Privacy Policy
Last updated 27 October 2026
This policy explains what personal data Lumivar Trading collects, why, who we share it with and your rights under the GDPR. We keep it simple: we collect what we need to run your journal, and we never sell your data.
1. Who is responsible for your data
Lumivar Trading is operated by its owner in Ireland. You can contact us at lumivartrading@gmail.com.
We are the "controller" of your personal data. For anything privacy-related, including exercising your rights, email lumivartrading@gmail.com.
2. What we collect
| Data | Examples | Why |
|---|---|---|
| Account | Email address, password (stored only as a secure hash by our login provider), sign-in times | To create your account and let you sign in |
| Profile | Username, display name, bio, profile picture | To show who you are in the community |
| Journal | Trades, notes, screenshots, portfolio, checklist, journal settings, watchlist and ticker choices, imported broker files (only the resulting trades are stored, not the file) | To provide the journal, statistics and analytics you use |
| Community | Posts, comments, likes, follows, leaderboard stats you opt into | To run the community features |
| Plan and billing | Your plan, subscription status, payment provider customer ID, invoices. Card details are handled by Stripe and never reach us. | To take payment, keep tax records and give you paid features |
| Course progress | Modules you've completed | To track your progress in Education |
| Technical | IP address, browser and device type, error logs kept by our hosting providers | To keep the service secure and working |
| Usage | Anonymous page-view counts (Vercel Web Analytics, no cookies, no cross-site tracking) | To see which pages are used and improve them |
| Messages | Emails you send us | To answer you |
We don't knowingly collect special-category data (such as health or political views). Please don't put it in your journal or posts.
3. Our legal bases
- Contract: to provide your account, journal, plan and the features you use.
- Legitimate interests: to keep Lumivar secure, prevent abuse, fix problems and understand usage in an aggregated, privacy-friendly way.
- Legal obligation: to keep billing and tax records.
- Consent: for anything optional we ask about, such as marketing emails. You can withdraw consent at any time. We don't send marketing emails today.
4. Who we share data with
We use trusted providers ("processors") who handle data only on our instructions:
- Supabase: database, sign-in and file storage (your journal, screenshots and account).
- Vercel: website hosting, server functions and cookie-free analytics.
- Stripe: payment processing and invoices, once paid plans are live.
- Google: only if you choose "Sign in with Google", and for our support email inbox.
- Finnhub: supplies market news. Our server requests headlines; none of your personal data is sent.
We never sell or rent your data, and we don't use it for advertising. We may disclose data if the law requires it, or to protect our members and service from fraud or abuse.
5. International transfers
Some providers are based in, or use, servers outside the European Economic Area (for example in the United States). Where that happens, we rely on safeguards the GDPR recognises, such as the EU–US Data Privacy Framework or the European Commission's Standard Contractual Clauses.
6. How long we keep it
- Account, profile and journal data: while your account is open. When you delete your account, it's deleted straight away from our live systems and drops out of backups within 30 days.
- Community posts and comments: until you delete them or your account.
- Billing and tax records: 6 years, as Irish tax law requires.
- Technical logs: kept briefly by our hosting providers (usually days to weeks).
7. Your rights
Under the GDPR you can ask us to:
- access the data we hold about you, and get a copy;
- correct anything inaccurate (most of it you can edit yourself);
- delete your data (Settings → Account → Delete account does this instantly);
- export your journal in a portable format (Settings → Import & export);
- restrict or object to certain uses, and withdraw consent where we rely on it.
Email lumivartrading@gmail.com and we'll reply within one month. If you're unhappy with how we handle your data, you can complain to the Data Protection Commission in Ireland (dataprotection.ie) or the authority in your own country.
8. Cookies and local storage
Lumivar doesn't use advertising or tracking cookies, so there's no cookie banner. Your browser's local storage keeps you signed in and remembers settings like your theme, filters and which page you were on. These are strictly necessary for the app or set by your own choices. Our analytics are cookie-free. Fonts are hosted on our own site, so loading a page doesn't send your details to font providers.
9. Security
Data is encrypted in transit, and each member's journal is protected by database rules so only they can read it. Screenshots are stored privately. No system is perfectly secure, so use a strong, unique password. If we ever have a breach that puts you at risk, we'll tell you and the regulator as the law requires.
10. Children
Lumivar is for adults aged 18 and over. We don't knowingly collect data from children. If you think a child has an account, tell us and we'll delete it.
11. Changes
We'll update this policy as Lumivar changes and show the date at the top. If a change matters, we'll tell you by email or in the app.
Questions about this page? Email lumivartrading@gmail.com.