Privacy Policy.
Which personal data Thetavio processes, for what purpose, for how long, and what rights you have.
1.Controller
The controller responsible for data processing on this website and in the application is:
No data protection officer has been appointed, as there is no legal obligation to do so. For questions about data protection, you can reach us at the email address given above.
2.Overview
We process personal data only to the extent necessary to provide the website and the application, to perform our contracts, to keep operations secure, or on the basis of your consent. We do not sell data, do not use advertising trackers and do not use your trading data for any purpose other than providing the application.
The legal bases are in particular Art. 6(1)(a) GDPR (consent), (b) (contract and pre-contractual measures), (c) (legal obligation) and (f) (legitimate interests). Access to information on your device is additionally governed by § 25 of the German Telecommunications Digital Services Data Protection Act (TDDDG).
3.Hosting and delivery
Own server in Germany
We operate the application and its database (MariaDB) on our own hardware in Germany. We do not use an external hosting provider for this.
Cloudflare
All requests to the website pass through the network of Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Cloudflare accepts the encrypted connection from your browser, protects against attacks and forwards the request to our server through an encrypted tunnel. In doing so, Cloudflare processes in particular your IP address, date and time, the requested address, technical information about your browser and device, and the transmitted content.
The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in secure, fast and available delivery. We have concluded a data processing agreement with Cloudflare. Cloudflare is certified under the EU-US Data Privacy Framework. In addition, the Standard Contractual Clauses of the EU Commission apply.
4.Access logs and abuse protection
For requests to the application, we log the following for error analysis, performance measurement and security: time, method and path of the request, status code, response time, your user and profile ID where applicable, browser identifier (user agent), referrer and an irreversible hash of your IP address. We delete these entries after 30 days. After that, only anonymous daily statistics without any personal reference remain.
To protect against abuse, we store your IP address together with a counter when you log in, register, reset your password, start the demo, and when you use the forms for withdrawal and cancellation. We delete these entries after one day at the latest.
Error messages of the application are stored in server logs and deleted after 30 days at the latest.
The legal basis is Art. 6(1)(f) GDPR. Our legitimate interest lies in secure and error-free operation.
5.Registration and user account
You need an account to use the application. For this we process:
- email address (mandatory, used as login),
- password, stored exclusively as a bcrypt hash,
- name (optional),
- plan, subscription status and the identifiers of your customer and subscription records at Stripe,
- times of registration, changes and password changes.
As proof of your acceptance of the Terms and Conditions and the Risk Disclosure, we store the version of the texts, the time, the declarations made and the name entered as your signature.
We maintain your session by means of a cookie (see the section on cookies). To reset your password, we generate a one-time link that expires after one hour.
The legal basis is Art. 6(1)(b) GDPR, and for the records of acceptance additionally (f) (proof and defence of legal claims). We store the data until you delete your account.
6.Your trading data
The core of the application is the data you enter or import: positions, strategies, campaigns, dividends, interest, fees, notes and the metrics and history calculated from them. This data is assigned to your profiles and is not visible to other users.
- File upload: When you upload a statement from your broker, we read the file in memory. We do not store the file itself. We keep the data read from it, such as account number, trades, fees and payments, as an import preview until you upload a new statement, discard the preview or delete the profile or your account.
- Import logs: We delete information about import runs after 30 days.
- Profile backups: We create a daily backup of each profile, which you can restore in the settings. We delete backups after seven days. The most recent backup is kept for as long as the profile exists.
- Demo profile: New accounts receive a demo profile with fictitious sample data.
You can export your data at any time and delete individual profiles or your entire account. When you delete your account, we remove all associated data from the database immediately. It remains in database backups until these are rotated (see Retention periods).
The legal basis is Art. 6(1)(b) GDPR.
7.Retrieval via the IBKR Flex Web Service
If you save a Flex Query, we store your Flex token and the query ID. We encrypt the token with AES-256-GCM. When retrieving data, our server sends the token and query ID to the Interactive Brokers group and receives the report, which we process like a file upload. Interactive Brokers receives the IP address of our server, not yours.
Interactive Brokers is your broker and processes your data under its own responsibility in accordance with its privacy policy. The legal basis for the retrieval is Art. 6(1)(b) GDPR. We delete the token and query when you remove the query or delete your account.
8.Payment with Stripe
We process Pro subscriptions via Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland. You enter your payment details, such as card number or bank details, directly in Stripe’s payment form. We do not receive them.
We transmit your email address and your user ID to Stripe. From Stripe, we receive and store the identifiers of your customer and subscription records, the subscription status, the end of the billing period and whether a cancellation has been scheduled. Invoices and payment transactions remain with Stripe.
Stripe processes data partly as our processor and partly under its own responsibility, for example for fraud prevention and to comply with legal obligations. In doing so, data may be transferred to Stripe, Inc. in the USA. Stripe is certified under the EU-US Data Privacy Framework; Standard Contractual Clauses apply in addition. Details: stripe.com/privacy.
The legal basis is Art. 6(1)(b) GDPR, and for the retention of invoices (c) in conjunction with § 147 AO and § 14b UStG.
