Privacy Policy

1. Data Controller

Stefan Hertweck
FlowTrader AI
Ooser Waldstraße 5
76532 Baden-Baden, Deutschland
E-Mail: info@flowtraderai.de
Phone: +49 157 35705939

2. Principles of Data Processing

Personal data is only collected when necessary for providing a functional website and our content and services.

The processing of personal data only occurs with the user's consent or when a legal basis exists pursuant to Art. 6 GDPR.

3. Hosting (Vercel)

This website is hosted by Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA. Data may be transferred to the US in the process; Vercel is certified under the EU-U.S. Data Privacy Framework.

When visiting the website, the following data is automatically collected in server log files and stored only for as long as is necessary for operating and securing the website:

• IP address
• Date and time of access
• Accessed files and pages
• Browser and operating system
• Referrer URL (previously visited page)

Legal basis: Legitimate interest pursuant to Art. 6(1)(f) GDPR.

4. Fonts

This website uses fonts that are served locally from our own server. No connection is made to Google servers, and IP addresses are not transmitted to Google.

5. Newsletter (Brevo)

We use Brevo (formerly Sendinblue) for sending newsletters. The following data is collected upon registration:

• Email address (required)
• First name (optional)
• Time of registration
• IP address

Registration uses a double opt-in process. Your data is not shared with third parties. You can unsubscribe at any time via the link in every email or by emailing info@flowtraderai.de.

Besides our own content, the newsletter occasionally mentions offers from selected partners. These mentions are marked as advertising. No personal data is passed on to the partners.

6. Blindspot Analysis

On flowtraderai.de/blindspot-analyse you can take a free self-assessment of typical behavioral patterns in trading. We evaluate your answers to the 15 situations in order to show you a preview right away; we do not store anything in the process.

If you request the full report, we process your first name, your email address, your answers and your result (patterns and scores) in order to send you the report. The legal basis is your request (Art. 6(1)(b) GDPR). We first send you a confirmation email and send the report as a PDF only after you click the link in that email. We send both emails as transactional emails via Brevo (Sendinblue SAS, 7 rue de Madrid, 75008 Paris, France) as processor; in doing so we do not create a contact for you at Brevo and do not add you to any list. The link contains your details, your answers and, where present, the origin of your visit (the link parameters utm_source, utm_medium and utm_campaign) in encrypted form, so that we can create the report after your confirmation; it is valid for seven days. We do not keep a database of our own for these details. Providing these details is voluntary; without your first name and email address we cannot send you the report. Brevo deletes the sending log of both emails (address, subject, time) after 12 months.

After your confirmation, the AI of Anthropic (Anthropic, PBC, 548 Market Street, PMB 90375, San Francisco, CA 94104, USA) creates the report. For this we transmit your answers and scores, not your name and not your email address. Anthropic may not use the content to train its models. Data is transferred to the USA in the process; the EU Standard Contractual Clauses apply to this transfer. We send you the finished report, which is marked as created with AI, as a PDF by email via Brevo. According to Anthropic, inputs and outputs are deleted within 30 days unless longer storage is necessary to enforce its usage policies or required by law.

Only if you tick the voluntary box in the form for occasional emails about FlowTrader AI and trading psychology do we create a contact at Brevo after your confirmation and add you to a list. We then store your first name, your email address, your result (patterns and scores), the time and the origin of your visit (for example “instagram/dm/analyse”). The legal basis is your consent (Art. 6(1)(a) GDPR). Without the tick we do not create a contact and do not store any of these details at Brevo; you still receive the report.

You can withdraw your consent at any time, by email to info@flowtraderai.de or via the unsubscribe link in our emails. The contact stays stored at Brevo until you withdraw.

7. Instagram: Comments and Direct Messages

If you comment on one of our Instagram posts with a certain keyword (for example “ANALYSE”), we automatically send you a direct message with the requested link. For this we use the tool Inro of Edgar SAS (20 rue des Maraîchers, 60700 Pontpoint, France) as processor. We process your Instagram name and user ID, your comment, the message history with us and the time.

