Privacy Policy

This Policy explains how Aitor Ilundain Real («we») processes your personal data when you use SuaVar, in accordance with Regulation (EU) 2016/679 (GDPR) and other applicable legislation.

1. Data controller

• Controller: Aitor Ilundain Real
• Address: Calle Undiano, 5, 31180 Zizur Mayor (Navarra)
• Tax identification: 73115657Z
• Privacy contact: privacidad@suavar.com

2. Data we process

• Account and authentication: email address and user identifier (handled with Supabase Auth; signing in with Google uses your identity provider).
• Preferences: the markets you select when you sign up and those you add later (asset categories, instruments you follow, favourite tools and language). They are used to filter and order what you see.
• Subscription and payment data: plan, status and period. Payments are processed by Stripe; we do not store your full card details.
• Documents you upload: chart screenshots, MetaTrader reports and logs, EA source code or candle CSV files. EA source code and candle CSV files are processed in memory to produce the result and are not retained; chart screenshots and the result derived from each analysis are stored in your history and you can delete them at any time.
• Input text and generated code: the text of the free-form field, the options selected in the guided questionnaire and the generated source code (.mq5 or Pine Script) are processed through the AI models. This content is stored persistently and linked to your user account for the sole purpose of enabling the history, versioning and strategy iteration/debugging features. You can delete this history at any time by deleting the strategy from your dashboard.
• Usage data: usage records for the AI tools (to apply plan limits and measure costs) and basic technical data.

We do not ask you about your experience, your investment objectives, your financial situation or your risk tolerance, and we do not process them: the Service carries out no suitability assessment. The preferences listed above only filter and order the content you see.

3. Purposes and legal bases

• Providing the Service and managing your account — performance of the contract (Art. 6(1)(b) GDPR).
• Processing payments and subscriptions — performance of the contract and legal obligation (accounting and tax).
• Security, abuse prevention and usage limits — legitimate interest (Art. 6(1)(f)).
• Analytics and improvements — legitimate interest (Art. 6(1)(f)). We use no third-party analytics tool: no external service receives your browsing on this site. If we ever added one, we would say so in this Policy before switching it on.
• Service communications — performance of the contract; commercial communications only with your consent.
• Optional service email notifications (weekly summary of your trading journal, macro release alerts) — consent (Art. 6(1)(a)): they are opt-in from your account and you can unsubscribe at any time from the email itself or from your preferences.
• Marketing communications (news, content, offers) — consent (Art. 6(1)(a)), handled with double opt-in (unticked box plus email confirmation) and kept separate from service email; you can withdraw it in one click at any time.

4. Processors and third parties

To provide the Service we rely on the following providers, which process personal data on our behalf under a processing agreement in accordance with Article 28 GDPR:

The AI model providers receive the content of your queries in order to generate the result and, if you have trades recorded in the journal, a statistical summary of your own trading behaviour (frequency, duration and outcome of your trades, without identifying you). They never receive your identity, your credentials or your account data.

We have contracted with both providers that the content of your queries is not used to train their models. Should that condition change, we would reflect it here.

Retention differs between them, so we state it separately for each: Groq does not store inputs or outputs, because we have enabled its zero data retention setting on our account; Anthropic deletes them automatically within a maximum of 30 days, unless there is a legal obligation to retain them or an open investigation into misuse of the service. None of this affects what we ourselves keep, which is set out in section 6.

Stripe also acts as an independent controller in respect of the data it processes for fraud prevention and for compliance with its own regulatory obligations, in accordance with its privacy policy.

In addition to the above, we may disclose data to our tax and accounting advisers, and to public authorities, judges and courts where there is a legal obligation to do so.

5. International data transfers

Some of the providers listed in the previous section are established outside the European Economic Area, or may access the data from outside it, even where the processing takes place on European servers.

These transfers rely, depending on the provider, on one of the following mechanisms:

• the European Commission’s adequacy decision on the EU-US Data Privacy Framework, where the provider is certified and active under that framework for the category of data concerned; or, failing that,
• the standard contractual clauses approved by the European Commission in Implementing Decision (EU) 2021/914, controller-to-processor module, together with a documented assessment of the conditions in the destination country.

As supplementary measures we minimise the data sent: the AI model providers receive the content of your query and, where applicable, a statistical summary of your trading behaviour, but never your identity or your account data, and that behavioural information is aggregated, never trade by trade. We also apply pseudonymisation where technically possible, encryption in transit and at rest, and zero-retention settings on the services that offer them.

You can request information about the mechanism applicable to each provider, and a copy of the safeguards adopted, by writing to privacidad@suavar.com.

6. Retention periods

We keep each category of data for strictly as long as the purpose that justifies it requires:

Inactive accounts. If you do not access your account for 24 months, we will notify you by email and, if you do not access it within the 30 days following that notice, we will delete it together with its content. This policy does not reach an account with a subscription in force,: while it remains in force we will neither warn you nor delete it for inactivity.

Limits on erasure. When you exercise your right to erasure we will delete your data, except for data we must keep to comply with a legal obligation or for the establishment, exercise or defence of legal claims, in accordance with Article 17(3) GDPR. In practice this means that billing data and the contract evidence log are kept for the periods stated in the table even if you delete your account, without remaining linked to your profile.

7. Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction and portability, and withdraw your consent where processing is based on it, in two ways:

• from your account area, where you can download a copy of your data as a structured, machine-readable file, delete your content and delete your account immediately;
• by writing to privacidad@suavar.com, without having to justify your request or use any particular form.

We will reply within one month of receiving your request, extendable by a further two months if the request is particularly complex, in which case we will tell you.

You may also lodge a complaint with the competent supervisory authority, which in Spain is the Agencia Española de Protección de Datos (AEPD).

8. Cookies

We only use cookies that are strictly necessary for operation and for your session (for example, to keep you signed in and to remember your chosen language). We install no cookies for analytics or advertising, and we use no external measurement service, so there is nothing to consent to on that front. If we were to add non-essential cookies in future, we would ask for your prior consent through a banner.

Embedded third-party content. The market screen can display a TradingView chart. That content loads from TradingView’s servers, which will receive your IP address and may set their own cookies. That is why it does not load on its own: you will see a notice, and the chart is only requested if you press to load it.

9. Minors

The Service is not directed at minors and we do not knowingly collect their data.

10. Changes to this policy

We may update this Policy; we will inform you of substantial changes by reasonable means.

See also the Legal Notice and the Terms of Service.