9.Sending emails
We only send emails that are necessary for your account or your contract: links to confirm your email address and to reset your password, the contract confirmation with the contract documents as PDF, and acknowledgements of receipt for withdrawals and cancellations. We do not send newsletters or advertising.
We use Resend, Inc., USA, to send emails. Resend processes your email address, the content of the message and delivery data. We have concluded a data processing agreement with Resend. Resend is certified under the EU-US Data Privacy Framework. The legal basis is Art. 6(1)(b) GDPR.
Our mailboxes (such as support@ and info@) are operated by Google Ireland Limited, Ireland, using Google Workspace. When you write to us or reply to one of our emails, Google processes your email address and the content of the message on our behalf. A transfer to Google LLC in the USA is possible. We have concluded a data processing agreement with Google, and Google is certified under the EU-US Data Privacy Framework. The legal basis is Art. 6(1)(b) GDPR, for other enquiries (f) (answering your request).
10.Online withdrawal and cancellation
Using Withdraw from contract and Cancel contracts here, you can submit declarations without logging in. In doing so, we process your name, your email address, your details on the contract, and for a cancellation the type of cancellation, the requested date and, where applicable, the reason for cancellation, as well as the time of receipt. If the email address belongs to a customer account, we send you an acknowledgement of receipt, otherwise the confirmation page serves as proof. We then process the declaration.
The legal basis is Art. 6(1)(c) GDPR in conjunction with §§ 312k, 356a BGB, as well as (b). We keep the declarations for three years as proof, also beyond the deletion of your account.
12.Product analytics with PostHog
Only with your consent. Without consent in the cookie banner, no analytics take place.
To understand how the application is used, we use PostHog after you have given your consent, a service of PostHog, Inc., 2261 Market Street #4008, San Francisco, CA 94114, USA. The data is processed and stored in PostHog’s EU cloud in Frankfurt am Main.
- page views, clicked elements and technical information about browser and device, including the approximate region derived from your IP address,
- selected events such as registration or the start of the ordering process,
- for logged-in users, your user ID and email address, in order to analyse usage across sessions.
We do not transmit the content of your trades, such as positions, premiums or profits and losses, to PostHog.
The legal basis is your consent under Art. 6(1)(a) GDPR and § 25(1) TDDDG. You can withdraw it at any time with effect for the future via the “Cookie settings” link in the page footer. We have concluded a data processing agreement with PostHog. Insofar as data may reach the USA in the process, Standard Contractual Clauses safeguard the transfer. On request, we delete the analytics data assigned to your user ID; otherwise, as soon as it is no longer required for analysis.
13.External data sources without personal data
For exchange rates, stock prices, company names and logos, our server queries the following services. Only ticker symbols or currencies are transmitted, no personal data. Your browser loads logos and names via our own domain, so your IP address does not reach these services.
- European Central Bank, Frankfurt am Main (reference rates),
- Twelve Data Pte. Ltd., Singapore (stock prices),
- logo.dev (company logos),
- OpenFIGI, a service of Bloomberg (company names).
We serve fonts ourselves. No connection to Google or other font providers takes place.
14.Guest demo
Via “Try the live demo”, we create a temporary guest account with sample data without you providing any data. We delete the guest account and its data after one day.
15.Data security
- Connections between your browser and Cloudflare are encrypted with TLS; forwarding to our server takes place through an encrypted tunnel.
- We store passwords only as bcrypt hashes and Flex tokens encrypted with AES-256-GCM.
- Each profile is separated from the data of other users. Access is restricted and protected against abuse.
- We back up the database daily to a separate storage medium.
- Only the controller has access to the server and the database.
16.Recipients and transfers to third countries
Personal data is received only by the service providers named in this policy: Cloudflare, Stripe, Resend, Google and, with your consent, PostHog. An overview is available under Processors. We base transfers to the USA on the adequacy decision for the EU-US Data Privacy Framework (Art. 45 GDPR) and additionally on Standard Contractual Clauses (Art. 46(2)(c) GDPR).
Beyond this, we only disclose data where we are legally obliged to do so.
17.Retention periods
| Data | Retention period |
|---|---|
| Account, trading data, records of acceptance | until the account is deleted |
| Import preview of a profile | until the next upload, until discarded, or until the profile or account is deleted |
| Profile backups | 7 days, most recent backup until the profile is deleted |
| Database backups | rotating, overwritten after 90 days at the latest |
| Access logs and server logs | 30 days, then only anonymous statistics |
| IP addresses for abuse protection | 1 day at most |
| Password reset link | 1 hour |
| Demo guest accounts | 1 day |
| Withdrawal and cancellation declarations | 3 years |
| Invoices and accounting records | according to the statutory periods, usually 8 to 10 years |
18.Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You can withdraw any consent you have given at any time with effect for the future (Art. 7(3)).
You can exercise many of these rights directly in the application: export and deletion in the settings. Otherwise, a message to [email protected] is sufficient.
You also have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia), Kavalleriestraße 2-4, 40213 Düsseldorf, Germany.
No automated decision-making, including profiling within the meaning of Art. 22 GDPR, takes place. Providing your data is necessary for concluding and performing the contract. Without it, we cannot provide the application.
19.Changes
We adapt this privacy policy when the application or the legal situation changes. The version published here applies.