Inro names the following sub-processors: Heroku (Salesforce, Inc.) for hosting, databases and caching, Amazon Web Services (S3) for file storage and OpenAI for AI features. We do not use Inro's AI features. For transfers to countries without an adequacy decision, for example to the USA, Inro states that it relies on the EU Standard Contractual Clauses and the EU-US Data Privacy Framework.

The direct message contains only the link to the Blindspot Analysis; we do not ask for an email address in the Instagram chat. The message is marked as sent automatically. We send further messages on Instagram only if you reply or tap a button.

The legal basis for replying to your comment is your request (Art. 6(1)(b) GDPR). Inro deletes the data at the latest 24 months after the last contact. Meta Platforms Ireland Limited is responsible for the processing by Instagram itself; its privacy notices apply to that.

8. Contact Form / Email

When you contact us via the contact form or email, your information is stored to process the inquiry. Data is deleted once the inquiry has been fully processed, unless legal retention obligations apply. Our email inbox runs on Google Workspace (Google Cloud EMEA Limited, 70 Sir John Rogerson's Quay, Dublin 2, Ireland). Google provides a data processing agreement for this (Cloud Data Processing Addendum); it bases transfers to countries outside the EU on a recognised data protection framework or on Standard Contractual Clauses.

Cancellation form

With the form “Cancel subscription here” you can cancel your contracts without logging in (Section 312k German Civil Code, BGB). For this we process your name, your email address, the details you enter in the form (type of cancellation, requested date, optionally a reason and a contract or customer number), the time of receipt, a check value of your IP address (see below) and the browser identifier (name and version of your browser). With the email address we look up your account and your subscriptions with us and at Stripe, carry out the cancellation and send you the confirmation by email (via Brevo). A copy of your notice goes to our mailbox info@flowtraderai.de (section 8). We keep the record of receipt, content, confirmation and execution, where assigned also with the identifiers of the subscription and the account, until three years after the end of the year in which the cancellation was received, even if you delete your account earlier. Legal bases: Art. 6(1)(b) and (c) GDPR and our legitimate interest in being able to prove the cancellation (Art. 6(1)(f) GDPR).

To protect the form against misuse, we count submissions per IP address and per email address. For this we store only check values from which the addresses cannot be recovered, together with the time. We delete the counters after 24 hours; the check value of the IP address remains part of the record for as long as the record is kept (Art. 6(1)(f) GDPR).

After submitting, you can voluntarily tell us why you are cancelling, by selecting reasons and in a free comment. We use this information only to improve FlowTrader AI. It has no effect on your cancellation. We store it in the record of your cancellation and keep it for as long as the record, note it on your subscription at Stripe and send it to our mailbox info@flowtraderai.de. The legal basis is our legitimate interest in improving our offer (Art. 6(1)(f) GDPR).

Withdrawal form

With the form “Withdraw from contract here” you can withdraw from a contract concluded online without logging in (Section 356a German Civil Code, BGB). For this we process your name, your email address, your details about the contract (type of contract, optionally order date or order number), the time of receipt, a check value of your IP address and the browser identifier. With the email address we look up your account and your contracts with us and at Stripe, process the withdrawal and send you the acknowledgement of receipt by email. We keep the record of receipt, content and acknowledgement until three years after the end of the year in which the withdrawal was received, even if you delete your account earlier. To protect against misuse we count receipts per IP address and per email address only as check values from which the addresses cannot be recalculated; we delete the counters after 24 hours. Legal bases: Art. 6(1)(b) and (c) GDPR and our legitimate interest in being able to prove the withdrawal and in protecting the form (Art. 6(1)(f) GDPR).

