billing/tax records: 5 years from the end of the fiscal year (Polish accounting law). Support tickets: 24 months. Hashed affiliate click data: 12 months. Server logs: 30 days.
5. Your rights
You have the right to access, rectify, erase, restrict, and port your data, to object to processing based on legitimate interest, and to withdraw consent at any time (withdrawal does not affect prior lawful processing). Exercise any of these via [EMAIL_KONTAKT] or in Settings. You also have the right to lodge a complaint with the Polish DPA — UODO (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa).
6. What we do NOT do
- We don't sell personal data. To anyone. Ever.
- We don't run third-party ad trackers or advertising pixels.
- We don't store plaintext IPs for analytics — affiliate tracking uses keyed HMAC hashes.