Privacy Policy

DAFE Privacy Policy Version 2.0 Effective Date: 25 September 2026 ## 1. Controller The controller responsible for DAFE is: Daniel Felsinger DAFE Ifangweg 6 8610 Uster Switzerland Privacy contact: app.dafe@gmail.com ## 2. Scope This Privacy Policy explains how DAFE collects, uses, stores and otherwise processes personal data when users interact with: - the DAFE website - the DAFE application - Free and Pro accounts - support - AI functionality - affiliate functionality - related DAFE services This policy should be read together with the DAFE Terms of Service. ## 3. Principles DAFE aims to process personal data: - transparently - for defined purposes - proportionately - securely - only for as long as reasonably necessary or legally required DAFE does not treat acceptance of this Privacy Policy as blanket consent for every possible form of processing. Where consent is legally required, consent is requested separately. ## 4. Account and Profile Data Depending on the account setup, DAFE may process: - display name - email address - user ID - country - postal address where collected - account status - plan - preferred language - timezone - profile settings This data is used to create and manage the user's DAFE account and provide the service. ## 5. Authentication and Security Data DAFE and its authentication/infrastructure providers may process: - authentication identifiers - password-reset requests - Two-Factor Authentication configuration - login/session information - browser information - device information - IP address where technically processed - session tokens - security-event information - audit logs DAFE must not store plaintext passwords. Where password authentication is handled by a third-party authentication provider, that is described accurately in the processor table. ## 6. Subscription and Billing Data For Pro subscriptions, DAFE may process: - selected plan - billing interval - subscription status - Stripe customer identifier - Stripe subscription identifier - price identifier - invoice/payment status - transaction dates - cancellation status - renewal dates - Pro-access dates Complete card numbers and card security codes remain with the payment provider rather than being stored directly by DAFE, because the current implementation uses provider-hosted payment processing. ## 7. Journal and Trading Data Users may voluntarily record information including: - asset or instrument - trade date/time - direction - PnL - trade result - timeframe - entry information - exit information - risk/reward information - trade rating - setup information - tags - written notes - screenshots - normal Trade entries - Missed Trade entries - No Trade entries DAFE processes this information to provide journaling, analytics, review and AI features requested by the user. ## 8. Strategy Data Users may store: - strategy names - descriptions - rules - checklists - folders - strategy links to trades This information is used to provide strategy organization and performance analysis. ## 9. Psychology and Behavioral Data DAFE may process voluntarily recorded trading-related information including: - emotions before trades - emotions during trades - emotions after trades - Pre-Trade Self-Check responses - discipline indicators - rule-following information - behavioral patterns - psychology scores generated by DAFE This information is used for trading-related self-reflection and behavioral analytics. DAFE does not use these features to provide medical or psychological diagnosis. Users should not intentionally enter medical records, psychiatric diagnoses or other unrelated highly sensitive health information into DAFE. ## 10. Notes Users may create notes containing: - titles - text - formatting - checklists - images - links Notes are processed to provide the Notes feature and any user-requested functionality that uses those notes. ## 11. Motivation, Vision Board and Goals DAFE may process: - Vision Board names - uploaded images - goal titles - descriptions - target dates - subtasks - external links - goal completion information This information is processed to provide the Motivation and Goal Tracker features. ## 12. Progress Data DAFE may process: - Process Goals - Vision Goals - achievements - streaks - progress indicators - historical completion information ## 13. Weekly Review Data DAFE may process: - written weekly reflections - selected answers - performance information for the selected week - generated insights - AI Weekly Coaching Summaries ## 14. AI Data When users use AI functionality, DAFE may process information necessary to generate the requested response. Depending on the requested analysis, this may include selected data from: - Journals - trades - Strategies - Psychology - Weekly Reviews - Progress - Goals - previous AI Reports - AI Chat messages DAFE applies data minimization and should send only the data reasonably required for the requested AI function. DAFE discloses the actual AI provider in the verified processor table below. DAFE does not state that AI providers never retain data or never use data for training unless that statement is factually and contractually verified for the production configuration. This has not yet been verified and is therefore flagged as a launch blocker. ## 15. AI Chat History Where users save multiple AI Data Chat conversations, DAFE may store: - chat title - user messages - AI responses - scope/filter information - timestamps The user may delete chats through available application functionality. Deleted chat data is handled according to the retention section below. ## 16. Generated AI Reports DAFE may store: - AI Coaching Reports - Weekly AI Coaching Reports - generated key takeaways - generated behavioral observations - timestamps - report scope These reports are linked to the user's account. ## 17. Trade Highlight Videos Where the user creates a Trade Highlight Video, DAFE may process: - selected trade statistics - asset - trade result - PnL - timeframe - trade rating - selected notes/tags displayed in the video - generated video file - thumbnail or preview - technical generation status The video