9. Cookies

This website uses technically necessary cookies (e.g. to store the cookie consent itself), for which no consent is required (Art. 6 (1) lit. f GDPR in conjunction with § 25 (2) No. 2 TDDDG). With your explicit consent (Art. 6 (1) lit. a GDPR, § 25 (1) TDDDG) we additionally use the following services: (a) Google Analytics 4 (Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland) with anonymised IP for reach measurement and (b) Google Ads including conversion tracking and remarketing for measuring and optimising our advertising. Data is transferred to the USA; Google LLC is certified under the EU-US Data Privacy Framework (Adequacy Decision of the EU Commission of 10 July 2023). Also only with marketing consent, we load Tolt (Tolt, Inc., 2093 Philadelphia Pike #2726, Claymont, DE 19703, USA) for our partner programme: Tolt recognises which partner link brought you to the website so that the referral can be credited to the partner. In doing so, data is transferred to Tolt in the USA. The Tolt cookie expires after 30 days. You can withdraw your consent at any time via the “Cookie Settings” link in the footer. Our own cookies and the Google Analytics cookies expire after 12 months at the most. Cookies that Google Ads and Microsoft set on their own domains may be stored for up to 13 months; Google Ads conversion cookies expire after 90 days.

Google Analytics 4 records which pages you view and how long you stay on them, how far you scroll, which links you click, whether you use forms (starting and submitting, not what you enter) and play videos, and how you came to the website (for example via a search engine, Instagram or a partner link). Measurement works across domains, covering flowtraderai.de and the app at flowtraderai.com, so that a visit that starts on the website and continues in the app is recognised as one connected path. Data on individual visits and devices is deleted automatically after 14 months; aggregated reports without any link to individual people are kept. The Google Analytics cookies (_ga and _ga_…) expire no later than 12 months after your first visit; further visits do not extend this period.

Also only with your consent to “Statistics”, we use Microsoft Clarity (Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland). Clarity shows us how the website is used: clicks, mouse movements, scroll depth and session recordings, i.e. the course of individual visits. This helps us see where a page is unclear or does not work. Anything entered in form fields is masked and not transmitted to Microsoft; in addition, we fully mask areas containing forms and personal details. The legal basis is your consent (Art. 6 (1) lit. a GDPR, § 25 (1) TDDDG), which you can withdraw at any time via the “Cookie Settings” link in the footer. Data may be transferred to the USA; Microsoft Corporation is certified under the EU-US Data Privacy Framework. In addition, Microsoft bases the transfer on the European Commission's Standard Contractual Clauses. We do not pass on any consent for advertising purposes to Microsoft. Irrespective of this, Microsoft also processes the data from Clarity under its own responsibility, among other things to improve its services and for advertising. Details can be found in the Microsoft Privacy Statement (https://www.microsoft.com/privacy/privacystatement). Clarity stores a pseudonymous identifier in the cookies _clck (up to 12 months) and _clsk (1 day) to assign page views to a visit and recognise returning visits. Clarity may also set cookies on Microsoft domains (CLID, MUID, MR, ANONCHK and SM). Microsoft uses them to recognise a browser across different websites using Clarity and on Microsoft's own sites; according to Microsoft, MUID is also used for advertising. Depending on the type, these cookies are stored for up to about 13 months. According to Microsoft, recordings are kept for 30 days; recordings marked as favourites, a random selection of further recordings and heatmaps are kept for up to 9 months.

In addition, the website stores in its own cookie (ft_first, 90 days) how you first arrived at the site (for example a search engine, Instagram or a partner link) and which page you landed on. This information is only used further if you create a trial account for the app; it is then linked to your customer account so we know which of our channels bring customers. No data is transmitted to third parties. The cookie is only set if you consent to the Statistics category in the cookie notice. The legal basis is your consent (Art. 6(1)(a) GDPR, Section 25(1) TDDDG). You can withdraw it at any time; the cookie is then deleted. If you arrive via a partner link (address with ?ref= or ?via=) or open a partner page on this website, the website stores the partner code in another cookie of its own (ft_partner_30, 30 days). When you switch to the app, it is passed on to the sign-up so that the partner link's benefit applies and the referral can be credited to the partner. If you close the notice about this benefit, a cookie (ft_partner_30_x, 30 days) stores that choice. The legal basis is our legitimate interest in granting the benefit offered via the partner link and in crediting the referral (Art. 6(1)(f) GDPR).

