Draft. This text is a template and must be reviewed by a lawyer before the service is opened to paying customers. Fields in [square brackets] must be filled in.

Privacy Policy

Last updated: [date]

Data controller

[Company name] (reg. no. [Company registration number]) is the data controller for personal data in Journvex. Contact us at [email address].

What data we process

Account: email address and password (the password is stored encrypted and cannot be read by us).
Content you record: trades, journal notes, strategies, playbook, settings and screenshots you upload. This may contain information about your financial situation, and we process it only to deliver the service to you.
Payment: the payment provider Stripe handles card details. We store a customer ID, subscription status and period, but not the card number.
Technical data: cookies that keep you signed in, and necessary operational logs.

Purpose and legal basis

Delivering the service and managing your account: contract (GDPR art. 6(1)(b)).
Payment, accounting and bookkeeping: legal obligation (art. 6(1)(c)).
Security and prevention of abuse: legitimate interest (art. 6(1)(f)).

We do not use your data for advertising, and we do not sell it. We do not use tracking tools.

Processors

We use these providers to run the service: [Supabase (database, authentication and file storage, region: …)], [Stripe (payments)], [hosting provider, for example Vercel], [email delivery]. They process data on our behalf and under agreement. Where data is transferred outside the EEA, this is done on the basis of the EU Standard Contractual Clauses or equivalent safeguards. [Fill in and verify.]

Cookies

We only use strictly necessary cookies to keep you signed in. We do not use analytics or marketing cookies.

How long we keep data

Your content is stored for as long as you have an account. When you delete your account, the account and all content, including screenshots, are deleted. Data we must retain under accounting and bookkeeping law (for example invoices and payment history at Stripe) is kept for as long as the law requires, normally five years. [Verify.]

Your rights

You have the right to access, rectification and erasure, to restrict or object to processing, and to receive your data in a common format. You can download your data (CSV and JSON) and delete your account yourself under Settings. For other requests, contact us at [email address]. You may complain to your data protection authority if you believe we process data in breach of the rules.

Security

Data is sent encrypted. Each user has access only to their own data, and this is enforced in the database. Screenshots are stored privately and shown only to the owner through temporary links. No service can be guaranteed completely secure. Let us know at [email address] if you notice anything that looks wrong.

Changes

We may update this policy. For material changes we will notify you.