Privacy policy

This policy explains what personal data we process when you visit audalyst.com, join the waitlist or use the app.audalyst.com application (together, the Service), what we use it for, who we share it with and how you can exercise your rights. We apply it in accordance with the General Data Protection Regulation (GDPR) and Spanish Organic Law 3/2018 on the Protection of Personal Data and Guarantee of Digital Rights (LOPDGDD).

1. Data controller

The controller of your data is Audalyst SL. For any privacy matter you can write to us at support@audalyst.com.

2. What data we process

If you join the waitlist

• Your email address.
• Minimal technical data: the sign-up date, the language of the page you signed up from and your browser's user agent, for security and abuse prevention.

If you have an account in the application

• Account data: email, first and last name, country of residence, time zone and language; the version of the terms and of this policy you accepted and when, including your statement that you are of legal age; your plan and your usage of it; and, if you tick it, your preference to receive news by email.
• Credentials: we never see your password; the authentication service only stores an irreversible fingerprint (hash) of it. If you sign in with Google, we receive your email, your name and an identifier of your Google account from Google, nothing else.
• Exchange data: the read-only API keys you connect (stored encrypted), the name you give each account and the trades we read from it: dates, market, side, sizes, prices, fees, funding and results.
• Data you generate in the application: signals received from your alerts, strategy and bot configurations with their version history, simulation and optimization results, journal notes and ratings, and your answers to behavior flags.

If you write to us

Your email address and the content of the messages you send us and our replies.

Technical data

Like any internet service, our servers log data about each request (for example, date and time, requested path and IP address) for security and troubleshooting. We also count requests per minute in memory to prevent abuse, without storing them.

What we do not ask for

We do not ask for your phone number, date of birth, postal address, identity document or bank or card details. During the beta the Service is free and we do not process payment data. We do not process special categories of data (health, beliefs, etc.).

3. What we use it for and on what legal basis

• Managing the waitlist and letting you know when we can give you access. Basis: your consent, given when you submit the form, which you can withdraw at any time.
• Creating and maintaining your account, inviting you and letting you sign in. Basis: performance of the service you request (Art. 6.1.b GDPR).
• Reading your trades and showing you your statistics, journal, flags, simulations and optimizations. Basis: performance of the service (Art. 6.1.b GDPR).
• Applying your plan and its usage limits. Basis: performance of the service.
• Sending you the necessary account emails and answering your questions. Basis: performance of the service.
• Keeping proof that you accepted the terms and are of legal age. Basis: our legitimate interest in being able to prove it and defend ourselves against claims (Art. 6.1.f GDPR).
• Protecting the Service, preventing abuse and fixing faults. Basis: our legitimate interest in the security of the Service (Art. 6.1.f GDPR).
• Sending you Audalyst news. Basis: your consent, only if you tick the corresponding box, which is unticked by default. You can withdraw it in the application settings or by writing to us.
• Complying with legal obligations and requests from authorities. Basis: legal obligation (Art. 6.1.c GDPR).

4. Automated analysis

The Service analyzes your trades automatically to show you statistics and behavior flags (for example, re-entering right after a loss). That analysis is for you, you can answer it, and it produces no legal effects and does not significantly affect you. We do not make automated decisions about you within the meaning of Article 22 GDPR, we do not build profiles for commercial purposes and we do not use your data for advertising.

5. Who we share your data with

We do not sell or hand over your data to third parties. To provide the Service we rely on providers that process it on our behalf (processors), under contract and only on our instructions:

• Supabase (database and authentication for the application, and the waitlist). Application data is hosted in its Western Europe region (Ireland).
• Oracle Cloud (the server that runs the application and where your exchange keys are decrypted, in memory only, when your data is read). Data center in Europe.
• Vercel (hosting of the audalyst.com website and the waitlist form, and aggregated, cookie-free visit measurement).
• Resend(sending the Service's emails: invitations, sign-in and internal notices of new waitlist sign-ups).
• Zoho (support mailbox), in its European Union data centers.

