1. Data Controller
Kristian Kovac, Am Grimnitzsee 3, 16247 Althüttendorf, Germany
Email: info@ngutrading.com
2. What Data We Collect
We collect and process the following personal data:
- Account data: Email address, display name, password (hashed)
- Trading data: Journal entries, trade logs, P&L records, account information, screenshots
- Usage data: Interface preferences, navigation history, XP/level progression
- Authentication data: Session tokens, Google account ID (if linked)
3. Legal Basis for Processing
- Contract performance (Art. 6(1)(b) GDPR): Processing your trading data to provide the journaling service
- Consent (Art. 6(1)(a) GDPR): Optional features like weekly email digests, public profiles
- Legitimate interest (Art. 6(1)(f) GDPR): Security measures, fraud prevention, service improvement
4. Third-Party Services
- Vercel: Application hosting and content delivery — processes technical request data (IP address, user agent) to serve the app
- MongoDB Atlas: Database hosting — data may be stored on servers in the EU/US
- Stripe: Payment processing for subscriptions and one-time purchases — processes your email and payment details. We never see or store your full card number. See Stripe’s Privacy Policy
- AI providers (Google Gemini, OpenAI): Optional AI features (journal review, screenshot grading, coaching) send the relevant journal text, trade data, or chart screenshots to an AI provider for processing. Requests go to Google’s Gemini API first and fall back to OpenAI if it is unavailable, so either provider may process a given request. AI features only process your data when you actively use them. Content is not used to train the providers’ models under our API terms
- Resend: Transactional emails (password reset, verification) — processes email addresses
- Google OAuth: Optional authentication — only email and name are accessed if you choose Google login
- Google Analytics: Usage analytics (only with your consent) — collects anonymized page views, session data, and device type. Processed by Google LLC. See Google’s Privacy Policy
- Vercel Web Analytics: Aggregate page-view measurement, processed by Vercel Inc. It sets no cookie and stores no identifier on your device, so it runs without a consent banner; it records the page visited, referrer, country and device type, and cannot follow you between sites or sessions
- Push notification services: If you turn on push notifications, your browser issues a subscription address which we store and send messages to. That address belongs to your browser’s push service — Google (Chrome/Android), Apple (Safari) or Mozilla (Firefox) — and identifies your device to them. Turning notifications off deletes it
- Speech recognition (journal dictation): Dictating a journal entry uses your browser’s own speech service — Chrome sends the audio to Google, Safari to Apple. We have no control over that and never receive the audio ourselves, only the text it returns. Typing instead avoids it entirely
We do not sell data to third parties. Google Analytics is only loaded after you accept analytics cookies via the cookie banner; Vercel Web Analytics is cookieless and runs regardless, as described above.
4a. Transfers Outside the EU/EEA
Several of the processors above are established in the United States (Vercel, Stripe, OpenAI, Google, Resend) or may store data on US servers (MongoDB Atlas). Where personal data reaches them outside the EU/EEA, the transfer is based on the European Commission’s Standard Contractual Clauses under Art. 46(2)(c) GDPR, and additionally on the EU–US Data Privacy Framework for those providers certified under it (Art. 45 GDPR). You may request a copy of the relevant safeguards at the contact address above.
5. Cookies
By default we use only essential cookies required for authentication and storing your preferences (theme, interface mode). Google Analytics cookies are set only if you accept them via the cookie banner — you can decline and the Service works fully. No advertising cookies are used. See our Cookie Policy for details.
6. Data Retention
- Account and trading data: retained as long as your account is active
- Authentication tokens: automatically deleted after 15 minutes (or upon use)
- Rate limiting records: automatically deleted once their window has passed
- Product event log (which screens were opened, for diagnosing faults and usage): automatically deleted after 180 days
- Server performance and health records: automatically deleted after 14 and 7 days respectively
- Upon account deletion: all personal data is removed immediately, in the same request — every collection is swept, not a fixed list. Routine encrypted database backups may still contain it for up to 30 days before they expire
7. Your Rights (GDPR Articles 15–22)
You have the right to:
- Access your personal data (Art. 15)
- Rectify inaccurate data (Art. 16)
- Delete your account and all data (Art. 17) — available in Settings
- Export your data in a machine-readable format (Art. 20) — available in Settings
- Restrict processing (Art. 18)
- Object to processing (Art. 21)
- Withdraw consent at any time (Art. 7(3))
To exercise any of these rights, contact us at info@ngutrading.com or use the self-service options in your Settings page.
8. Data Security
We implement appropriate technical and organizational measures to protect your data, including encrypted connections (HTTPS), hashed passwords (bcrypt), hashed authentication tokens (SHA-256), and rate-limited API endpoints.
9. Right to Lodge a Complaint
You have the right to lodge a complaint with a supervisory authority, in particular in the EU member state of your habitual residence, place of work, or place of the alleged infringement. The competent authority in Germany is the data protection authority of the state of Brandenburg (LDA Brandenburg).
10. No Financial Advice
NGU Edge is a journaling and performance tracking tool. Nothing on this platform constitutes financial, investment, or trading advice. All trading decisions are your sole responsibility. See our full disclaimer.