Privacy Policy

The controller of your personal data is Kitroot Ltd., 61 Agiou Pavlou, Agios Andreas, 1107 Nicosia, Cyprus (registration no. HE467135). For any privacy question or request write to [email protected]. We have not appointed a Data Protection Officer; requests to that address are handled by the team responsible for TradeSense.

Account data — email address and authentication identifiers (via Auth0). Subscription data — plan, entitlement and invoice metadata (payment card details are held by Stripe, never by us). Product data you create — watchlist entries, portfolio holdings you enter, read-only broker-synced holdings, annotations, decisions and notification preferences. Usage data — API/MCP call counts for plan metering and service logs for reliability and security. Contact data — what you send through the contact or demo form (name, email, company, message).

To operate the service (show your watchlist, match signals to your holdings, deliver alerts you asked for), to bill your subscription, to secure the platform, and to comply with legal obligations. We do not sell your personal data and we do not use your portfolio data for anything except showing it back to you and matching signals to it.

Legal bases (GDPR Art. 6): performance of our contract with you for the account, product data and alerts; legal obligation for billing and tax records; our legitimate interest in securing and improving the service for logs and usage metering, and in answering you for contact and demo enquiries; and your consent for the optional Telegram alerts, which you can withdraw at any time.

An email address is required to create an account; everything else you give us is optional. Signals, scores and alerts are generated automatically from market data, but no decision with legal or similarly significant effect is made about you by automated means.

If you connect a brokerage (e.g. eToro), the API keys you provide are stored encrypted and used only for read-only holdings synchronisation. We never receive your brokerage password and we never place orders. Disconnecting deletes the stored keys.

The service and its database run on our own infrastructure in a data centre in Cyprus; contact and demo enquiries are stored in that same database. We use these providers, each only as needed for its function: Auth0 (Okta) for sign-in; Stripe for checkout, subscriptions and invoices (card details stay with Stripe); Telegram, only if you link it, to deliver your alerts; and Google Gemini to classify public news headlines (no personal data is sent). Market-data and filings sources receive no personal data. If you connect a broker such as eToro, we read your holdings from it at your request.

Some of these providers process data outside the European Economic Area (notably in the United States). For Auth0, Stripe and Google the transfer relies on the provider’s EU–US Data Privacy Framework certification or the European Commission’s Standard Contractual Clauses. Telegram, which operates outside the EEA, receives your alert text and chat id only if you link it; that transfer is made at your request to deliver the alerts you asked for (GDPR Art. 49(1)(b)).

Account and product data are kept while your account is active and deleted when your deletion request is completed (contact and demo enquiries sent from your account email go with them). Other contact-form records are kept for as long as needed to answer you and follow up on the conversation. Service logs and raw market payloads are kept on rolling windows (days to months) and then purged. Billing, invoice and entitlement records, and the audit trail of access-role changes, are kept for as long as Cypriot tax, accounting and company law requires, even after an account is deleted.

You can download the data the service holds about you from your account page (“Download my data”) and request deletion from the same page; deletion requests are recorded immediately in a privacy ledger and completed by our team. For a copy of contact-form or service-log records, write to us. Depending on your jurisdiction you may also have rights to rectification, restriction, objection and portability — write to [email protected] to exercise them (no account needed). You also have the right to lodge a complaint with a supervisory authority — in Cyprus the Commissioner for Personal Data Protection (Cyprus), or the authority where you live.

Data is encrypted in transit, secrets are stored encrypted, and access is scope-gated per role. We will announce material changes to this policy in-product or by email.

We use only the cookies the service needs to work: your sign-in session and a security cookie. Your browser’s local and session storage keep interface preferences and small conveniences on your device (such as panel layout, the plan you picked before signing in, and that you already sent a deletion request); they are not sent to us as such. We do not use analytics or advertising cookies, and no third-party script runs on the site.