KomiTrade

Privacy Policy

DRAFT – not in force

This is an outline, not a legal text. It does not apply to anyone yet. Items marked TODO are missing and will be completed and reviewed before the closed beta.

1. Who is responsible

  • TODO operator’s legal name, address and contact email (decided with the form of business).
  • TODO whether a data protection officer is required (GDPR Art. 37).

2. This website

  • The website komitrade.app is a set of static pages hosted on Cloudflare Pages. It sets no cookies, runs no scripts, has no analytics or trackers and loads no fonts or files from other servers.
  • TODO what the hosting provider logs (for example IP addresses) and for how long, per the Cloudflare data processing addendum.

3. The waitlist

  • The waitlist is an email you send us. We keep your address and message in our mailbox to tell you when the closed beta opens.
  • TODO legal basis, retention period and email provider.

4. The app (when it launches)

  • Data we will process: your email and optional name, sign-in data, the trades and transactions you import or sync from your broker (read-only), your notes and tags, and an audit log without the content of your trades.
  • Purpose: keeping a journal of your own trades: import, statistics and read-only broker sync.
  • TODO legal basis for each purpose.

5. Processors and where data is stored

  • Planned processors: Supabase (database, sign-in, file storage), Vercel (application), Cloudflare (DNS, CDN and this website), Paddle (payments, as merchant of record) and an email provider.
  • Planned region: European Union (Frankfurt). Processors based in the USA are covered by Standard Contractual Clauses or the EU-U.S. Data Privacy Framework, as stated in their data processing addenda.
  • TODO email provider; Paddle’s role for buyer data (controller or processor).

6. How long we keep data

  • Account data: until you delete your account; deletion removes your rows and uploaded files.
  • TODO backup retention and payment records required by accounting law.

7. Your rights

  • You can export, correct and delete your data, and object to processing. You can complain to a supervisory authority.
  • TODO how to exercise each right and the contact of the supervisory authority.

8. Security

Planned: each user sees only their own rows (row-level security), encryption at rest and in transit, broker tokens stored encrypted, broker access read-only.

9. Changes and contact

TODO how changes are announced, effective date and contact address.