Privacy Policy

1. Data Controller

Stefan Hertweck
FlowTrader AI
Ooser Waldstrasse 5
76532 Baden-Baden, Deutschland
E-Mail: info@flowtraderai.de
Phone: +49 157 35705939

2. Principles of Data Processing

Personal data is only collected when necessary for providing a functional website and our content and services.

The processing of personal data only occurs with the user's consent or when a legal basis exists pursuant to Art. 6 GDPR.

3. Hosting (Vercel)

This website is hosted by Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA. Data may be transferred to the US in the process; Vercel is certified under the EU-U.S. Data Privacy Framework.

When visiting the website, the following data is automatically collected in server log files and stored only for as long as is necessary for operating and securing the website:

• IP address
• Date and time of access
• Accessed files and pages
• Browser and operating system
• Referrer URL (previously visited page)

Legal basis: Legitimate interest pursuant to Art. 6(1)(f) GDPR.

4. Fonts

This website uses fonts that are served locally from our own server. No connection is made to Google servers, and IP addresses are not transmitted to Google.

5. Newsletter (Brevo)

We use Brevo (formerly Sendinblue) for sending newsletters. The following data is collected upon registration:

• Email address (required)
• First name (optional)
• Time of registration
• IP address

Registration uses a double opt-in process. Your data is not shared with third parties. You can unsubscribe at any time via the link in every email or by emailing info@flowtraderai.de.

Besides our own content, the newsletter occasionally mentions offers from selected partners. These mentions are marked as advertising. No personal data is passed on to the partners.

6. Contact Form / Email

When you contact us via the contact form or email, your information is stored to process the inquiry. Data is deleted once the inquiry has been fully processed, unless legal retention obligations apply. Our email inbox runs on Google Workspace (Google Cloud EMEA Limited, 70 Sir John Rogerson's Quay, Dublin 2, Ireland). Google provides a data processing agreement for this (Cloud Data Processing Addendum); it bases transfers to countries outside the EU on a recognised data protection framework or on Standard Contractual Clauses.

7. Cookies

This website uses technically necessary cookies (e.g. to store the cookie consent itself), for which no consent is required (Art. 6 (1) lit. f GDPR in conjunction with § 25 (2) No. 2 TDDDG). With your explicit consent (Art. 6 (1) lit. a GDPR, § 25 (1) TDDDG) we additionally use the following services: (a) Google Analytics 4 (Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland) with anonymised IP for reach measurement and (b) Google Ads including conversion tracking and remarketing for measuring and optimising our advertising. Data is transferred to the USA; Google LLC is certified under the EU-US Data Privacy Framework (Adequacy Decision of the EU Commission of 10 July 2023). Also only with marketing consent, we load Tolt (Tolt, Inc., 2093 Philadelphia Pike #2726, Claymont, DE 19703, USA) for our partner programme: Tolt recognises which partner link brought you to the website so that the referral can be credited to the partner. In doing so, data is transferred to Tolt in the USA. You can withdraw your consent at any time via the “Cookie settings” link in the footer. Maximum cookie lifetime is 12 months; Google Ads conversion cookies expire after 90 days.

In addition, the website stores in its own cookie (ft_first, 90 days) how you first arrived at the site (for example a search engine, Instagram or a partner link) and which page you landed on. This information is only used further if you create a trial account for the app; it is then linked to your customer account so we know which of our channels bring customers. No data is transmitted to third parties. The legal basis is our legitimate interest in evaluating our own marketing channels (Art. 6(1)(f) GDPR). If you arrive via a partner link (address with ?ref= or ?via=) or open a partner page on this website, the website stores the partner code in another cookie of its own (ft_partner_30, 30 days). When you switch to the app, it is passed on to the sign-up so that the partner link's benefit applies and the referral can be credited to the partner. If you close the notice about this benefit, a cookie (ft_partner_30_x, 30 days) stores that choice. The legal basis is our legitimate interest in granting the benefit offered via the partner link and in crediting the referral (Art. 6(1)(f) GDPR).

8. FlowTrader AI App

A separate privacy policy applies to the FlowTrader AI app at flowtraderai.com (available at https://flowtraderai.com/privacy). The app uses the following services as data processors pursuant to Art. 28 GDPR; for payment processing, Stripe is an independent controller:

• Firebase (Google Ireland Ltd.) Authentication, database, and data storage. Data transfers to the US may occur; Google LLC is certified under the EU-US Data Privacy Framework. Legal basis: Art. 6(1)(b) GDPR (performance of contract).
• Anthropic (Anthropic, PBC, 548 Market Street, PMB 90375, San Francisco, CA 94104, USA): AI-powered analysis of trade data and journal entries and the AI coach. Anthropic may not use the content to train its models. Data is transferred to the USA in the process; the EU Standard Contractual Clauses apply to this transfer. Legal basis: Art. 6(1)(b) GDPR. For the AI coach's voice output, the app uses Google Gemini (Google Ireland Ltd.).
• Stripe Payments Europe, Ltd. Payment processing (credit card, SEPA). Stripe processes payment data as an independent controller. You enter your card number only on Stripe's pages; we do not see or store it. Through a Stripe extension, the status of your subscription, your invoices (with billing name, email address, billing address and amounts) and your payment transactions are transferred to the app's database at Firebase; after a failed card payment, this may also include the card brand, the last four digits and the expiry date of the card. We delete this information in the app's database together with your account. Legal basis: Art. 6(1)(b) GDPR. Details: https://stripe.com/privacy.
• Brevo (Sendinblue SAS, 7 rue de Madrid, 75008 Paris, France): transactional emails (welcome mail, password reset, renewal reminders) and optional newsletter. Legal basis: Art. 6 (1) lit. b GDPR (performance of contract) or Art. 6 (1) lit. a GDPR (consent for newsletter).
• Web push notifications (VAPID protocol, RFC 8030): if you explicitly opt in to in-app notifications, we store your push subscription (endpoint, public key, auth secret) to remind you of coaching tasks, trade reviews or journey letters. Delivery is via the respective browser vendor (Mozilla, Google, Apple, Microsoft). Legal basis: Art. 6 (1) lit. a GDPR. You can withdraw consent at any time in your browser settings or the app's notification settings.
• Vercel Inc. (440 N Barranca Avenue #4133, Covina, CA 91723, USA): operation of the app at flowtraderai.com. Data may be transferred to the US in the process; Vercel is certified under the EU-U.S. Data Privacy Framework.

Trading data is not shared with third parties beyond the processors listed above. You have the right to access, rectification, erasure, and portability at any time: write to info@flowtraderai.de.

Cross-domain tracking between flowtraderai.de and flowtraderai.com: when you click an app link, the GA4 client ID is passed via a Google Ads linker parameter (query parameter “_gl”) so that the conversion path between the marketing site and the app is not broken. No personal data is passed, only pseudonymous tracking IDs. The mechanism is only active if you have given consent to analytics.

Coach-client data flow: when, as a trader, you connect a trading coach in the app, you explicitly grant that coach access rights per data category (trades, journal, mood, commitments etc.). You can revoke these permissions at any time. FlowTrader AI remains the sole processor within the meaning of Art. 28 GDPR vis-à-vis the client; no separate processing agreement between coach and client exists. Upon termination of the coach-client relationship, the coach's access rights expire automatically.

Marketing emails and push notifications on behalf of your coach: if you are a trader connected to a coach and that coach has activated the marketing service, FlowTrader AI sends pre-built standard messages to you on the coach's behalf (e.g. reminders about the end of a coaching package, welcome message, re-engagement message after the end of the coaching relationship). The sender is “[coach name] via FlowTrader AI”; the technical reply-to address is the coach's email: your replies go exclusively to the coach. FlowTrader AI is content-responsible for the standard templates (see GTC § 16 (9)); the coach merely commissions the dispatch. Legal basis: Art. 6 (1) lit. b GDPR (performance of the coaching agreement you concluded with the coach) and, for push notifications, Art. 6 (1) lit. a GDPR (your consent to browser notifications, revocable at any time). You can stop receiving these messages at any time via the unsubscribe link in every email or via your app notification settings, without affecting your coaching agreement.

Research and development with pseudonymised trade data

We study how mood, rule adherence and trading behaviour are related, and we use the findings to further develop the analyses in the app. This work is part of our research and development project, for which we are applying for the German research allowance under the Research Allowance Act (Forschungszulagengesetz). For this purpose, our server creates a research dataset once a day from the trades you have entered in the app yourself. For each trade it contains only the following information:

• a pseudonymous identifier instead of your name, your email address and your user ID
• the trading day and, if entered, the time of the trade
• the mood you selected, as a category
• your rule adherence (1 to 10), as you assess it yourself or as the app calculates it in quick entry from your information on plan, stop and mood, and whether you respected your stop
• the planned and the actually achieved risk-reward ratio
• the position size, only as a deviation from your usual position size and not as an absolute value
• whether the trade counts as a rule break under a defined rule (derived from rule adherence and stop)
• the length in characters of your notes before, during and after the trade, not their content

The dataset does not contain your name, email address, user ID, account details, the traded instrument, profit or loss, or the wording of your notes. Imported trades, for example from a CSV file, and trades without information on rule adherence or the stop are not included.

Our server calculates the pseudonymous identifier from your user ID using a secret key (HMAC-SHA256). The key is not stored in the database. Without it, the identifier cannot be linked to your account. Because we hold the key, we treat the dataset as personal data. We do not merge it with your account and do not use it for decisions that affect you personally.

The dataset is stored in our database at Firebase (see above), as one version per day. It cannot be accessed in the app; only the controller has access. We do not pass it on to third parties. We publish or use results only in aggregated form that does not allow conclusions about individual users, for example to document the project to the certification body for the research allowance (Bescheinigungsstelle Forschungszulage) and to the tax office.

We keep only the daily versions of the last seven days; we delete older ones automatically. If you delete your account, your trades are no longer included in new daily versions, and they disappear from the existing ones after eight days at the latest.

