Privacy policy (GDPR)

Controller: [pending] (legal identity, tax ID and address). Data protection contact: [pending].

Account data: email, display name, your password (stored only as an argon2id hash, never in clear), preferred language and theme.

Service usage data: the situations you follow, your notification preferences and channels, your Academy progress, your simulated portfolios and their trades and, if you take part, your community posts.

Technical data: security and audit logs (for example sign-ins and account changes) needed to protect the service.

If you use the Faro copilot, we store your conversations and the notes Faro keeps for context, and the text of your questions is sent to the language-model provider to generate the answer.

Product usage events tied to your account (for example, which features you use), to understand and improve the service.

Providing the service you request by signing up (performance of a contract, Art. 6(1)(b) GDPR): account, following situations, notifications and Academy.

Keeping the service secure and intact, and understanding how it is used to improve it (legitimate interest, Art. 6(1)(f) GDPR).

Sending the transactional emails the service requires (verification, password reset, alerts you switch on).

Web hosting: Vercel. Database and content management: Railway. Transactional email: Resend. Faro copilot: Anthropic. Some of these providers may process data outside the European Economic Area under the safeguards of Chapter V GDPR (standard contractual clauses).

We keep account data while the account is active; after it is closed it is erased, except what must be kept by law. Specific periods: [pending].

You may exercise your rights of access, rectification, erasure, objection, restriction and portability by writing to the data protection contact above.

If you believe the processing does not comply with the law, you may lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).