is generated at the user's request. ## 18. Market News Preferences DAFE may process preferences used to configure market information, such as: - timezone - selected currencies - date range - impact filters DAFE does not track exact physical location. Timezone selection is manual. ## 19. Notification Preferences DAFE may process: - notification toggles - email-reminder preferences - delivery status - unsubscribe state - timestamps Optional reminder or marketing communications are sent only where permitted under applicable law. ## 20. Affiliate Data If a user applies to or participates in the DAFE Affiliate Program, DAFE may process: - name - email - country - social-media profile - audience information - application answers - application status - affiliate ID - affiliate code - referral information - eligible commissions - payout history - bank/payout information where collected - tax-related information where legally necessary - Affiliate Terms acceptance Affiliate information is used to review applications, administer the program, calculate commission, make payouts, prevent abuse and comply with legal/accounting obligations. ## 21. Support Communications If a user contacts DAFE, DAFE may process: - email address - name - support request - correspondence - technical information voluntarily provided ## 22. Legal Acceptance Data DAFE may retain evidence including: - accepted Terms version - Privacy Policy version shown to the user - Risk Disclaimer version - Affiliate Terms version where applicable - acceptance timestamp - acceptance language - relevant account identifier This information may be retained to demonstrate the contractual/legal relationship and compliance obligations. ## 23. Purposes of Processing DAFE processes personal data where necessary for purposes including: - creating accounts - authenticating users - providing DAFE functionality - storing user content - calculating analytics - providing AI analysis requested by the user - managing subscriptions - processing payments - preventing fraud - securing accounts - providing customer support - sending requested notifications - administering affiliates - maintaining records required by law - enforcing Terms - diagnosing technical problems - improving service reliability where permitted ## 24. GDPR Legal Bases Where Applicable Where the EU General Data Protection Regulation applies, DAFE relies on an appropriate legal basis depending on the processing. This may include: Performance of a contract: where processing is necessary to provide the DAFE service requested by the user. Legal obligation: where DAFE must retain or process information under tax, accounting or other law. Legitimate interests: where DAFE has a legitimate need such as securing the service, preventing fraud, establishing or defending legal claims or improving technical reliability, provided those interests are not overridden by the individual's rights and freedoms. Consent: where applicable law requires consent, for example for certain optional communications or non-essential tracking technologies. DAFE does not use consent as a blanket legal basis for every processing activity. ## 25. Service Providers and Recipients DAFE uses the following service providers in the current production configuration. Where a detail (legal entity, country, transfer mechanism, DPA) is not yet verified it is marked "Pending verification" and is listed as a launch blocker in the Admin → Legal Audit panel before targeted EU launch. No provider is listed that is not actually used. - Base44 (application platform) — Hosting, database, authentication, file storage, email delivery, AI/LLM invocation, video and image generation — all consumed through the Base44 platform integrations. Data: Account, authentication, journal, trading, psychology, AI prompts/responses, notes, uploaded files, email content. Country/region: Pending verification. Transfer mechanism: Pending verification. DPA: Pending verification. Privacy policy: Pending verification. Status: PLATFORM_CONFIRMED_SUBPROCESSORS_PENDING. - Stripe — Payment processing (Pro subscriptions). Data: Billing and payment data. Full card numbers and card security codes remain with Stripe and are not stored by DAFE.. Country/region: Pending verification (Stripe entity for this account). Transfer mechanism: Pending verification. DPA: Pending verification. Privacy policy: https://stripe.com/privacy. Status: PROVIDER_CONFIRMED_DPA_PENDING. - Forex Factory (faireconomy.media) — Economic-calendar and Bank Holiday data displayed in the Newsfeed. Data: No personal data is sent. Public market-event data is fetched server-side and displayed.. Country/region: Pending verification. Transfer mechanism: Not applicable (no personal data transferred). DPA: Not applicable. Privacy policy: Pending verification. Status: SOURCE_CONFIRMED_LICENCE_PENDING. - AI model provider (Claude family, via Base44 InvokeLLM) — AI Data Chat, AI Coaching Reports, Weekly AI Coaching Summaries and automated insight features. Data: Prompts and selected user data necessary to generate the requested analysis. Country/region: Pending verification. Transfer mechanism: Pending verification. DPA: Pending verification. Privacy policy: Pending verification. Status: MODEL_FAMILY_CONFIRMED_PROVIDER_TERMS_PENDING. DAFE does not currently use a separate analytics, advertising-marketing, or error-monitoring provider beyond the platform above. If that changes, this table will be updated before the relevant technology is activated. ## 26. International Transfers DAFE is based in Switzerland. Some service providers may process data outside Switzerland or the user's country. Where personal data is transferred internationally, DAFE will use mechanisms required by applicable law, which may include: - a country recognized as providing adequate protection - contractual safeguards - standard contractual clauses - other legally permitted safeguards The actual relevant transfer mechanisms must match the production providers listed in the processor inventory above. Where a mechanism is not yet verified, it is flagged as a launch blocker. ## 27. EU