Privacy Policy

We collect the minimum data necessary to provide and improve our service:

DepthSignal is a market-data analytics service. We provide visible market context and supporting analytics. We do not handle funds, execute orders, or connect to your exchange accounts. We have no access to your exchange credentials, balances, or order history. Account credentials are stored using one-way cryptographic controls and cannot be recovered in plaintext.

There is no active payment provider currently proved. While that remains true, the published payment fallback is manual invoicing plus SEPA bank transfer after approval, and DepthSignal stores the customer, invoice, payment reference, settlement, refund, and tax records needed to operate that finance workflow.

DepthSignal's finance/tax system remains the system of record for payment references, invoice records, refund records, settlement tracking, and VAT/GST monitoring. Any future PSP, card processor, bank rail, or merchant-of-record path must attach to that system as an adapter before payment-provider data processing is republished.

Under GDPR Article 6, we process your personal data on the following legal bases:

• Contract performance (Art. 6(1)(b)): Processing your account information and subscription data is necessary to provide the DepthSignal service you subscribed to. (GDPR Article 6(1)(b); contract basis)
• Legitimate interest (Art. 6(1)(f)): Processing API usage logs for abuse prevention, rate limiting, service security, and service improvement. Our legitimate interest is to maintain a secure, reliable API service. This does not override your fundamental rights. (GDPR Article 6(1)(f); legitimate interests)
• Legal obligation (Art. 6(1)(c)): Retaining certain data as required by Estonian and EU tax, accounting, and business regulations.
• Consent (Art. 6(1)(a)): Newsletter subscriptions are based on your explicit, freely given consent via double opt-in. You can withdraw consent at any time by unsubscribing. (GDPR Article 6(1)(a); consent)

We retain personal data only for as long as necessary for the purposes set out in this policy (GDPR Article 5(1)(e); storage limitation).

As a data subject, you have the following rights under the GDPR. Where possible, we provide self-service API endpoints so you can exercise these rights immediately:

• Right of access (Article 15): You can view all personal data we hold about you via the customer portal at any time. (Article 15)
• Right to rectification (Article 16): You can update your profile information (email, company name) directly via the customer portal profile settings. (Article 16)
• Right to erasure (Article 17): You can delete your account and all associated data by calling DELETE /v1/customer/me. This permanently removes your account, API keys, and usage data. Billing records are retained for 7 years as required by Estonian tax law. EU Article 16(m) consent records (per-transaction audit trail for the 14-day withdrawal-right waiver) are retained 7 years under the legitimate-interest legal basis (Article 6(1)(f)) for the same Estonian Accounting Act + EU consumer-protection enforcement window. These records survive Article 17 erasure of the linked customer account: the customer link is set to NULL, the consent record itself remains so that, if a chargeback or consumer-protection claim is filed, the original consent can still be evidenced. (Article 17)
• Right to data portability (Article 20): You can export all your data in a structured, machine-readable JSON format by calling GET /v1/customer/export. The export includes your profile, subscription details, API key metadata, and usage history. (Article 20)
• Right to restriction (Article 18): You can request that we restrict processing of your data in certain circumstances. (Article 18)
• Right to object (Article 21): You can object to processing based on legitimate interest. We will cease processing unless we demonstrate compelling legitimate grounds. (Article 21)

How to exercise your rights: For rights not available via self-service, send a request to [email protected] with the subject line "GDPR Data Request". We will verify your identity and respond within 30 days. If you are unsatisfied with our response, you have the right to lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) or your local supervisory authority. (GDPR Article 77)

We split cookies and comparable browser storage into three categories. The consent banner shown on your first visit lets you accept, reject, or customize them. Your choice is stored in the ds_consentcookie (and a localStorage mirror) for one year. You can revisit the banner any time via the Cookie Preferences link in the footer (ePrivacy Directive 2002/58/EC Article 5(3); GDPR Article 7(3)).

No third-party advertising networks or fingerprinting vendors are used. Optional analytics and behavioral analytics only run after consent.

DepthSignal can run optional consent-gated analytics only when the relevant project identifiers are configured and public optional analytics is deliberately enabled at runtime. Analytics remains off by default until you grant consent through Cookie Preferences. Microsoft Clarity and Google Analytics are limited to public-site surfaces. First-party PostHog analytics may run on public pages and core product pages, while auth, billing, admin, account-settings, signup, and similar sensitive routes remain excluded by default.

Google Analytics and Microsoft Clarity bootstrap tags may appear in the pageheadin consent-denied mode so browser setup checks can recognize the installation. Analytics storage, page measurement, heatmaps, and replay remain denied unless the runtime enablement flag, route policy, vendor configuration, and user consent all allow them together.

