Privacy policy

Controller

The controller within the meaning of the General Data Protection Regulation is DecodeStocks UG (haftungsbeschränkt), Sommerstraße 11/1, 72227 Egenhausen, Germany, e-mail: contact@decodestocks.com.

No data protection officer has been appointed. There is currently no statutory obligation to appoint one.

What we process

When you open a page, our web server records technical operating details only — which route was matched, which service answered, status codes, sizes, timings and TLS parameters. Your IP address, the address you requested, your browser and the referring page are not stored.

We do process your IP address when you use specific functions — signing in, registering, resetting a password, freezing an account — and when a technical error occurs.

With an account we additionally process your e-mail address, your password in hashed form only, sign-in and session data, and the content you create — watchlists, portfolios and settings.

For a paid subscription we process contract, billing and receipt data. Full payment details such as card numbers never reach us.

If you declare a cancellation or a withdrawal, we store the content of your declaration, the time it reached us and the contact details you supplied.

Purposes and legal bases

We process data to provide, stabilise and secure the site on the basis of our legitimate interest (Art. 6(1)(f) GDPR), to enter into and perform the usage and subscription contract, including account management, payment handling and support (Art. 6(1)(b) GDPR), to comply with legal obligations, in particular commercial and tax retention duties and consumer-law record-keeping (Art. 6(1)(c) GDPR), and on the basis of your consent wherever we ask for one (Art. 6(1)(a) GDPR).

Recipients and service providers

To operate the service we use providers that process personal data solely on our instructions (Art. 28 GDPR): hosting and operation of the application and its database, delivery of transactional e-mail, and error and uptime monitoring.

The providers we use are: Netcup (hosting and operations), Backblaze (encrypted backups via Backblaze B2, EU Central region), Amazon Web Services (transactional email delivery via Amazon SES, Frankfurt region), Cloudflare (protecting our public forms against automated requests) and Sentry (error and operations monitoring).

Error monitoring receives technical error reports from our application. In individual cases such a report can contain an IP address, browser details or an email address, where these are part of the reported event.

If you choose "Sign in with Google", we send you to Google. The connection is created by your click and not before — we load no Google script and transmit nothing until then.

From the redirect onwards Google is the site you are visiting and sees the usual data such as your IP address. Google is responsible for the sign-in itself.

From Google we receive only your email address and an identifier for your Google account — no profile picture, no name, no ongoing access to your account. If you do not use this sign-in, no contact with Google occurs at all.

The sources from which we obtain price, company and financial data generally receive no personal data about our users merely through the use of this data.

Payments are processed through Stripe Managed Payments. The merchant-of-record service is provided by Sold through Link, LLC. Stripe and Sold through Link handle in particular the payment processing as well as tasks relating to fraud prevention, taxes and order handling.

In doing so, Stripe and Sold through Link process personal data in part as independent controllers, in particular where this is necessary for payment processing, fraud prevention and to meet their own legal and tax obligations. The Stripe and Link privacy notices apply in addition for that processing.

What reaches us are the details we need to perform your subscription and keep our books. Full payment details such as card numbers do not reach us.

Transfers to third countries

Some of the providers we use are based outside the European Economic Area or may process personal data there. A transfer to a third country takes place only where the conditions of Art. 44 et seq. GDPR are met.

For transfers to the United States we rely, where the recipient in question is certified accordingly, on the European Commission’s adequacy decision for the EU-U.S. Data Privacy Framework. Where no adequacy decision applies, appropriate safeguards are used, in particular the standard contractual clauses approved by the European Commission. You can request information about the safeguards used in each case, and about where a copy can be obtained, at contact@decodestocks.com.

Storage on your device

We use no cookies for advertising, audience measurement or user tracking, and we embed no third-party analytics or advertising services. Simply opening our pages creates no connection to any third party.

We store only what the function you asked for requires: the data that keeps you signed in, the carrier of a registration or sign-in you have started, and the settings you set yourself — language, display currency, appearance, and the columns you assemble for a table.

How you arrange lists and views beyond that — cards or table, time range, rows per page — is remembered only if you explicitly ask us to.

If you do not, your choice applies to this visit and is gone afterwards. You can change it at any time in your settings. Switching it off deletes what has already been remembered.

None of it says anything about which stocks or pages you looked at.

While you are signed in, the name of the storage slot carries a reference to your account — so that two accounts on the same browser do not overwrite each other's settings.

Because this storage serves only the function you requested, it requires no consent under § 25(2) TDDDG. That is why we show you no consent banner.

On the registration and password-reset pages we additionally embed a Cloudflare challenge that fends off automated requests. It loads only when you open one of those two pages.

Retention

The web server's technical operating logs contain no personal data.

Application logs, which can contain an IP address when something fails, are kept for 30 days. Logs of security-relevant account events have their own periods, staggered by event type.

Account data and the content you create are stored for as long as your account exists. After a subscription ends they are kept for a limited retention window so that coming back later costs you no data, and are deleted afterwards.

Contract, invoice and declaration data are kept for as long as commercial and tax retention duties and the limitation periods for possible claims require.

Backups are stored encrypted and kept for up to 56 days. Data already deleted from the live system can still be present in backups during that period. There it is held solely to restore the service after a data loss, and it is deleted once the retention period ends.

Your rights

You have the right of access (Art. 15 GDPR), to rectification (Art. 16), to erasure (Art. 17), to restriction of processing (Art. 18), to data portability (Art. 20), and to object to processing based on legitimate interests (Art. 21).

Any consent you have given can be withdrawn at any time with effect for the future. Write to contact@decodestocks.com.

Independently of this, you may lodge a complaint with a data protection supervisory authority.

If we rectify or erase your data, we notify every recipient we disclosed it to, unless this proves impossible or would involve disproportionate effort. We will tell you who those recipients are if you ask.

There is no automated decision-making in individual cases, including profiling, that produces legal effects concerning you or similarly significantly affects you. The ratings and analyses shown on the site are general information, not a decision about you.

Providing your email address is necessary for an account and for entering into a contract. Without it we cannot operate an account for you. Anything beyond that is voluntary.