The legal basis is our legitimate interest in researching and further developing our service (Art. 6(1)(f) GDPR). You can object to this processing at any time on grounds relating to your particular situation (Art. 21(1) GDPR), for example by email to info@flowtraderai.de.

After your account is deleted

If you delete your account in the app, we delete your login account and the data stored in the app for your account. This also includes your messages and requests to coaches, your messages in coach groups and in session chats, your notes on booked sessions, your posts and reactions in the community, the bug reports you sent us, your own referral code and the files you uploaded or that your coach created for your trades. We also delete a contact at our email service provider Brevo; a newsletter subscription with the same address therefore ends as well. If you have objected to our advertising or unsubscribed from our emails, we do not delete the contact at Brevo but keep it with your email address, marked as blocked; we remove your name and the other attributes we stored there, and we take the address off all mailing lists. This way, your objection also applies if you later register again with the same address. The legal basis for this is our legitimate interest in respecting your objection permanently (Art. 6(1)(f) GDPR).

If you unsubscribed from a coach's emails or objected to the use of your trades for research (section “Research and development with pseudonymised trade data”), we create a check value for this upon deletion for every email address stored for your account, including at Stripe. It is generated in the same way as the check value under item 1. Only the check value, the time it was created and, for an unsubscription from a coach, the coach's identifier are stored, not your address, your name or your user ID. If you later register again with the same address, your objection therefore continues to apply. We record an objection to our advertising in the same way until your address has been marked as blocked at Brevo. We do not delete these check values after a fixed period, because an objection should not end by itself. The legal basis is our legitimate interest in respecting your objection permanently (Art. 6(1)(f) GDPR).

Some information is kept for a limited time:

1. A check value of your email address. Our server generates it from the address using a secret key. Only the check value and the time it was created are stored, not your address, your name or your user ID. The address cannot be calculated back from the check value; with the key, however, it is possible to check whether a given address matches it. If someone later registers with the same address, we therefore do not start another free trial period. We delete the check value automatically three years after it was created. The legal basis is our legitimate interest in preventing the free trial period from being used more than once (Art. 6(1)(f) GDPR).
2. If, at the time of deletion, you had a connection to a coach, including one that was paused or archived by the coach, or if the connection was ended in the month of deletion or in the month before, we keep what is needed for the outstanding settlement of the coach's commission on your payments: the coach's identifier, your former user ID, the time of deletion, the times at which the connection was created, confirmed and, where applicable, ended, earlier connection periods with the same coach and, if available, your customer numbers at our payment service provider Stripe. Your name, your email address and your trading data are not included. We use the customer numbers to ask Stripe which payments you made in the month being settled. We delete this information automatically at the beginning of the second calendar month after the month of your deletion. The additional month is a buffer for a delayed or repeated settlement (example: deletion in September, settlement at the beginning of October, deletion of this information at the beginning of November). The legal basis is our legitimate interest in a correct settlement with the coach (Art. 6(1)(f) GDPR).
3. If you came to us through another user's referral link, we remove your email address from the referral record when your account is deleted. We delete the rest of the record, with your former user ID, the referral code used, the status and the times of the referral, 30 days after your account is deleted; until then we need it to settle or reverse a referral bonus correctly. The legal basis is our legitimate interest in a correct settlement of the referral programme (Art. 6(1)(f) GDPR). For the user who referred you, we then keep only a record of their credit with the amount, the day and whether it was reversed, without your name, your email address or your user ID; it is used to settle their referral credit and remains until the referring user deletes their own account.
4. If you bought something from us, your customer account at Stripe with your invoices and payments remains; we remove payment methods stored there when your account is deleted. If you requested a payout of your referral credit, this request is also kept, with your former user ID, name, email address, amount and the payout method you chose (IBAN or PayPal address). We keep these records for as long as commercial and tax retention obligations apply. The legal basis is compliance with these obligations (Art. 6(1)(c) GDPR).

Shortly after the deletion, information from your account may still appear in two automatically created daily versions: in our internal analysis of app usage until the next nightly run, and in the pseudonymised research dataset (section “Research and development with pseudonymised trade data”) for at most eight days, because we only keep the daily versions of the last seven days there.

9. Your Rights (GDPR)

You have the following rights regarding your personal data:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object (Art. 21 GDPR)
• Right to withdraw consent (Art. 7(3) GDPR)
• Right to lodge a complaint with a supervisory authority (Art. 77 GDPR)

10. Social media and partner links

We maintain presences on Instagram, Facebook, YouTube and TikTok. No platform tracking pixels are embedded on flowtraderai.de. Data is only transmitted to the platform operators when you click on the respective profile links.

On our website, in the app and in the newsletter we link to offers from partners, partly through affiliate or referral links. Visiting our pages does not transfer any data to the partners, the logos are hosted on our own servers. Only when you click a partner link are you taken to the partner's website. The partner may then process data of its own and use a cookie to recognise that you came from us. The partner's own privacy policy applies to this.

11. Data Security

This website uses SSL/TLS encryption (identifiable by https:// in the address bar). This means all data is transmitted encrypted between your browser and our server.

12. Currency

This privacy policy is currently valid. Changes will be published on this page.