10. FlowTrader AI App

A separate privacy policy applies to the FlowTrader AI app at flowtraderai.com (available at https://flowtraderai.com/privacy). The app uses the following services as data processors pursuant to Art. 28 GDPR; for payment processing, Stripe is an independent controller:

• Firebase (Google Ireland Ltd.) Authentication, database, and data storage. Data transfers to the US may occur; Google LLC is certified under the EU-US Data Privacy Framework. Legal basis: Art. 6(1)(b) GDPR (performance of contract).
• Anthropic (Anthropic, PBC, 548 Market Street, PMB 90375, San Francisco, CA 94104, USA): AI-powered analysis of trade data and journal entries and the AI coach. Anthropic may not use the content to train its models. Data is transferred to the USA in the process; the EU Standard Contractual Clauses apply to this transfer. Legal basis: Art. 6(1)(b) GDPR. For the AI coach's voice output, the text of the respective coach reply is transmitted to Google Gemini (Google); processing in the USA is possible; details are in the app's privacy policy.
• Stripe Payments Europe, Ltd. Payment processing (credit card, SEPA). Stripe processes payment data as an independent controller. You enter your card number in an input field provided by Stripe that is embedded in the app's checkout page; it goes directly to Stripe, we do not see or store it. Through a Stripe extension, the status of your subscription, your invoices (with billing name, email address, billing address and amounts) and your payment transactions are transferred to the app's database at Firebase; after a failed card payment, this may also include the card brand, the last four digits and the expiry date of the card. We delete this information in the app's database together with your account. Legal basis: Art. 6(1)(b) GDPR. Details: https://stripe.com/privacy.
• Brevo (Sendinblue SAS, 7 rue de Madrid, 75008 Paris, France): emails about your account and contract (e.g. welcome mail, password reset, trial confirmation, reminder before the first charge) and, only with your confirmed consent, marketing emails. Legal basis: Art. 6 (1) lit. b GDPR (performance of contract) or Art. 6 (1) lit. a GDPR (consent).
• Web push notifications (VAPID protocol, RFC 8030): if you explicitly opt in to in-app notifications, we store your push subscription (endpoint, public key, auth secret) to remind you of coaching tasks, trade reviews or journey letters. Delivery is via the respective browser vendor (Mozilla, Google, Apple, Microsoft). Legal basis: Art. 6 (1) lit. a GDPR. You can withdraw consent at any time in your browser settings or the app's notification settings.
• Vercel Inc. (440 N Barranca Avenue #4133, Covina, CA 91723, USA): operation of the app at flowtraderai.com. Data may be transferred to the US in the process; Vercel is certified under the EU-U.S. Data Privacy Framework.

Trading data is not shared with third parties beyond the processors listed above. You have the right to access, rectification, erasure, and portability at any time: write to info@flowtraderai.de.

Cross-domain tracking between flowtraderai.de and flowtraderai.com: when you click an app link, the GA4 client ID is passed via a Google Ads linker parameter (query parameter “_gl”) so that the conversion path between the marketing site and the app is not broken. No personal data is passed, only pseudonymous tracking IDs. The mechanism is only active if you have given consent to analytics.

Coach-client data flow: when, as a trader, you connect a trading coach in the app, you explicitly grant that coach access rights per data category (trades, journal, mood, commitments etc.). You can revoke these permissions at any time. FlowTrader AI remains the sole processor within the meaning of Art. 28 GDPR vis-à-vis the client; no separate processing agreement between coach and client exists. Upon termination of the coach-client relationship, the coach's access rights expire automatically.

