Privacy Policy

1. Who we are

FxNova UG (Haftungsbeschränkt) (“FxNova”, “we”, “us”) operates the FxNova trading-education platform and related online services (collectively, the “Services”), including:

• fxnova.de– learning platform, courses, account and subscription management
• ai.fxnova.de– AI trading analyzer and chat
• journal.fxnova.de– trading journal
• community.fxnova.de– community and leaderboard features

This Privacy Policy explains how we collect, use, store, and share personal data when you visit our websites, create an account, subscribe to a plan, use our tools, or otherwise interact with us. If there is a conflict between our Terms and Conditions and this Privacy Policy regarding the processing of personal data, this Privacy Policy prevails.

For the purposes of applicable data protection law, FxNova is the data controller. Contact details are in Section 14.

2. Personal data we process

“Personal data” means information relating to an identified or identifiable person. Depending on how you use the Services, we may process:

• Account and identity data– email address, password hash, user ID, display name or username, profile settings, subscription plan, and account status.
• OAuth and social-login data– when you sign in with Google, GitHub, or Discord, or connect LinkedIn in settings, we receive data from the provider (such as name, email address, profile identifier, and public profile information you authorize).
• Risk disclaimer data – your full legal name (full_name), the language of the disclaimer you signed (accepted_locale), and the timestamp when you accept our risk disclaimer before using trading tools.
• Subscription and billing data– selected plan, billing period, payment status, Stripe customer and subscription identifiers, invoices, and limited billing metadata. Card details are processed by Stripe, we do not store full payment card numbers.
• Learning data– course progress, completed lessons, streaks, quiz or assessment results, and gamification metrics.
• Trading journal data– trade dates, instruments, P&L, notes, strategy descriptions, mental state, execution quality, and related journal fields you enter.
• Imported trade data (CSV)– contents of trade-history files you upload to the analyzer or related tools, including symbols, prices, timestamps, profit/loss, and other columns present in your file.
• Screenshots– images you attach to journal entries, stored in our cloud storage.
• AI chat data– chat messages, conversation threads, optional file attachments you send in chat, and derived trading context (such as KPIs and recent trade summaries) transmitted to our AI provider for response generation.
• Community data– public profile information shown on leaderboards (for example display name and linked social profiles you choose to show).
• Support and communications– information you send when contacting us.
• Technical and usage data– IP address, browser type, device information, session cookies, log data, page views, performance metrics, and interaction data collected through analytics tools described in Section 7.

3. Sources of personal data

• Directly from you– when you register, complete forms, upload files, use the journal or AI chat, accept the risk disclaimer, subscribe, or contact us.
• Automatically– when you access the Services, including through cookies, session storage, and analytics or performance tools.
• From authentication and social providers– Google, GitHub, Discord, and LinkedIn when you use those integrations.
• From payment provider– Stripe provides subscription and payment status information.
• From processors– infrastructure, hosting, and AI providers that process data on our behalf.

4. Purposes and legal bases (EEA/UK)

We process personal data for the following purposes:

• Providing the Services– account creation, authentication across subdomains, course delivery, journal, analyzer, AI chat, community features, and file storage. Legal basis: performance of a contract (Art. 6(1)(b) GDPR) and, where applicable, steps prior to entering a contract.
• Subscriptions and payments– processing plans, checkout, renewals, and billing support via Stripe. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
• Risk disclaimer record– documenting your acceptance and full name before access to trading tools. Legal basis: performance of a contract and legitimate interests in demonstrating acceptance and limiting misuse (Art. 6(1)(b) and (f) GDPR).
• AI features – generating chat responses using your messages and relevant trading context (aggregated KPIs, trade summaries, strategy descriptions, and recent trade sequences). Legal basis: consent (Art. 6(1)(a) GDPR). AI processing is optional, you must actively opt in before the AI chat sends data to OpenAI. You can withdraw consent at any time in Settings → Preferences.
• Security and fraud prevention– protecting accounts, detecting abuse, and maintaining service integrity. Legal basis: legitimate interests (Art. 6(1)(f) GDPR).
• Analytics and product improvement– understanding usage and performance (Vercel Analytics, Speed Insights, and Google Analytics only after cookie consent). Legal basis: consent where required (Art. 6(1)(a) GDPR) or legitimate interests (Art. 6(1)(f) GDPR) for strictly necessary technical metrics.
• Marketing communications– only if you opt in or where permitted by law. Legal basis: consent (Art. 6(1)(a) GDPR) or legitimate interests where applicable.
• Legal compliance– responding to lawful requests and enforcing our terms. Legal basis: legal obligation and legitimate interests (Art. 6(1)(c) and (f) GDPR).

Where processing is based on legitimate interests, you may object as described in Section 12. Where processing is based on consent, you may withdraw consent at any time without affecting prior lawful processing.

