Privacy Policy

1. Responsibility and contact

EdgeVeris is a research and backtesting platform for algorithmic trading strategies. Radek Zalubil, the operator of EdgeVeris, determines the purposes and means of the processing described in this notice and acts as the data controller.

For privacy questions and requests, contact support@edgeveris.com. Our website is edgeveris.com. This is our privacy contact, not a statement that a statutory Data Protection Officer has been appointed.

2. Scope and sources

This notice covers website visitors, account holders, subscribers and people contacting EdgeVeris. It describes personal data associated with the website, sign-in, billing, research workspaces and support. Information comes from you, use of the service, Google when you choose Google sign-in, and Stripe when you use payment or subscription services.

Strategy code, parameter sets and simulated trades may constitute personal data when linked to an identifiable user. Anonymous market prices and aggregated market statistics are not necessarily personal data. This notice does not transfer ownership of your code or authorise public distribution of private reports.

3. Information we process

Account and research workspace

Account information includes your name, email address, username where applicable, account identifier, creation time and appearance preferences. Where password sign-in is available, we store a salted password hash rather than a readable password.

Your workspace can include uploaded strategy code and data, code versions, inputs, selected instruments and periods, calculation settings, trade records, reports, portfolios and notes. Saved items include identifiers, versions and timestamps needed to retrieve and reproduce your work. Hosted workspaces are processed on our infrastructure, not solely on your computer.

Google sign-in

When you choose Google sign-in, we receive your Google identity identifier, issuer, verified email, name and authentication claims. We do not receive your Google password. This integration requests basic identity, email and profile access, not access to Gmail or Google Drive. The authentication framework also uses the cookies described below.

Payments

Stripe receives the account name and email, an internal account reference, selected plan and checkout references. Our billing records contain Stripe customer, payment and subscription identifiers, amounts, currency, status, billing dates, cancellations, refunds, disputes and invoice links. Payment-card details are entered on Stripe-hosted pages. Our billing ledger does not store full card numbers or CVCs.

Support and technical information

Support information includes your name, email, message, subject, ticket reference and information you choose to send. Do not send passwords, full payment-card details, API secrets or unnecessary personal information.

Technical records can include session identifiers or hashes, sign-in and activity timestamps, authentication expiry, recovery-token hashes, failed-attempt counters, delivery status and diagnostic errors. Network infrastructure processes connection data, including IP addresses, to handle requests. Diagnostic records are restricted to operation, security and troubleshooting. Payment payloads and authentication secrets are not intended as log content.

4. Purposes and legal bases

• Providing the requested service. Creating and securing your account, saving your work, carrying out requested analyses, processing purchases and managing paid access rely on performance of a contract or requested pre-contractual steps under Article 6(1)(b) GDPR.
• Required records. Applicable accounting, tax and other legally required records, and responses to binding lawful requests, rely on Article 6(1)(c) where that obligation applies.
• Support. We rely on the contract for service-related requests. Otherwise, our legitimate interest in answering relevant enquiries is the basis under Article 6(1)(f).
• Security and reliability. Proportionate abuse prevention, diagnosis, fraud prevention and protection of users rely on our legitimate interests under Article 6(1)(f).
• Legal claims. Necessary evidence for establishing, exercising or defending claims is processed under Article 6(1)(f), limited to the relevant claim.

For a business customer's contact person who is not personally a party to the contract, necessary relationship administration relies on our legitimate interest. We weigh legitimate interests against your rights and use proportionate safeguards. Optional processing that requires consent is not authorised merely by reading or accepting this notice.

5. Recipients and service providers

• Hetzner provides application hosting and server storage in Germany. Hosting can contain account, workspace and billing records, and server recovery copies.
• Cloudflare R2 stores market data and, when backups are enabled, encrypted recovery copies in a separate private EU-jurisdiction backup bucket. Backup decryption credentials are kept separately from the backup server.
• Stripe provides payment processing, subscriptions, the customer portal and related payment security. Stripe acts as a processor for some activities and as an independent controller for its own regulated, fraud-prevention and other disclosed purposes.
• Google provides optional Google sign-in and Google Workspace email for correspondence. Google operates its own account services under its privacy notice. Sign-in requests only the limited identity access described above.
• Authorised personnel and advisers receive only the information necessary for administration, support, accounting, security or legal advice, with appropriate confidentiality and access restrictions.
• Authorities and a lawful business successor may receive information required by law or needed for a legally justified claim. A business transfer must preserve applicable privacy protections and include notice where required.

Ordinary sign-in and payment calls do not send your strategy source code or reports to Google or Stripe. We do not sell personal data or use private strategy content to train AI models. If you choose to copy content into an external AI or other service, that is a separate disclosure governed by that service's terms and privacy notice.

Provider information: Hetzner, Cloudflare, Stripe and Google.

6. International processing

Google, Stripe and other infrastructure providers may process information internationally, including in the United States. A German application host and an EU backup location do not mean that every provider processes all information only in the European Economic Area.

Transfers for which we are responsible require an applicable adequacy decision or appropriate safeguards, such as the European Commission's Standard Contractual Clauses and supplementary measures where necessary. A recipient's eligibility must cover the actual transfer. You may contact us for information about applicable safeguards, subject to lawful redaction.

7. Cookies and browser storage

EdgeVeris uses authentication and security cookies and browser storage for requested workspace functions. The application does not currently integrate advertising pixels or audience-analytics tracking, and Streamlit usage telemetry is disabled. Non-essential tracking that requires consent must not be introduced without the required prior choice.

