Privacy Policy

1. Data Controller

The data controller responsible for your personal data is:

2. Data We Collect

• Account data: email address, hashed password;
• Chart images: screenshots you upload or paste for analysis, and the AI-generated analysis + chat messages tied to them;
• Usage data: number of analyses and chat messages used, for quota enforcement;
• Billing data: subscription plan and status — payment details themselves are handled entirely by Stripe and are never stored on our servers;
• Technical data: IP address, session/auth cookies, basic request logs.

3. Legal Basis for Processing

We rely on the following legal bases under Article 6 GDPR:

• Performance of a contract — creating and operating your account, generating analyses you request, processing billing;
• Legitimate interests — securing the Service, preventing abuse, enforcing usage quotas, and basic technical logging, where these interests are not overridden by your rights;
• Legal obligation — retaining billing/invoice records as required by Slovenian accounting and tax law.

We do not rely on consent as a basis for any of the processing described above; where we ever introduce optional processing that requires consent (e.g. marketing emails), we will ask for it separately and you may withdraw it at any time.

4. How We Use Your Data

• To create and manage your account and enforce plan quotas;
• To generate the chart analysis and chat responses you request;
• To process subscriptions and billing via Stripe;
• To maintain your analysis history so you can revisit past results;
• To keep the Service secure and prevent abuse.

5. Chart Images & AI Processing

Chart screenshots you submit are sent to our AI provider, Anthropic (Claude), for analysis and are stored so you can view your analysis history. We do not use your chart images to train AI models, and we do not sell or share them other than as described in this policy. Because AI processing is inherently probabilistic, we cannot guarantee the accuracy of AI-generated output — see our Terms of Service for the full disclaimer.

6. Automated Decision-Making

The Service produces AI-generated descriptions (trend direction, confidence score, support/resistance levels, chart patterns) for your own review. This output is informational only — it is not used by us to make any automated decision that produces a legal or similarly significant effect concerning you, and it is not a substitute for your own judgment. Article 22 GDPR automated-decision-making rights are therefore not engaged by this processing.

7. Data Sharing & Third Parties

We do not sell your personal data. We share data only with the service providers needed to operate the Service, each bound by a data processing agreement:

• Stripe — payment processing and subscription billing;
• Anthropic (Claude) — to generate the chart analysis you request;
• Hetzner — hosting provider, to run the application and store your data;

and where required by law, to enforce our Terms of Service, or to protect the rights, property, or safety of the Operator, our users, or others.

8. International Data Transfers

Our hosting infrastructure (Hetzner) is located within the EU. Our AI provider, Anthropic, is based in the United States; where your data is transferred outside the EU/EEA for AI processing, we rely on appropriate safeguards recognised under GDPR (such as Standard Contractual Clauses or an equivalent adequacy mechanism) to protect it. You may request further details of these safeguards by contacting us.

9. Cookies

We use strictly necessary cookies to keep you signed in (a short-lived access token and a longer-lived, httpOnly refresh token). We do not use third-party advertising or tracking cookies.

10. Data Retention

We retain your account, chart images, and analysis history for as long as your account is active. If you close your account, we delete or irreversibly anonymise your personal data within 30 days, except for billing/invoice records, which we retain for the period required by Slovenian accounting and tax law (currently up to 10 years), and any data we must retain to establish, exercise, or defend legal claims.

11. Your Rights

Under the GDPR, you have the right to: access the personal data we hold about you; request correction of inaccurate data; request erasure; request restriction of processing; receive a copy of your data in a portable format; object to processing based on our legitimate interests; and withdraw consent for any processing based on consent, at any time. To exercise any of these rights, contact us using the details below — we aim to respond within 30 days.

You also have the right to lodge a complaint with the Slovenian data protection authority (Informacijski pooblaščenec, Dunajska cesta 22, 1000 Ljubljana, Slovenia — [email protected]), or with the supervisory authority in your own EU/EEA country of residence, if you believe our processing of your data infringes the GDPR.

12. Children's Privacy

The Service is not directed at, and must not be used by, anyone under 18 years of age (see our Terms of Service, Eligibility). We do not knowingly collect personal data from anyone under 18. If we become aware that we have done so, we will delete it promptly.

13. Security

We use TLS encryption in transit, hashed password storage, and access controls to protect your data. No internet-connected system can guarantee absolute security, and we cannot guarantee that unauthorised access, hardware failure, or other data loss will never occur.

14. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated by email or an in-app notice. Continued use of the Service after the effective date constitutes acceptance.

15. Contact