Privacy Policy

Last updated: [PLACEHOLDER — set before launch]

Legal placeholder. Replace this page with counsel-reviewed Privacy Policy and GDPR disclosures before public launch. Do not treat this draft as legal advice.

1. Data controller

Data controller: [PLACEHOLDER — legal company name], [PLACEHOLDER — registered address]. Contact: [PLACEHOLDER — privacy email].

2. Data we process

Account data (email, name, authentication identifiers)
Trading journal data you enter or import
Billing metadata synced from Stripe (subscription status, customer ID — not full card data)
Technical logs required to operate and secure the service

3. Processors

We use Supabase (hosting/database/auth/storage), Stripe (payments), Vercel (application hosting), and optionally Upstash (rate limiting). Each processor is bound by their respective terms and, where applicable, Data Processing Agreements.

4. Your rights (GDPR)

Depending on your location, you may have rights to access, rectify, erase, restrict, or port your personal data, and to object to processing. To exercise rights, contact [PLACEHOLDER — privacy email].

Account deletion/self-service export: [PLACEHOLDER — not yet implemented; see GO-LIVE checklist].

5. Retention

We retain data while your account is active and as required for billing, security, and legal obligations. Define retention periods in the final policy.