PLACEHOLDER-DO-NOT-PUBLISH. This page is a drafting brief, not a privacy policy, and nothing on it is in force. It cannot be finished until the legal entity exists: a privacy policy has to name the data controller, its registered address and a contact point, and RECAPITAL has none of those yet. The text below lists what the document has to cover so the reviewed version can be dropped straight in.
Data controller
To be completed once the company is formed. Needs the registered legal name, the registered address, the VAT or company number, and a contact route for privacy requests.
What we collect
To be drafted. Has to cover, at minimum: account details given at sign-up (name, email, phone number and country); trading data, whether typed in, imported from a file or synced from a broker; OAuth tokens for connected broker accounts; chart screenshots attached to trades; and usage data.
Legal basis for processing
To be drafted, per category of data.
How broker tokens are stored
To be drafted. This is the part a reader will care about most and the part the payment provider will read closely: it has to describe how the tokens are encrypted, who can reach them and what they are used for.
Sub-processors
To be drafted. Needs the current list — the database and storage provider, the payment provider, the email provider and analytics — with what each one receives.
International transfers
To be drafted.
How long we keep it
To be drafted. Has to state the retention periods and be explicit that data is retained after a subscription is cancelled and after an account is locked out, and for how long.
Your rights
To be drafted. Access, export, correction, deletion, objection, and how to exercise each.
Cookies
To be drafted, alongside the cookie consent mechanism, which does not exist yet.
Contact
To be completed with the entity.