Privacy policy

1. Data controller

The controller of the processing described here is atech, the publisher identified in article 1 of the terms. Contact: atech.contact@proton.me.

2. Principle

The service only collects what it needs. The account only knows the email address and the language. No investor profile is requested, no advertising is shown and no data is passed on to third parties for commercial purposes.

3. Data, purposes and legal bases

• Email address and password (never readable in plain text): account creation and sign-in. Legal basis: performance of the contract. Period: until the account is deleted.
• Language: display in the right language. Legal basis: performance of the contract. Period: until the account is deleted.
• Strategies, sheets, entered figures and frozen versions: operation of the service. Legal basis: performance of the contract. Period: until the account is deleted.
• Plan, renewal date and Stripe customer identifier: subscription management. Legal basis: performance of the contract. Period: until the account is deleted.
• Invoices and billing data: accounting and tax obligations. Legal basis: legal obligation. Period: 10 years.
• Funnel counters (daily numbers of sign-ups, first sheets, subscriptions and cancellations, not linked to any person): running the service. Legal basis: legitimate interest. Period: 25 months.
• Visit statistics of the public website: audience measurement (section 7). Legal basis: legitimate interest.
• Technical logs (errors, server calls, technical account identifier): security and bug fixing. Legal basis: legitimate interest. Period: 30 days.
• Messages received by the publisher: answering them. Legal basis: legitimate interest. Period: 3 years after the last exchange.

4. Processors and transfers

Data is processed by the following providers, each for its own part of the service:

• Google (Firebase): authentication (Firebase Authentication), database (Cloud Firestore, stored in the European Union, eur3 region), hosting of the website and the app (Firebase Hosting, a global delivery network that does not store account data) and server functions (Cloud Functions, in Belgium)
• Stripe: payment, invoicing, tax calculation and subscription portal. Stripe is also the controller of its own processing (fraud prevention, financial obligations)
• Cloudflare: audience measurement of the public website (Cloudflare Web Analytics), without cookies
• Resend: sending emails related to the account (address confirmation, password reset, change of address)

Some of these providers are based in the United States or may process data there. These transfers rely on the EU-US Data Privacy Framework where the provider is certified under it, and on the standard contractual clauses of the European Commission.

5. Account deletion

Account data is stored as long as the account exists. The account can be deleted at any time from the app: open the “My account” page, choose “Delete my account”, then confirm. Deletion is immediate and permanent. It cancels any current subscription, with no refund of the current period, then erases the account (email address and language), the strategies, the sheets and their frozen versions. If you can no longer sign in, first reset your password from the app’s sign-in screen.

Only invoices remain archived, for 10 years, by Stripe and by atech, for accounting obligations. Funnel counters, which are totals without any identifier, are not affected. Nothing else can be recovered.

Open the “My account” page

6. Cookies and local storage

The public website sets no cookies. The app only uses the browser storage strictly needed for it to work: sign-in session, theme and language preferences, local copy of the sheets for offline use. These items are exempt from consent. No advertising tracker is used, neither on the website nor in the app.

7. Audience measurement

The public website, and only the website, measures its traffic with Cloudflare Web Analytics: pages viewed, referring site reduced to its domain, country, type of device and browser. No cookie is set, the IP address is not kept, and no person or campaign is tracked. This measurement relies on the legitimate interest of atech and falls within the consent exemption for audience measurement. The app loads no measurement tool.

Anyone may object to it with the button below. The choice is saved in this browser’s local storage, for this website only. No cookie is set and nothing is sent. It applies to this browser on this device: on another device, or after clearing the website’s data, it needs to be made again.

8. Rights

Under the General Data Protection Regulation, each user has the following rights:

• access to their data (article 15)
• rectification (article 16), directly in the app for the email address and language
• erasure (article 17), directly in the app by deleting the account (section 5)
• portability (article 20): their sheets in a machine-readable format, on request
• restriction of processing (article 18) and objection (article 21)
• instructions on what happens to their data after their death

These rights are exercised with the controller (section 1), who replies within one month. In the event of disagreement, a complaint may be lodged with a data protection supervisory authority.

9. Updates

This policy may change. The date of the last update is shown at the top of the page. Users are invited to consult it regularly.