• PostHog: optional first-party product analytics and feature flags, self-hosted by Ravenna OÜ on EU infrastructure when configured and deliberately enabled. It is used for product and public-site measurement after consent, but not on blocked sensitive routes.
• Microsoft Clarity: optional public-site behavioral analytics, including heatmaps, session replay, clicks, scrolls, page rendering diagnostics, page URLs, browser metadata, and masked page content. We use Clarity to understand how visitors use public pages, improve product presentation, debug page experience, and validate which public content is useful. Microsoft may receive this public-site usage data when you grant analytics consent. Platform, auth, billing, admin, signup, preview, demo, token, embed, and sensitive account routes are excluded by default, and Clarity masking must stay enabled on form-like collection surfaces. Learn more in the Microsoft Privacy Statement.
• Google Analytics: optional public-site measurement for page views and aggregate acquisition/performance reporting when configured and deliberately enabled. Google may receive information such as the page URL, browser and device metadata, IP-derived coarse location, and analytics cookies or identifiers after consent. The current implementation is not used for platform heatmaps, session replay, Google Ads personalization, or remarketing. Learn how Google uses information from partner sites and apps in Google's partner-site notice.
• Legal basis: consent (GDPR Article 6(1)(a)). Analytics stays off by default until you opt in and can be revoked through Cookie Preferences.
• Retention: PostHog raw events are kept for up to 90 days before anonymization or deletion. Microsoft Clarity and Google Analytics retention is governed by their project settings and provider terms.
• Third-party sharing: Microsoft and Google receive the consent-mode bootstrap requests needed for their configured public-site integrations. Active analytics storage, page measurement, heatmaps, and replay start only when those integrations are configured and you have granted analytics consent.
• Opt-out controls: you can withdraw site consent from Cookie Preferences. Google also provides a Google Analytics browser add-on for users who want a browser-level Analytics opt-out.

Your rights: under GDPR you can access, rectify, erase, port, or object to this processing at any time. You can also exercise all of these from inside the app:

• Reject or customize cookies from the banner or Cookie Preferences link in the footer.
• Toggle analytics at any time from Account Settings → Privacy.
• Download your data via GET /v1/customer/export (also linked from Privacy settings).
• Delete your account (right to erasure). Account deletion also removes related first-party product analytics profiles where technically linked to your account.

We share personal data with the following third-party processors only, each bound by data processing agreements (GDPR Article 28):

We do not use third-party advertising networks or fingerprinting vendors. PostHog, Microsoft Clarity, and Google Analytics are listed above because analytics can process personal data when configured and when you grant analytics consent. Clarity and Google Analytics are public-site only. PostHog is first-party analytics with sensitive routes excluded by default. We do not share your personal data with any other third parties except where required by law.

Core DepthSignal infrastructure is hosted in the European Union. Most account and service operations run on EU-hosted systems.

Some processing involves US-based sub-processors for specialized services (for example, email delivery, AI processing, and issue tracking). No current third-party payment processor is published as active; any future payment-provider location, transfer basis, and safeguards must be republished before activation. Where personal data is transferred outside the EEA, we apply GDPR Chapter V safeguards, including Standard Contractual Clauses and additional contractual or technical protections where required.

For UK-restricted transfers, UK transfer addendum mechanisms are applied where legally required. For Switzerland-restricted transfers, Swiss transfer requirements are applied where legally required.

As a small company, we are not required to appoint a Data Protection Officer (DPO) under GDPR Article 37. However, for any data protection inquiries, you may contact us directly:

• Email: [email protected]
• Subject line: "Data Protection Inquiry"

You also have the right to lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) (GDPR Article 13(1)(a)-(b)):

• Website: www.aki.ee/en
• Email: [email protected]

When you use AI chat features, the following applies to your conversation data:

• Storage. Your messages and AI responses are stored in our database to provide chat history across sessions.
• Third-party processing. Conversations are sent to a third-party AI provider for processing. Current provider: OpenAI.
• No model training. AI providers process conversation data under contractual data processing commitments. Data Processing Agreements (DPAs) are in place with relevant sub-processors, including transfer safeguards where required.
• Your control. You can delete all conversation history at any time from Settings.
• Automatic deletion. Conversations are automatically deleted after 30 days (Trader plan), 90 days (Professional and Expert plans), or 1 year (Enterprise plan).

The legal basis for processing AI conversation data is contract performance (Art. 6(1)(b) GDPR): processing is necessary to deliver the AI feature you have requested as part of your subscription.

We may update this Privacy Policy to reflect changes in our practices or legal requirements. When we make material changes, we will notify you via the email address associated with your account at least 14 days before the changes take effect.

The current version of this Privacy Policy is always available at this page. Minor clarifications or formatting changes may be made without notice.