Privacy Policy

Last updated: 20 August 2026

This notice explains what personal information Vanity Analysis (“Vanity Analysis”, “we”, “us”) collects, why we collect it, the legal bases on which we rely, who processes it on our behalf, and the rights available to you. It is written with the transparency requirements of the EU General Data Protection Regulation (GDPR) in mind, because we may serve users located in the European Economic Area (EEA).

Who we are

Vanity Analysis is a trading-research platform. The operator of the service acts as the controller of your personal data and can be contacted at contact@vanityanalysis.com. We have not appointed a Data Protection Officer; if we are required to appoint one or choose to do so, this notice will be updated with their contact details.

Information we collect

Account information

You provide this when you create and manage an account:

• your name;
• your email address (used to sign in and to contact you);
• your password, which we store only in a securely processed (hashed) form using scrypt — we never store, log, or have access to your password in plain text;
• optional profile details you choose to add: company or firm, phone number, a contact email, and timezone;
• account timestamps, such as when the account was created.

Trading and research information

When you use the platform, you may submit information describing how you trade, including:

• strategy descriptions written in your own words;
• strategy configurations, and your market, session, and timeframe selections;
• risk parameters and backtest configurations;
• the research reports generated for you, and the simulated trade history contained within them.

This information is used solely to interpret your methodology, run the research you request, and store the resulting reports in your account. We do not use your strategy descriptions or configurations to train machine-learning models, and we do not use them for advertising. Your reports are associated with your account and are not accessible to other users.

Payment information

Payments are processed by Stripe. Card details are entered directly into Stripe’s secure components and are not received or stored by Vanity Analysis. We retain a record of each transaction — a Stripe payment reference, the amount, the currency, the status, and timestamps — so that we can account for purchases and grant the corresponding research credits. We do not hold your full card number.

Technical information

Operating a secure online service necessarily involves processing limited technical information. This includes your IP address and standard connection and request metadata, together with session and authentication information and related timestamps. This information is processed to deliver the service, keep it available, and protect it against abuse, and it is handled largely by our hosting and database providers as part of running the platform. We do not currently operate analytics or behavioural tracking (see our Cookie Policy).

How we use information

• to create and administer your account, and to authenticate you;
• to interpret your strategy, run the research you request, and store your reports;
• to operate the research-credit system and account for how credits are used;
• to process payments through Stripe and maintain transaction records;
• to detect, prevent, and investigate fraud, abuse, and security incidents;
• to respond to your support requests and communicate with you about your account;
• to maintain the reliability and integrity of the service;
• to comply with legal and regulatory obligations.

Legal bases for processing (GDPR)

Where the GDPR applies, we rely on the following legal bases:

• Performance of a contract — to create your account, deliver the research you request, operate the credit system, and process your purchases.
• Legitimate interests — to keep the service secure, prevent fraud and abuse, and maintain its reliability, provided those interests are not overridden by your rights.
• Legal obligation — to retain records we are required to keep, such as those relating to payments and tax.
• Consent — for any future non-essential technologies (such as analytics), which we do not currently operate and would not introduce without asking first.

Service providers who process information for us

We rely on a small number of providers to operate Vanity Analysis. They process personal information on our behalf, or as independent controllers where applicable, under their own contractual and data-protection arrangements:

• Vercel — application hosting and delivery.
• Neon — the managed PostgreSQL database where account, report, and payment records are stored.
• Stripe — payment processing, and the delivery of payment receipts.
• Resend — delivery of transactional emails, such as password-reset messages.

We do not sell your personal information, and we do not share it for advertising. Because these providers are necessary to operate the platform, they do process information on our behalf; we therefore do not claim that information is never shared.

International transfers

Some of our providers operate infrastructure outside the EEA, including in the United States, which means your information may be processed outside the EEA. Where this occurs, the transfer relies on the safeguards each provider offers for such transfers — principally the European Commission’s Standard Contractual Clauses and, where the provider is certified, the EU-US Data Privacy Framework.

Data retention

We keep personal information only for as long as reasonably necessary for the purposes described in this notice, and for as long as required to meet our legal obligations:

• session records expire after 30 days, and password-reset tokens expire within an hour and are removed shortly afterwards;
• account information and reports are retained while your account is active and are deleted within 90 days following account closure, except where information must be retained for longer to meet a legal obligation;
• payment, accounting, fraud-prevention, legal, and other records that we are legally required or reasonably need to keep are retained only for the applicable legally required or reasonably necessary periods.

How we protect information

The platform is built with security as a first-class concern. Measures include:

• passwords stored only as scrypt hashes, never in plain text;
• session tokens stored only in hashed form, with the session cookie kept inaccessible to page scripts;
• server-side authentication, so account state cannot be altered from the browser;
• a managed PostgreSQL database (Neon);
• a server-side credit ledger with ownership checks, so reports can only be accessed by their owner;
• database-level locking when credits are authorised, to prevent double-spending;
• server-side verification of payments, and verification of the authenticity of payment webhooks;
• encrypted connections (HTTPS) in production.

No online service can be guaranteed to be perfectly secure, and we do not claim any specific security certification.

Your rights

Where the GDPR applies, you have the right to:

• access the personal information we hold about you;
• have inaccurate information corrected;
• request erasure of your information in certain circumstances;
• restrict or object to certain processing;
• receive certain information in a portable format;
• withdraw consent where processing is based on consent;
• lodge a complaint with a data-protection supervisory authority.

These rights are subject to the conditions and exceptions provided by applicable law. You can exercise them by contacting us at contact@vanityanalysis.com. You also have the right to lodge a complaint with a data-protection supervisory authority. Our lead supervisory authority is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, “UODO”), ul. Stawki 2, 00-193 Warsaw, Poland. If you are located elsewhere in the EEA, you may also complain to your local supervisory authority.

Automated processing

Vanity Analysis interprets your strategy description and produces a research report, including a research verdict such as “Statistically Viable”, “Requires Optimisation”, or “No Reliable Edge”. These outputs are research conclusions about a trading strategy under the platform’s modelling assumptions. They are not credit decisions, legal determinations, or assessments of you as an individual, and they do not produce legal effects concerning you or similarly significantly affect you. Accordingly, we do not consider this to be automated decision-making of the kind addressed by Article 22 of the GDPR.

Children

Vanity Analysis is a professional research tool intended for adults. It is not directed to children, and we do not knowingly collect personal information from children. Eligibility to use the Service depends on your legal capacity to enter into a contract, as set out in our Terms of Service. If you believe a child has provided us with personal information, please contact us so we can address it.

Changes to this notice

We may update this notice from time to time. When we make a material change, we will revise the “last updated” date above and, where appropriate, provide additional notice.

Contact

For any privacy question, or to exercise your rights, contact us at contact@vanityanalysis.com.