Privacy Policy
Last updated: March 2026
1. Data Controller
ZidraInvest OÜ, Harju maakond, Tallinn, Estonia (hereinafter "we"). Contact: hello@trademates.co
2. Data We Collect
2.1 Usage Data (automatic)
When visiting our website, we automatically collect: browser type and version, operating system, referrer URL, pages visited, time of access, device type, and country/city (derived from your browser's timezone).
IP address: Your IP address is never stored in plain text. It is used server-side only to derive a one-way, non-reversible SHA-256 hash (a "visitor ID") combined with your user-agent and a secret salt. This pseudonymous hash is used solely to detect repeat visits by the same person across different browsers for our internal traffic analytics. Reconstructing your real IP from this hash is not possible.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in providing, securing, and measuring traffic to the website).
2.2 Registration Data
When creating an account: email address, chosen display name. This data is stored in our database.
Legal basis: Art. 6(1)(b) GDPR (performance of a contract).
2.3 Portfolio Data
When uploading a portfolio: security tickers, weightings, transaction history. This data is processed solely to provide the analysis functionality.
Legal basis: Art. 6(1)(b) GDPR.
2.4 Payment Data
Payments are processed via Stripe Inc. We do not store credit card numbers. Stripe processes data as an independent controller under their own privacy policy.
3. Cookies & Local Storage
We use only technically necessary cookies and localStorage for:
- Authentication sessions (auth token)
- Language preference (de/en)
- Theme preference (light/dark)
- Cookie consent status
We do not use any third-party tracking, marketing, or analytics cookies.
4. Data Sharing
We share personal data only with the following categories of recipients:
- Hosting: Our infrastructure is hosted within the EU.
- Financial data providers: Finnhub, Yahoo Finance – only stock tickers (no personal data) are transmitted.
- Payment processing: Stripe Inc. (USA) – under the EU-US Data Privacy Framework.
- AI Analysis: Requests to AI models contain no personal data, only public company financial data.
5. Your Rights (Art. 15-22 GDPR)
You have the right to:
- Access your stored data (Art. 15 GDPR)
- Rectification of inaccurate data (Art. 16 GDPR)
- Erasure of your data (Art. 17 GDPR)
- Restriction of processing (Art. 18 GDPR)
- Data portability (Art. 20 GDPR)
- Object to processing (Art. 21 GDPR)
- Lodge a complaint with a supervisory authority
Contact: hello@trademates.co
6. Data Security
We employ state-of-the-art technical and organizational measures: encrypted transmission (TLS), row-level security, hashed passwords, regular security audits.
7. Retention Period
Usage data is anonymized after 90 days. Account data is deleted immediately upon account deletion, unless statutory retention obligations apply.
8. Minors
Our services are not directed at persons under 18 years of age. We do not knowingly collect data from minors.
9. Changes
We reserve the right to update this privacy policy. The current version is always available on this page.