Marketing emails and push notifications on behalf of your coach: if you are a trader connected to a coach and that coach has activated the marketing service, FlowTrader AI sends pre-built standard messages to you on the coach's behalf (e.g. reminders about the end of a coaching package, welcome message, re-engagement message after the end of the coaching relationship). The sender is “[coach name] via FlowTrader AI”; the technical reply-to address is the coach's email: your replies go exclusively to the coach. FlowTrader AI is content-responsible for the standard templates (see GTC § 16 (9)); the coach merely commissions the dispatch. Legal basis: Art. 6 (1) lit. b GDPR (performance of the coaching agreement you concluded with the coach) and, for push notifications, Art. 6 (1) lit. a GDPR (your consent to browser notifications, revocable at any time). You can stop receiving these messages at any time via the unsubscribe link in every email or via your app notification settings, without affecting your coaching agreement.

Orders in the app: For every order on the app's checkout page we keep a record: the time of the order, the plan chosen, the price, the number of trial days, the times at which you accepted the terms and expressly requested that we begin the service before the withdrawal period ends, the version of the terms, the language, the label of the order button and the identifiers of the order, the subscription or the payment at Stripe. The record proves that the order was concluded properly and shows the status of your right of withdrawal (Art. 6(1)(b) and (f) GDPR). If you start a trial with a card, we also store the fingerprint of your card generated by Stripe (an identifier, not the card number), together with the accounts that started a trial with this card, the time of the last trial and the identifier of that subscription. This lets us detect repeated free trials with the same card. We delete this entry two years after the last trial with this card (Art. 6(1)(f) GDPR).

Marketing emails from the app (consent with confirmation)

When you sign up in the app, or later in the settings, you can use a separate box or switch to agree to receive emails from FlowTrader AI with trading tips, app news and offers, including up to two reminders if you don’t start your trial (no earlier than 24 and 72 hours after sign-up). Your consent only applies once you open the link in our confirmation email and confirm there (double opt-in, link valid for seven days), and only for that address.

We store your email address, the time you ticked the box and the time you confirmed, the version of the consent text, where you gave consent, your language, an ID of the request and the ID of the confirmation email, to be able to prove your consent (Art. 7 (1) GDPR). The legal basis is your consent (Art. 6 (1) lit. a GDPR). You can withdraw it at any time in the app settings, via the unsubscribe link in every email or by writing to info@flowtraderai.de; unsubscribing via a Brevo link also counts as withdrawal. Withdrawal only covers our own marketing emails; emails from a coach have their own unsubscribe link. If you had previously unsubscribed from our marketing emails, your confirmation lifts that for our own marketing emails (including the block at Brevo); we store when and in reference to which request. If you had unsubscribed before 29 October 2026, you also remain unsubscribed from emails from a coach.

To prevent misuse, we send at most three confirmation emails per account in 24 hours and at most five to the same address in 30 days; for this we keep only the times and the address as a non-reversible check value for 30 days, also beyond the deletion of an account (Art. 6 (1) lit. f GDPR). If you delete your account, we delete your consent with it; we keep a record without your name (times, text version, where consent was given, language, ID of the confirmation email, address only as a check value) for three full calendar years after the year of deletion, so that we can prove the consent if needed (Art. 17 (3) lit. e and Art. 6 (1) lit. f GDPR).

Research and development with pseudonymised trade data

We study how mood, rule adherence and trading behaviour are related, and we use the findings to further develop the analyses in the app. This work is part of our research and development project, for which we are applying for the German research allowance under the Research Allowance Act (Forschungszulagengesetz). For this purpose, our server creates a research dataset once a day from the trades you have entered in the app yourself. For each trade it contains only the following information:

• a pseudonymous identifier instead of your name, your email address and your user ID
• the trading day and, if entered, the time of the trade
• the mood you selected, as a category
• your rule adherence (1 to 10), as you assess it yourself or as the app calculates it in quick entry from your information on plan, stop and mood, and whether you respected your stop
• the planned and the actually achieved risk-reward ratio
• the position size, only as a deviation from your usual position size and not as an absolute value
• whether the trade counts as a rule break under a defined rule (derived from rule adherence and stop)
• the length in characters of your notes before, during and after the trade, not their content

The dataset does not contain your name, email address, user ID, account details, the traded instrument, profit or loss, or the wording of your notes. Imported trades, for example from a CSV file, and trades without information on rule adherence or the stop are not included.