5. Processors and recipients

We use trusted service providers that process personal data on our behalf under data processing agreements. Main categories:

• Supabase, Inc. – authentication, PostgreSQL database, and file storage (including journal screenshots). Our production project is hosted in eu-west-1 (AWS Ireland, European Union). Primary account, database, and file data are stored in the EU. Supabase may process limited operational metadata through subprocessors outside the EU under their DPA and Standard Contractual Clauses. DPA: supabase.com/legal/dpa.
• Stripe, Inc. – payment processing and subscription management. Stripe may process data in the United States and other countries. DPA: stripe.com/legal/dpa.
• OpenAI, L.L.C. (USA) – AI chat completion when you have opted in. We send your chat messages, optional file attachments (CSV, TXT, JSON, MD), and derived trading context (KPIs, performance score summaries, strategy descriptions, and recent trade sequences from your uploaded CSV data) to OpenAI servers in the United States. OpenAI acts as our processor under a Data Processing Agreement (DPA) incorporating the EU Standard Contractual Clauses (SCCs) pursuant to Art. 46 GDPR. The USA does not currently have an EU adequacy decision for this processing, transfers are safeguarded by these contractual clauses. OpenAI does not use API data to train its models under our API configuration. OpenAI's privacy policy: openai.com/policies/privacy-policy. DPA: openai.com/policies/data-processing-addendum.
• Vercel, Inc. – hosting of our web applications, Vercel Analytics, and Speed Insights (performance and usage metrics). DPA: vercel.com/legal/dpa.
• Google LLC– Google Analytics (only after you accept cookies via our cookie banner) and Google OAuth for sign-in.
• GitHub, Inc. (Microsoft), Discord, Inc., and LinkedIn Corporation (Microsoft)– OAuth sign-in or optional profile connection.

We do not sell your personal data. We may disclose data if required by law, to protect rights and safety, or in connection with a corporate transaction subject to appropriate safeguards.

We maintain data processing agreements (DPAs) with our main processors where required by Art. 28 GDPR. You can request copies of applicable transfer safeguards by contacting us.

6. International transfers

Personal data may be transferred to countries outside your country of residence, including the United States (OpenAI, Stripe, Vercel, and OAuth providers). Our primary Supabase database is located in the European Union (eu-west-1, Ireland). Where required, we rely on appropriate safeguards such as the EU Standard Contractual Clauses, the UK International Data Transfer Addendum, or adequacy decisions.

OpenAI (USA):When you use the AI chat after opting in, your messages and trade summaries are transferred to OpenAI in the United States. The USA is a third country without an EU adequacy decision for this transfer. We mitigate this through our DPA with OpenAI, which includes the European Commission's Standard Contractual Clauses (Module Two: controller-to-processor). You may request a copy of the relevant transfer safeguards by contacting us. Without your consent, no data is sent to OpenAI.

You may request further information on transfer safeguards by contacting us.

7. Cookies and analytics

We use technically necessary cookies and similar technologies for authentication, session management, and security across the FxNova subdomains.

Vercel Analytics and Speed Insights help us measure page views and web performance. These tools are designed to collect limited, privacy-oriented usage data.

Google Analytics is loaded only if you accept cookies in our cookie banner. If you decline, Google Analytics is not activated. You can change your choice by clearing site cookies or contacting us.

8. Retention

We retain personal data only as long as necessary for the purposes described above, including:

• Account and profile data – for the life of your account and a reasonable period thereafter for legal or backup purposes.
• Journal entries, CSV imports, screenshots, and AI chat threads – until you delete them or close your account, unless longer retention is required by law.
• Risk disclaimer records – for as long as needed to demonstrate acceptance.
• Billing records – as required by tax and commercial law (typically up to 10 years in Germany).
• Server logs and security data – for a limited operational period, usually up to 90 days unless needed for incident investigation.

9. Security

We implement appropriate technical and organizational measures to protect personal data, including encryption in transit, access controls, and row-level security in our database. No method of transmission or storage is completely secure. Please use a strong password and keep your credentials confidential.

10. Children

The Services are intended for adults. We do not knowingly collect personal data from children under 16. If you believe a child has provided us data, contact us and we will delete it where required.

11. Automated decision-making

We do not make decisions with legal or similarly significant effects based solely on automated processing. AI outputs are educational and informational only, they do not determine access to the Services or contractual outcomes.

12. Your rights

Depending on your location, you may have the right to access, rectify, erase, restrict, or object to processing, and to data portability. Where processing is based on consent, you may withdraw consent. You may also lodge a complaint with a supervisory authority.

To exercise your rights, download a machine-readable copy of your data under Settings → Security in any FxNova app, or email info@fxnova.de. We may need to verify your identity before responding. You can withdraw AI processing consent at any time under Settings → Preferences in the AI app, this does not affect the lawfulness of processing before withdrawal.

For users in the EEA/UK, supervisory authorities include the authority in your country of residence. Our lead supervisory authority in Germany is the Hessian Commissioner for Data Protection and Freedom of Information (Hessische Beauftragte für Datenschutz und Informationsfreiheit).

13. Third-party links

Our Services may link to third-party websites. Their privacy practices are governed by their own policies. OAuth providers process data according to their terms when you use their login or connection features.

14. Changes and contact

We may update this Privacy Policy to reflect changes in our Services or legal requirements. The “Last Updated” date will be revised accordingly.

Contact: