Legal

Privacy policy

Last updated: May 2026

1. Data Controller

Tradalyst (“Tradalyst” or “we”) acts as the data controller for the personal data collected through this platform. Contact email: [email protected]. Country: Spain.

2. What Data We Collect

  • Account data: display name, email address and password (stored securely with bcrypt — never in plain text).
  • Trade data: assets traded, entry and exit prices, trade reasoning and emotional state recorded by the user.
  • Usage data: language preference, theme preference (light/dark) and watchlist assets.
  • Technical data: IP address (recorded in server logs) and session cookies (JWT token stored in an httpOnly cookie).
  • Analytics data: browsing data collected by Google Analytics only with the user's prior consent.

3. How We Use Your Data

  • Service delivery: to provide the trading journal, AI analysis, dashboard and all platform features.
  • Authentication and security: to verify user identity and protect account access.
  • Product improvement: to analyse service usage and introduce improvements.
  • Web analytics: to obtain anonymous usage statistics, only when the user has given explicit consent.

4. Legal Basis for Processing

  • Contract performance (Art. 6(1)(b) GDPR): processing is necessary to deliver the service requested by the user.
  • Consent (Art. 6(1)(a) GDPR): analytics cookies are only set with the user's prior consent, which can be withdrawn at any time.
  • Legitimate interests (Art. 6(1)(f) GDPR): technical logs and security information are processed under Tradalyst's legitimate interest in maintaining the security and integrity of the service.

5. Data Retention

  • Account and trade data: retained while the account remains active.
  • Technical logs: retained for a maximum of 30 days.
  • After account deletion: all personal data is permanently deleted within a maximum of 30 days.

6. Your Rights (GDPR Arts. 15–22)

Under the General Data Protection Regulation (GDPR) you have the right to:

  • Access: know what personal data we process about you.
  • Rectification: correct inaccurate or incomplete data.
  • Erasure (“right to be forgotten”): request deletion of your personal data.
  • Portability: receive your data in a structured, commonly used format.
  • Objection: object to the processing of your data.
  • Restriction: request that processing is restricted in certain circumstances.

To exercise any of these rights, send an email to [email protected] with the subject “GDPR Rights Request”. We will respond within 30 days. You also have the right to lodge a complaint with the Spanish Data Protection Agency (AEPD) at aepd.es.

7. International Transfers

  • Claude API (Anthropic, Inc., USA): trade data and analysis context may be transmitted to Anthropic to generate AI insights. This transfer is made under EU Standard Contractual Clauses.
  • Google Analytics (Google LLC, USA): only when the user has given explicit consent for analytics cookies.

8. Cookies

For detailed information about the cookies we use, see our Cookie Policy.

9. Changes to This Policy

If we make material changes to this policy, we will notify you by email with reasonable advance notice. The last updated date appears at the top of this document. The current version is always available at tradalyst.com/privacidad.