• Authentication cookies. The framework uses _streamlit_user for signed Google user information and _streamlit_user_tokens for authentication-token information in an HttpOnly cookie. Framework persistence can be up to 30 days, with token validity potentially shorter. These are cleared by framework logout.
• Security cookies. _streamlit_session supports session and OAuth state, with the framework's default lifetime of up to 14 days. _streamlit_xsrf protects against cross-site request forgery and is a browser-session cookie.
• Tab storage. edgeveris.entry.v1 and workspace session storage preserve selected offers, return navigation, form state and in-tab drafts. Entry payloads are accepted for up to 24 hours. Tab storage otherwise lasts for the tab session, subject to browser restoration.
• Layout preferences. Account-scoped local storage preserves window positions, sizes and layout preferences until it is replaced or cleared. It has no separate automatic expiry.

A persistent Google cookie does not grant unlimited application access. EdgeVeris separately checks its own session and your entitlement. Application sessions have an eight-hour maximum and a one-hour idle limit.

You can clear site data in your browser. Blocking required storage can prevent sign-in or state saving. Clearing browser storage can remove unsaved drafts and preferences but does not delete server-side accounts, reports or billing records. Sign out on shared devices. Google and Stripe use their own storage on their hosted pages under their own notices.

8. Retention

We retain information for the purpose for which it is needed. Where there is no single fixed duration, the following criteria determine the period.

• Accounts and saved research are kept for the active account relationship and requested storage. After a verified closure or erasure request, only records needed for a separate lawful purpose may be retained.
• Payment and accounting evidence is retained for applicable accounting, tax, refund, dispute and claim obligations, measured from the legally relevant event. This does not justify keeping all strategy code or notes.
• Support correspondence is kept to resolve the issue and for any necessary related complaint, claim or legal obligation.
• Technical and security records are retained as needed for diagnosis, abuse prevention or an active investigation, with necessity reviewed. A justified legal hold applies only to relevant evidence.
• Authentication is subject to the validity limits above. Password-reset links expire after 30 minutes. Expiry limits access but does not itself promise immediate physical deletion of every record.
• Recovery copies can temporarily outlive deletion from the active service. Encrypted production backups are retained for up to 90 days and are then scheduled for deletion. Restored data must remain subject to earlier verified erasure requests and applicable retention restrictions. Provider server snapshots follow a separate limited recovery rotation.

If a legal requirement prevents erasure, we retain only the necessary information and explain the reason where required. Contact us for the applicable period or criteria for a specific record.

9. Deletion and subscription cancellation

Removing a report or code entry from a list can archive it rather than erase every historical copy. Saved calculations and versions may remain. To request personal-data erasure across relevant systems, email support@edgeveris.com.

Stopping subscription renewal, closing a window or clearing browser storage is not equivalent to closing an account or requesting erasure. Cancellation does not remove records that must lawfully be retained.

10. Your rights

Subject to the GDPR's conditions, you may request access to your personal data and a copy, correction, erasure, or restriction of processing. You may request portability of data you provided where processing is automated and based on contract or consent.

You may object, on grounds relating to your situation, to processing based on legitimate interests. We must stop unless an applicable exception permits continuation, such as compelling overriding grounds or legal claims. You may object to direct marketing at any time. If processing relies on consent, you may withdraw it without affecting earlier lawful processing.

Send requests to support@edgeveris.com. We may request proportionate identity verification to protect your data and the data of others. Do not send an identity document unless genuinely necessary and a secure method has been agreed.

We respond without undue delay and normally within one month. Complex or multiple requests may require up to two additional months, with reasons communicated within the first month. Requests are generally free. Any permitted fee or refusal must satisfy the applicable legal conditions and be explained together with complaint and judicial-remedy options.

11. Complaints

You may complain to the Czech Office for Personal Data Protection, Úřad pro ochranu osobních údajů, or another competent supervisory authority, particularly where you live, work or consider an infringement to have occurred. You do not have to contact us first.

12. Required information and automated processing

We need enough account information to authenticate you and provide your requested workspace. Payment information is required for a purchase and legally required billing records. Without the relevant information, we may be unable to provide that function. Optional notes and information unnecessary for an analysis remain your choice.

Backtests and simulations analyse the market data and strategy rules you select. They are not credit scores or decisions about employment, insurance or lending. Paid access is checked automatically against payment and subscription status. Security controls can reject suspicious or expired sessions. Contact support for human review of an incorrect restriction. Stripe and your payment provider may separately assess payment risk under their own notices.

13. Other people's information

Avoid uploading personal data about others unless necessary and you are authorised to do so. EdgeVeris is not intended for sensitive personal records. Where a business wants us to process personal data on its behalf, the parties must first define the processing and establish any required Article 28 agreement. This notice is not a substitute for that agreement.

14. Security, children and changes

Safeguards include account access checks, password and token hashing where applicable, account-specific workspaces, restricted infrastructure access and HTTPS transport. User strategy execution is separated from payment credentials and administrative infrastructure. No system is absolutely secure. Where a breach requires notification, we notify the relevant authority and affected people as required by law.

EdgeVeris is intended for adults and is not directed to children. If you believe a child has provided personal data, contact us so that we can assess the situation without collecting unnecessary proof of age.

We keep this notice aligned with the service and show its updated date. Material changes will be brought to your attention as appropriate. Updating a notice does not supply consent or a lawful basis that is otherwise missing.