Privacy Policy
This Privacy Policy explains what personal data TradeVizor (“we”, “us”) collects when you use the web application at https://tradevizor.ai (the “Service”), why we collect it, who we share it with, how long we keep it, and the rights you have under the General Data Protection Regulation (GDPR) and Dutch law. It applies to everyone who visits our website or holds an account.
In short. We process your trading data to run your journal, and nothing else. We do not sell it, we do not use it for advertising, we set no tracking cookies, and AI providers only see your data when you run an AI feature yourself. You can ask for a copy or for deletion at any time.
1. Who is responsible
The controller of your personal data is [Owner legal name], a sole proprietorship registered with the Dutch Chamber of Commerce under number [KVK number], trading as TradeVizor, [Street and number], [Postal code] [City], the Netherlands. For every question or request about your data, email support@tradevizor.ai. We have not appointed a data protection officer, as the law does not require one for our processing.
2. What data we process and why
We process the following categories of data. The legal basis under Article 6 GDPR is given for each.
| Data | Purpose | Legal basis |
|---|---|---|
| Account data: email address, a hashed password, sign-in timestamps and IP addresses in authentication logs. | Creating and securing your account, signing you in, sending account emails (confirmation, password reset). | Performance of our contract with you; legitimate interest in security. |
| Trading data: the broker statements you upload or trades you enter, including instruments, dates, sizes, prices, leverage, fees, profit and loss, open positions and any account identifiers your broker includes in its export. | Providing the journal and every analytic built on it. | Performance of the contract. |
| Journal data: labels, notes, moods, process checklists, strategy names, your trading profile (style, risk settings, goals) and watchlist. | Providing the journal, the reviews and the analytics you request. | Performance of the contract. |
| Delivery settings: Telegram chat id, alert rules, briefing opt-ins, time zone, display preferences. | Delivering the alerts and briefings you switch on, and showing the app the way you set it. | Performance of the contract; your choice to enable each channel. |
| Broker API credentials, if you connect a broker account. Stored encrypted. | Reading your trade history from the broker and, if you opt in, maintaining price alerts in your broker account. | Performance of the contract at your request. |
| AI reports: the text generated for you by the AI features, and the evidence it was built on. | Showing you your reviews and answers, and letting you see earlier ones. | Performance of the contract. |
| Usage and technical data: pages requested, feature runs, AI usage and credit ledger, error logs, browser and device information. | Operating, securing, debugging and metering the Service; enforcing plan limits; preventing abuse. | Legitimate interest in running a reliable, secure service; performance of the contract for metering. |
| Billing data (once paid plans are available): plan, invoices, payment status. Payment details are held by our payment provider. | Charging for paid plans and credits, bookkeeping. | Performance of the contract; legal obligation (tax and accounting records). |
| Correspondence: what you send us by email. | Answering your questions and requests. | Legitimate interest in supporting you; legal obligation for rights requests. |
We do not use your data for advertising, we do not build marketing profiles, and we do not sell or rent personal data to anyone. We send no marketing email unless you have asked for it, and every such email would carry an unsubscribe link.
3. AI features and your data
Some features use an AI model provided by Anthropic to write a narrative over calculations we make ourselves. When you run such a feature, the evidence for that run, meaning statistics and excerpts of your own trades, labels, notes and trading profile, is sent to the model provider, processed to produce the text, and returned to us. Under the provider’s commercial terms this data is not used to train its models. We store the generated text in your account so you can read it again; you can have it deleted with the rest of your data.
AI features run only when you or a schedule you armed start them. On the Free plan no AI feature runs unless you spend credits on it. Text generated by an AI system is marked as such where it is shown. The Service makes no decision with legal or similarly significant effect on you by automated means.
4. Who we share data with
We use the following providers to run the Service. Each acts on our instructions under a data processing agreement, or, for services you connect yourself such as Telegram and your broker, under its own terms as an independent controller of what you send it.