In addition:

• Google, only if you choose to sign in with your Google account. In that case Google acts as controller of its own authentication service, under its privacy policy.
• Your exchange and, if you use them, TradingView or other tools you connect: we receive data from them at your request, and it is also governed by their own terms.
• When you open some screens of the application, your browser downloads cryptocurrency icons directly from a third-party service (CoinCap). That request reaches it with your IP address and the usual browser data; we do not give it any other data.
• Authorities, judges and courts, when a law requires us to disclose data to them.

6. International transfers

Some of these providers are companies based outside the European Economic Area or may access data from outside it (for example, the United States). In those cases the transfer relies on the standard contractual clauses approved by the European Commission and, where the provider has joined it, on the EU-US Data Privacy Framework. You can ask us for information about these safeguards at support@audalyst.com.

7. How long we keep data

• Waitlist: until we give you access and you create your account, until you ask to be removed or until we close the list, whichever comes first.
• Account and application data (profile, exchange accounts, trades, signals, configurations, results and journal): for as long as you keep the account. When you close it we delete it, except what we must keep by law.
• Proof of acceptance of the terms: while you hold the account and, afterwards, blocked for the limitation periods of any legal claims that may arise.
• Support emails: for as long as needed to handle your request and, afterwards, blocked for the applicable limitation periods.
• Technical logs: for the limited time needed for security and troubleshooting.

Blocking means keeping the data set aside, unused, available only to judges, courts and authorities, and deleting it when that period ends.

8. Your rights

You can exercise at any time your rights of:

• Access: knowing what data of yours we process and getting a copy.
• Rectification: correcting inaccurate data. You can change part of it yourself in the application settings.
• Erasure: asking us to delete your data and your account.
• Restriction: asking us to stop using it while a complaint is resolved.
• Portability: receiving the data you gave us in a structured, commonly used format.
• Objection: objecting to processing based on our legitimate interest.
• Withdrawal of consent: without affecting what was done before you withdrew it.

To exercise them, write to support@audalyst.com from the email linked to your account or to the waitlist, saying which right you want to exercise. We will reply within one month, which may be extended in complex cases after letting you know. We may ask you to confirm your identity so no one else can act on your behalf. It is free of charge.

If you believe we have not handled your data properly, you can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es) or with the supervisory authority of your country of residence in the European Union.

9. Cookies and browser storage

We only use what is essential for the Service to work. We do not use advertising, tracking or third-party analytics cookies.

• Website (audalyst.com): a langcookie that remembers the language you choose in the selector, for one year. Vercel's visit measurement is aggregated and does not use cookies.
• Application:the authentication service's session cookie (its name starts with sb-), which keeps you signed in, and a NEXT_LOCALE cookie that remembers your language. The application also stores your display preferences (theme, columns, filters, guides already seen) in your browser's local storage. That storage is not sent to our servers.

As they are technical and necessary to provide the service you request, they do not require your consent (Art. 22.2 of the Spanish Information Society Services Act). You can delete them from your browser settings; if you do, you will need to sign in again and those preferences will be lost.

10. Security

• Your exchange API keys are stored encrypted (AES-256-GCM) and must be read-only, so the Service cannot trade or withdraw funds.
• The personal key for your alerts is stored only as an irreversible fingerprint and you can revoke it whenever you want.
• Each user can only access their own data.
• All communication with the Service is encrypted (HTTPS).
• Internal access to systems is limited to those who need it to provide the Service.

No measure is infallible. If a security breach affecting your data occurred, we would report it to the supervisory authority and, where it poses a high risk to you, to you as well, within the legal deadlines.

11. Minors

The Service is only for people over 18. We do not knowingly process data of minors. If we find out that a minor has registered, we will delete their account and data.

12. Links to other sites

The website and the application may link to third-party sites (for example, your exchange). We are not responsible for their privacy practices; we recommend reading their policies.

13. Changes to this policy

We may update this policy to reflect changes in the Service or in the law. The version in force is always the one published on this page, with its date. If a change is material, we will notify you by email or inside the application.

14. Language and contact

This English version is provided for convenience; in case of any discrepancy, the Spanish version prevails. For any privacy matter: Audalyst SL, support@audalyst.com.