Privacy Policy

Last updated: 4 October 2026

This policy explains what personal data ForexFin (“we”, “us”) collects, why, and your rights under the EU General Data Protection Regulation (GDPR) and the Dutch Uitvoeringswet AVG.

1. Who runs ForexFin

ForexFin is operated as a Netherlands-based sole trader. For any privacy question or to exercise your rights, use the contact form (choose “Privacy or data request”).

2. What we collect, why, and on what legal basis

• Email address — when you sign in. We use it to send single-use sign-in links, the alert emails you set up, and messages about your plan. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
• Trade journal data — the trades you log or import (instrument, direction, size, prices, stop and target, open and close times, profit/loss, setup, notes), your journal accounts (name, broker, currency, planned risk per trade), and the entry/exit tags you apply. We use it to show your journal, statistics and behavior analysis (section 7). It is never sold, never used for advertising, and never used to train AI models. Legal basis: performance of a contract.
• Price alerts (instrument, level, direction, delivery method, optional webhook URL and note, trigger time). Needed to deliver the alerts you create. When an alert has fired, its trigger time is also used to mark trades you opened on the same instrument shortly afterwards (“from alert”). Legal basis: performance of a contract.
• Order payloads (Trader) — if you connect an order receiver: its URL, your send rules (time window, correlated-trade limit, tilt guard, default deviation and expiry), a signing secret (stored encrypted) and a log of what was sent or blocked, including the payload itself (instrument, side, order type, prices, size, your risk settings and note). When you press Send in the Trade Architect, the plan’s numbers are sent to us to size and check the order. Legal basis: performance of a contract.
• Imports. CSV files are read in your browser; only the rows you confirm in the review step are sent to us. Two Trader features send import data to our AI provider, Anthropic (section 3):
  • Screenshot import: the image you upload is sent to Anthropic to read the trades from it. We do not store the image.
  • Automatic column matching for CSV layouts we don’t recognise: the header row and up to three sample rows are sent to Anthropic. We keep the column names (not the values) so the same layout is recognised next time without another request.
  Legal basis: performance of a contract.
• Retrospectives (Trader, Beta) — when you ask for one, the computed statistics for the selected account and period (a week, a calendar month or the whole journal: trade counts, profit/loss totals, tag and detector counts, trade numbers and instrument symbols) are sent to Anthropic to draft a short written summary. Your email address, account names, setup names and trade notes are not sent. The generated summary is stored with your account so it does not need to be generated again. Legal basis: performance of a contract.
• Billing (Trader plan) — payments are handled by Stripe. We store your Stripe customer and subscription IDs, your plan and its status; we never see or store card details. Legal basis: performance of a contract and legal obligation (Art. 6(1)(c)) for tax records.
• Bug reports and feedback sent through our contact form (your message, optional name and email, the page, browser user-agent, app version, IP address). Used to reply and fix the problem. Legal basis: legitimate interest (Art. 6(1)(f)) in running a working service.
• Waitlist sign-ups (email, where you signed up). Used only to tell you when the feature you signed up for is available. Legal basis: your consent (Art. 6(1)(a)); withdraw it any time by emailing us.
• Server logs (IP address, user-agent, request paths, timestamps; sign-in and import events include your email address) — for security, abuse prevention, and debugging. Legal basis: legitimate interest in keeping the service running and secure.
• Analytics events (page views, referrer, anonymised IP, device type) via Google Analytics 4 — only if you accept analytics cookies. Legal basis: your consent.

The calculators on this site run entirely in your browser. The numbers you enter (account balance, lot size, prices, etc.) are not sent to us, except when you are signed in and use the Trade Architect’s exposure check (instrument and direction) or send the plan as an order payload.

If you use the journal without signing in, your trades stay in your browser’s local storage on your device. They reach our server only when you sign in and choose to move them into your account. The behavior preview in that mode (including the sample week) sends the trades to our server to compute the analysis; they are not stored.