| Provider | Purpose | Data involved | When |
|---|---|---|---|
| Supabase, Inc. | Authentication, database and file storage for the Service | All account and trading data, stored in [Supabase region, e.g. Frankfurt (eu-central-1)] | Always |
| Vercel, Inc. | Hosting and delivery of the web application | Request data (IP address, browser, pages requested) and the pages we render for you | Always |
| Resend (Plus Five Five, Inc.) | Sending of transactional email (sign-in confirmations, password resets, the weekly briefing) | Your email address and the content of the emails we send you | Always for account email; the weekly briefing only if you opt in |
| GitHub, Inc. | Running the scheduled background jobs that compute alerts, briefings and analytics | Trading and watchlist data processed transiently in memory; nothing is stored there | Paid plans, for alert and briefing jobs |
| Anthropic, PBC | The AI model behind the AI features | The evidence the feature is built on: statistics and excerpts of your own trades, labels, notes and trading profile, as shown in the feature. Not used by Anthropic to train models under its commercial terms | Only when you run an AI feature |
| Telegram FZ-LLC | Delivery of alerts and the weekly briefing to your Telegram account | The chat id you enter and the messages we send | Only if you enable Telegram delivery |
| eToro (Europe) Ltd. | Reading your account and trade history, and maintaining price alerts in your eToro account | The API keys you enter (encrypted at rest), and the alert levels we create for you | Only if you connect your eToro account |
| Market data sources (paid plans) | Price and options data for the instruments you trade or follow | Ticker symbols requested. No account or personal data is sent | Paid plans only |
| Stripe Payments Europe, Ltd. | Payment processing and subscription management | Name, email, billing details and payment method; we never see or store full card numbers | Only when you buy a paid plan or credits, once available |
We may also disclose personal data where the law requires it, to protect our rights or the safety of users, or to a successor if the business is transferred, in which case we will inform you.
5. International transfers
Your account and trading data is stored in the European Union. Some of the providers above are established in the United States or may process data there. Where personal data leaves the European Economic Area, we rely on an adequacy decision of the European Commission (including the EU-U.S. Data Privacy Framework where the provider is certified) or on the European Commission’s Standard Contractual Clauses, with additional safeguards where needed. You can ask us for details of the safeguards used for a specific provider.
6. How long we keep data
- Account, trading and journal data: for as long as your account exists. When you delete your account, or ask us to, we delete it within 30 days. Copies in encrypted backups are overwritten within a further 30 days.
- Broker API credentials: until you disconnect the broker or delete your account, whichever comes first.
- Alerts and briefings sent to you: kept in your notification feed for as long as your account exists.
- Technical and security logs: up to 90 days.
- Billing records: 7 years after the financial year in which they were created, as Dutch tax law requires, even if you delete your account.
- Correspondence: up to 2 years after the matter is closed.
- Inactive Free accounts: after 24 months without a sign-in we may delete the account after warning you by email.
7. How we protect data
All traffic to and from the Service is encrypted in transit (TLS). Data is stored in a database where every table is isolated per user by row-level security, so one account can never read another’s data. Broker credentials are encrypted at rest with a key held only on our servers. Server keys never reach your browser. Access to production systems is limited to the operator and protected by multi-factor authentication. We keep no card data. If a breach of personal data ever occurs that is likely to put you at risk, we will inform you and the Dutch Data Protection Authority as the GDPR requires.
9. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you and receive a copy;
- rectify inaccurate data (most of it you can edit yourself in the Service);
- erase your data (“right to be forgotten”), subject to the retention we must keep by law;
- restrict or object to processing based on our legitimate interests;
- data portability: receive the data you provided in a structured, machine-readable format;
- withdraw consent at any time where processing relies on it, for example by switching off a delivery channel, without affecting the lawfulness of earlier processing.
You can exercise the two most common rights yourself, at any time, under Settings → Account: Download my data gives you every record we hold for you as one machine-readable file, and Delete account erases the account and all of its data at once. For anything else, email support@tradevizor.ai from the address on your account. We respond within one month; for complex requests we may extend this by two months and will tell you if so. Exercising your rights is free unless a request is manifestly unfounded or excessive.
You also have the right to lodge a complaint with a supervisory authority. In the Netherlands this is the Autoriteit Persoonsgegevens (Dutch Data Protection Authority), Postbus 93374, 2509 AJ Den Haag, autoriteitpersoonsgegevens.nl. If you live in another EU country you may complain to the authority there.
10. Children
The Service is intended for adults and is not directed at anyone under 18. We do not knowingly collect personal data from children. If you believe a child has created an account, contact us and we will delete it.
11. Changes to this policy
We will update this policy when the Service, our providers or the law change. The effective date at the top tells you which version you are reading. For material changes we will notify you by email or in the Service before they take effect. The current version is always available at https://tradevizor.ai/privacy.
Effective date: 19 September 2026.