Our server calculates the pseudonymous identifier from your user ID using a secret key (HMAC-SHA256). The key is not stored in the database. Without it, the identifier cannot be linked to your account. Because we hold the key, we treat the dataset as personal data. We do not merge it with your account and do not use it for decisions that affect you personally.

The dataset is stored in our database at Firebase (see above), as one version per day. It cannot be accessed in the app; only the controller has access. We do not pass it on to third parties. We publish or use results only in aggregated form that does not allow conclusions about individual users, for example to document the project to the certification body for the research allowance (Bescheinigungsstelle Forschungszulage) and to the tax office.

We keep only the daily versions of the last seven days; we delete older ones automatically. If you delete your account, your trades are no longer included in new daily versions, and they disappear from the existing ones after eight days at the latest.

The legal basis is our legitimate interest in researching and further developing our service (Art. 6(1)(f) GDPR). You can object to this processing at any time on grounds relating to your particular situation (Art. 21(1) GDPR), for example by email to info@flowtraderai.de.

After your account is deleted

If you delete your account in the app, we delete your login account and the data stored in the app for your account. This also includes your messages and requests to coaches, your messages in coach groups and in session chats, your notes on booked sessions, your posts and reactions in the community, the bug reports you sent us, your own referral code and the files you uploaded or that your coach created for your trades. We also delete a contact at our email service provider Brevo; a newsletter subscription with the same address therefore ends as well. If you have objected to our advertising or unsubscribed from our emails, we do not delete the contact at Brevo but keep it with your email address, marked as blocked; we remove your name and the other attributes we stored there, and we take the address off all mailing lists. This way, your objection also applies if you later register again with the same address. The legal basis for this is our legitimate interest in respecting your objection permanently (Art. 6(1)(f) GDPR).

If you unsubscribed from a coach's emails or objected to the use of your trades for research (section “Research and development with pseudonymised trade data”), we create a check value for this upon deletion for every email address stored for your account, including at Stripe. It is generated in the same way as the check value under item 1. Only the check value, the time it was created and, for an unsubscription from a coach, the coach's identifier are stored, not your address, your name or your user ID. If you later register again with the same address, your objection therefore continues to apply. We record an objection to our advertising in the same way until your address has been marked as blocked at Brevo. We do not delete these check values after a fixed period, because an objection should not end by itself. The legal basis is our legitimate interest in respecting your objection permanently (Art. 6(1)(f) GDPR).

Some information is kept for a limited time:

1. A check value of your email address. Our server generates it from the address using a secret key. Only the check value and the time it was created are stored, not your address, your name or your user ID. The address cannot be calculated back from the check value; with the key, however, it is possible to check whether a given address matches it. If someone later registers with the same address, we therefore do not start another free trial period. We delete the check value automatically three years after it was created. The legal basis is our legitimate interest in preventing the free trial period from being used more than once (Art. 6(1)(f) GDPR).
2. If, at the time of deletion, you had a connection to a coach, including one that was paused or archived by the coach, or if the connection was ended in the month of deletion or in the month before, we keep what is needed for the outstanding settlement of the coach's commission on your payments: the coach's identifier, your former user ID, the time of deletion, the times at which the connection was created, confirmed and, where applicable, ended, earlier connection periods with the same coach and, if available, your customer numbers at our payment service provider Stripe. Your name, your email address and your trading data are not included. We use the customer numbers to ask Stripe which payments you made in the month being settled. We delete this information automatically at the beginning of the second calendar month after the month of your deletion. The additional month is a buffer for a delayed or repeated settlement (example: deletion in September, settlement at the beginning of October, deletion of this information at the beginning of November). The legal basis is our legitimate interest in a correct settlement with the coach (Art. 6(1)(f) GDPR).
3. If you came to us through another user's referral link, we remove your email address from the referral record when your account is deleted. We delete the rest of the record, with your former user ID, the referral code used, the status and the times of the referral, 30 days after your account is deleted; until then we need it to settle or reverse a referral bonus correctly. The legal basis is our legitimate interest in a correct settlement of the referral programme (Art. 6(1)(f) GDPR). For the user who referred you, we then keep only a record of their credit with the amount, the day and whether it was reversed, without your name, your email address or your user ID; it is used to settle their referral credit and remains until the referring user deletes their own account.
4. If you bought something from us, your customer account at Stripe with your invoices and payments remains; we remove payment methods stored there when your account is deleted. If you requested a payout of your referral credit, this request is also kept, with your former user ID, name, email address, amount and the payout method you chose (IBAN or PayPal address). We keep these records for as long as commercial and tax retention obligations apply. The legal basis is compliance with these obligations (Art. 6(1)(c) GDPR).
5. If you ordered in the app, we keep the order record (section 10) without your name, your email address, your postal address and your user ID. We delete it three years after the end of the year in which your subscription ends; a running subscription and a lifetime licence end when your account is deleted. The legal basis is our legitimate interest in being able to prove and defend legal claims arising from the order (Art. 6(1)(f) GDPR in conjunction with Art. 17(3)(e) GDPR).
6. If you cancelled via the cancellation form, the record of your cancellation is kept until three years after the end of the year in which the cancellation was received (see section “Cancellation form”). The legal basis is our legitimate interest in being able to prove the cancellation (Art. 6(1)(f) GDPR).
7. If you started a trial with a card, the entry for your card's fingerprint (section 10) remains; we replace your user ID in it with a placeholder. This lets us recognise when a free trial is started again with the same card. We delete the entry two years after the last trial with this card. The legal basis is our legitimate interest in preventing repeated use of the free trial (Art. 6(1)(f) GDPR).

Shortly after the deletion, information from your account may still appear in two automatically created daily versions: in our internal analysis of app usage until the next nightly run, and in the pseudonymised research dataset (section “Research and development with pseudonymised trade data”) for at most eight days, because we only keep the daily versions of the last seven days there.

11. Your Rights (GDPR)

You have the following rights regarding your personal data:

• Right of access (Art. 15 GDPR)
• Right to rectification (Art. 16 GDPR)
• Right to erasure (Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to object (Art. 21 GDPR)
• Right to withdraw consent (Art. 7(3) GDPR)
• Right to lodge a complaint with a supervisory authority (Art. 77 GDPR)

12. Social media and partner links

We maintain presences on Instagram, Facebook, YouTube and TikTok. No platform tracking pixels are embedded on flowtraderai.de. Data is only transmitted to the platform operators when you click on the respective profile links.

YouTube comments: We read comments under our YouTube videos via the YouTube interface (Google Ireland Limited) in order to reply to them. For the draft replies we use the AI Claude by Anthropic (Anthropic, PBC, 548 Market Street, PMB 90375, San Francisco, CA 94104, USA). For this we transmit the public comment, your public channel name, earlier posts in the same thread and the title of the video; data is transferred to the USA in the process. Anthropic processes this data in accordance with its own privacy notices. We review and approve every reply before it is published. We store comments and drafts for no longer than 12 months. The legal basis is our legitimate interest in replying to comments (Art. 6(1)(f) GDPR). You can object to this at any time, for example by email to info@flowtraderai.de; we will then no longer reply to your comments with the help of AI.

On our website, in the app and in the newsletter we link to offers from partners, partly through affiliate or referral links. Visiting our pages does not transfer any data to the partners, the logos are hosted on our own servers. Only when you click a partner link are you taken to the partner's website. The partner may then process data of its own and use a cookie to recognise that you came from us. The partner's own privacy policy applies to this.

13. Data Security

This website uses SSL/TLS encryption (identifiable by https:// in the address bar). This means all data is transmitted encrypted between your browser and our server.

14. Currency

This privacy policy is currently valid. Changes will be published on this page.