3. Who else processes your data

We share the minimum needed with the following processors, all bound by data-processing agreements:

• OVH (EU) — hosting and server infrastructure, including the database and its backups.
• Postmark (US) — transactional email delivery for sign-in links and alert notifications.
• Stripe (Ireland/US) — payments and subscription management for the Trader plan. For fraud prevention and its own legal obligations Stripe acts as an independent controller; see Stripe’s privacy policy.
• Anthropic (US) — AI model provider (Claude) for screenshot import, automatic CSV column matching and the retrospectives. Data is sent only when you use one of these features. Under Anthropic’s commercial terms, data sent through its API is not used to train its models and is kept only for a limited period.
• AgentDelivery (EU) — delivers your order payloads to the receiver URL you set, with retries, and keeps a delivery log. It receives the payload content and the destination URL. AgentDelivery is run by the same operator as ForexFin.
• Google Analytics 4 (US) — only after you grant consent. IP is anonymised; no advertising features are enabled.

Our account on X. ForexFin publishes market-data summaries on X (formerly Twitter). We post by hand; the site does not embed X posts, buttons or tracking pixels, and we send no visitor or account data to X. If you follow, mention, reply to or message our X account, X processes that as an independent controller under X’s privacy policy. We see only what X shows any account holder (your public profile and what you send us) and use it only to reply. Legal basis: legitimate interest in answering people who contact us. The posts are drafted with Anthropic’s help from public market data only; no personal data is involved.

4. International transfers

Where a processor is based outside the EU/EEA or transfers data there (Postmark, Stripe, Anthropic, Google), transfers are covered by the EU–US Data Privacy Framework where the recipient is certified, or otherwise by the European Commission’s Standard Contractual Clauses and supplementary safeguards.

5. How long we keep it

• Account, journal data, retrospectives and alerts: while your account exists. Trades and alerts you delete disappear from your workspace straight away; the underlying records are erased when you ask us to delete your account.
• Screenshots: not stored by us — discarded once the trades have been read.
• Billing: plan and Stripe IDs while your account exists; payment records for 7 years, as Dutch tax law requires (fiscale bewaarplicht).
• Bug reports: as long as needed to handle the report; deleted on request.
• Order payloads: the receiver settings while the receiver exists; the send log while your account exists. AgentDelivery keeps its delivery record for the retention period of its plan (up to 90 days).
• Sign-in links expire after 15 minutes; sign-in sessions after 30 days.
• Server logs: complete logs for up to 14 days. After that, web-server request logs are kept for up to 13 months with the IP address shortened (the last part removed, so it no longer identifies a single connection), for aggregate traffic statistics, then deleted. For security and abuse investigation, an encrypted copy of the full logs is kept for up to 13 months; it is opened only to investigate a specific incident, and every opening is recorded.
• Analytics data (if consented): 14 months in Google Analytics, then automatically purged.

You can request deletion of your account and all associated data at any time by emailing us.

6. Your rights

Under GDPR you have the right to:

• Access the data we hold about you, and receive a copy in a portable format.
• Rectify inaccurate data.
• Erase your data (“right to be forgotten”).
• Restrict or object to processing based on legitimate interest.
• Withdraw consent for analytics at any time — either via the “Change your choice” control on our Cookie Policy page, or by clearing your browser’s site data.
• Lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens, autoriteitpersoonsgegevens.nl) or the supervisory authority in your country of residence.

7. Automated analysis — no automated decisions

The journal analyses your own trades for you. Fixed, published rules look at timing and size (for example a trade opened within 10 minutes of a closed loss, or a position much larger than your usual size on that instrument) and show the result as flags on your trades. These flags are computed when you open the journal and are not stored. The retrospectives (Beta) turn the same statistics for a week, a calendar month or the whole journal into a short written summary; every figure in one must match the computed statistics, otherwise only the statistics are shown.

This analysis is shown only to you. It is descriptive, not investment advice, and it is never used to make decisions about you: it does not affect your access, plan, price, or anything else. We do not perform automated decision-making in the sense of Art. 22 GDPR. Price-alert evaluation is a simple threshold check.

8. Security

Traffic is encrypted in transit with TLS. Your data is stored on servers in the EU. Sign-in is passwordless via single-use email links. Sessions are stored in an HTTP-only cookie scoped to this domain. Access to the production database is limited to the operator.

9. Changes

If we update this policy, we will change the “Last updated” date above and, for material changes, notify account holders by email.

10. Contact

Questions, requests, or complaints: contact form.