Privacy policy

The controller of personal data is Ing. Karel Ježík, company ID (IČ): 21329753, registered address Plickova 880/19, Háje, 149 00 Praha 4, Czech Republic, an entrepreneur registered in the Czech Trade Register (the “Controller”), operator of the FinSignal service (finsignal.cz).

Contact for personal data matters: info@finsignal.cz.

The Controller processes your personal data solely on one of the following legal bases:

• Performance of a contract (Art. 6(1)(b) GDPR) — to provide the Server’s services, the Premium subscription and user-configured alerts, to process payments and to send tax documents.
• Compliance with legal obligations (Art. 6(1)(c) GDPR) — to keep accounts and archive tax documents for the period required by law.
• Legitimate interest (Art. 6(1)(f) GDPR) — to secure the service, prevent abuse, measure basic traffic without advertising cookies, protect and defend legal claims, send necessary service messages and, where permitted by law, information about our own similar services. You can object to processing based on legitimate interest; commercial communications can always be easily declined.
• Consent (Art. 6(1)(a) GDPR) — only where we separately ask for it in advance, for example for marketing communication that cannot rely on another legal basis. Consent can be withdrawn at any time.

The Controller informs the data subject under Article 13 GDPR before processing begins and allows the full exercise of rights under the GDPR.

For registration and the Free account we process the e-mail address, the account identifier, technical session data and, where applicable, the name or profile picture provided by the chosen sign-in provider. This data is necessary for authentication, security and service-related communication.

For the Premium subscription Stripe processes payment and billing data (for example name, address, payment method and transaction details). The Controller does not store the full card number or security code, but obtains and may view in Stripe the data needed to manage the customer, the subscription, invoicing, complaints and accounting obligations.

For the operation of the Server we keep information about your activity that the application needs: the asset watchlist, AI chat history (including vector embeddings of messages for RAG search), price alerts, e-mail alert settings, usage records and security or operational logs. AI chat conversations are kept for at most 12 months after their last message; you can permanently delete any conversation in the chat history at any time.

For e-mail alerts and the digest we use your e-mail address according to the Account settings. The weekly digest and general watchlist alerts are off after registration; you can switch each of them on and off in the Account section. E-mails link to the e-mail settings. Transactional, security and other necessary service messages related to the Account or subscription cannot be switched off while they are needed to provide the service.

Retention. We process account data for as long as the account exists. After the account is deleted we remove or anonymise the data from active systems without undue delay, usually within 30 days. Data may persist for a limited time in technical backups and security logs and is then removed according to retention cycles. We keep accounting, billing and legal records according to the type of document and the approved retention policy; some of them may be subject to a longer statutory or audit period. There is no single retention period for all records. Data needed for legal claims is kept for the relevant limitation periods.

For referral abuse prevention we store only HMAC fingerprints, not raw payment data, IP addresses or devices. The technical default limit for the payment fingerprint is at most 540 days from last use; short-term IP/device/phone risk evidence is kept for at most 90 days and click-review evidence for at most 180 days. These limits govern use for fraud checks, not the automatic deletion of accounting, payout or legal records, which may be subject to a longer statutory or audit period.

When you visit the Server we use technical cookies necessary for the service to work and for authentication. We use no cookies for ad targeting or profiling. A detailed overview is on the Cookies page.

If you open a referral link, we show a separate dialog asking for consent to referral tracking. Only after consent do we store an HttpOnly cookie with a signed referral code and the original click time (for at most 90 days). Before consent we write no referral click or IP/UA hash to the database; after consent we use only HMAC fingerprints for abuse prevention and audit. You can decline consent without any impact on the website.

We use the following providers to run the Server. Depending on the service, they act as processors on our instructions or as independent controllers to the extent set by their own terms (typically for regulated payment activities).

• Supabase (Supabase Inc.) · EU (Frankfurt) — database, authentication, storage of user data
• Vercel Inc. · USA / global infrastructure — application hosting, edge proxy, operational cookieless web analytics
• Stripe Payments Europe, Ltd. · Ireland / EU — payment processing, invoicing, subscription management
• OpenAI · EU / USA — generative AI (chat, vector embeddings for RAG search)
• Google LLC (Google Sign-In) · EU / USA — identity verification for optional Google sign-in
• INTERNET CZ, a.s. (Forpsi) · EU / USA — sending transactional e-mails and the digest
• Stability AI, Ltd. · United Kingdom — generating cover images for social media

Data from public market sources (Marketaux, Finnhub, Yahoo Finance, GDELT, Alpha Vantage, CoinGecko, the Czech National Bank) is processed on the Server without any link to a specific User — it is therefore not personal data within the meaning of the GDPR.

The Controller does not sell personal data or pass it to third parties for their own targeted advertising. Data may also be disclosed to professional advisers or public authorities where necessary to comply with a legal obligation or to protect legal claims.

Some providers or their subcontractors may process data outside the European Economic Area. In that case the Controller relies on an appropriate legal mechanism, in particular an adequacy decision, certification under the EU-U.S. Data Privacy Framework or the European Commission’s standard contractual clauses, with supplementary safeguards where needed.

The Controller protects personal data with standard technical and organisational measures: encrypted connections, access-rights management, password hashing, Row-Level Security for access to database records, separation of privileged accounts, logging and regular security updates. Only people and providers who need personal data for the stated purposes have access to it.

The Controller cannot, however, guarantee absolute security of data transmission over the internet or complete resistance to cyber attacks. In the event of an incident threatening personal data, the Controller will proceed under Art. 33 GDPR (notification of the supervisory authority within 72 hours) and, where the risk is high, will also inform the affected data subjects.

Under the GDPR you have the following rights in relation to your personal data. You can exercise all of them by e-mail at info@finsignal.cz. The Controller will respond without undue delay, usually within one month; in complex cases the period may be extended in line with the GDPR.

• Right of access — to know what personal data we process about you and why, and to obtain a copy.
• Right to rectification — to request correction of inaccurate or completion of incomplete data. You can correct basic details yourself in the Account section.
• Right to erasure (“right to be forgotten”) — to request deletion of data. Some data (tax documents) must be kept by law even after the account is deleted.
• Right to restriction of processing — for example if you contest the accuracy of the data.
• Right to data portability — to receive, under the conditions of the GDPR, the data you provided in a structured, commonly used and machine-readable format.
• Right to object — to processing based on legitimate interest.
• Right to withdraw consent — for processing based on consent (newsletter, any other optional marketing communication). Withdrawal does not affect the lawfulness of processing before it.
• Right to lodge a complaint with the Czech Office for Personal Data Protection (uoou.cz) or the supervisory authority of your country of residence if you believe the processing of your data breaches the GDPR. We would nevertheless ask you to contact the Controller first — we will be glad to resolve any problem directly.

You can delete your account at any time in the Account section. When the account is deleted:

• we automatically cancel your Premium subscription in Stripe;
• we remove or anonymise the account data from active systems without undue delay, usually within 30 days;
• data may persist in limited technical backups until the retention cycle expires, and we keep records we must retain by law or to protect legal claims.

This Privacy policy takes effect on the date of publication. The Controller reserves the right to change it at any time; material changes will be announced to data subjects by e-mail at least 14 days in advance.

If you have questions or wish to exercise your rights, contact us at info@finsignal.cz.