Representative DAFE is established in Switzerland and offers a multilingual service that may be used by residents of the European Union. An assessment under GDPR Article 3 / Article 27 is pending. If an EU representative is legally required, DAFE will appoint one and insert the verified contact details here before targeted EU launch. No representative details are invented or published until verified. ## 28. Cookies and Similar Technologies DAFE may use cookies, local storage and similar technologies. Strictly necessary technology may be used to: - authenticate users - maintain security - preserve sessions - remember essential application state Optional analytics or marketing technologies must only operate in accordance with applicable consent requirements. Detailed information is available in the Cookie Policy. ## 29. Data Retention DAFE does not keep personal data indefinitely without purpose. The following retention periods apply. Where a period is not yet technically enforced, it is flagged as a launch blocker before publication. ### Active account/product content Journal data, Notes, Strategies, Psychology data, Vision Boards, Goals, AI Chats, AI Reports and generated videos are retained while the account is active unless the user deletes them earlier. ### Account deletion When an account deletion becomes effective, active product data is removed from production systems within 30 days unless a shorter period is technically possible or retention is legally required. ### Backups Deleted product data may remain in protected rotating backups for up to 90 days, solely for disaster recovery/security purposes, after which it expires through the backup lifecycle. Backup data is not restored into a newly created account solely because the new account uses the same email address. ### Security logs Ordinary security and technical logs may be retained for up to 12 months unless a security incident, fraud investigation or legal obligation requires longer retention. ### Support Support correspondence may ordinarily be retained for up to 3 years after the last relevant interaction, unless a longer period is necessary for an ongoing dispute or legal obligation. ### Affiliate applications Rejected affiliate applications may ordinarily be retained for up to 12 months for program administration and fraud/duplicate-application prevention, unless applicable law requires earlier deletion or a longer period is justified. ### Accounting and payment records Records that qualify as accounting, tax or business records may be retained for the applicable statutory period. Certain Swiss accounting records may require retention for 10 years. ### Legal acceptance records Evidence of contractual/legal acceptance may be retained for the period reasonably required to establish, exercise or defend legal claims and meet record-keeping obligations. DAFE minimizes the information retained for this purpose. ## 30. Account Deletion A user may request account deletion through DAFE where available or by contacting: app.dafe@gmail.com Account deletion removes active product data where no legal reason for continued retention exists. Some limited records may remain where necessary for: - accounting - tax - legal claims - fraud prevention - security - statutory retention Such retained information is segregated from normal product use. It does not cause historical Journal, Psychology, Notes, Goals or other deleted application data to reappear if the same person later creates a new DAFE account. ## 31. Data Export and Portability DAFE provides trade export functionality in CSV format. Where applicable law grants additional access or portability rights, users may request a copy of relevant personal data by contacting: app.dafe@gmail.com ## 32. Data Subject Rights Depending on applicable law, users may have rights including: - access - correction - deletion - restriction - objection - data portability - withdrawal of consent - complaint to a competent data-protection authority Rights may be subject to statutory conditions and exceptions. Requests can be sent to: app.dafe@gmail.com DAFE may take reasonable steps to verify the identity of the requester. ## 33. Withdrawal of Consent Where DAFE relies on consent, users may withdraw consent at any time for future processing. Withdrawal does not make prior lawful processing unlawful. Users may manage certain preferences directly in Settings. ## 34. Automated Analysis DAFE uses automated systems and AI to generate analytics and behavioral insights. These tools are intended to help users review their own trading-related information. DAFE does not use these tools to make decisions that produce legal effects concerning the user or similarly significantly affect the user's legal status. If this changes, this Privacy Policy and any required safeguards will be updated before deployment. ## 35. Data Security DAFE uses reasonable technical and organizational security measures appropriate to the service and the risks involved. Measures may include, where technically implemented: - authenticated access - encrypted network transmission - role-based permissions - session controls - Two-Factor Authentication - security logging - access restrictions - backups No internet-based service can guarantee absolute security. ## 36. Data Breaches If DAFE becomes aware of a personal-data breach, DAFE will assess the incident and comply with applicable legal notification and documentation obligations. Where required by law, affected individuals and/or the competent data-protection authority will be notified. ## 37. Children DAFE is not intended for children. Users must meet the eligibility requirements stated in the Terms. DAFE does not knowingly design the service to collect personal data from children for trading-related use. ## 38. Changes to This Privacy Policy DAFE may update this Privacy Policy where processing, technology or law changes. The version and effective date will be updated. Where required, users will receive additional notice. ## 39. Contact Privacy questions and requests: DAFE Daniel Felsinger Ifangweg 6 8610 Uster Switzerland app.dafe@gmail.com