Privacy Policy

1. Controller

• Controller: Sergi Linares Ortigas, an individual operating under the commercial name FLAWLINE.
• NIF: 39435877P. Address: Ronda de la Guineueta Vella, 50, 08042 Barcelona (Spain).
• Privacy and data-rights contact: privacy@flawline.io. General contact: info@flawline.io.
• No data protection officer has been appointed because one is not required for this activity.

2. Data we process

Depending on how you use FLAWLINE, we process:

• Account: your email address, an internal identifier, sign-up and verification dates, and the version and date of the Terms you accepted.
• Access and security: records of one-time sign-in links and sessions, with keyed cryptographic hashes of tokens, IP addresses and browser; your IP is never stored in clear in the database.
• Free trial: a pseudonymised identifier derived from your normalised email address (HMAC-SHA-256 computed with a secret server key), so the 2 free validations are granted only once per mailbox. It is not anonymous: with that key it could be recomputed from your email, so we treat it as pseudonymised personal data subject to the GDPR.
• Validations: the configurations you submit (strategy, market, timeframe and parameters), their status, results, HTML/JSON/PDF reports and data and reproducibility metadata.
• Credits: credit-ledger movements (grant, reservation, consumption and release). There are no payments and no bank details.
• Commercial interest: if you ask to be told about future packs, API access or more validations, the type of notice, its dates, your credit state at that moment and the version of the information shown; if you ask without an account, your email, the option chosen, language and confirmation date.
• Email: delivery status of service emails and their provider message identifier.
• Communications: messages you send to @flawline.io addresses.
• Technical logs: access and error logs needed to run and protect the service, which may include IP address and browser.

3. Purposes and legal bases

• Creating and managing your account, signing you in, running your validations, producing your reports, managing your credits and sending service emails: performance of the contract (Beta Terms), Art. 6(1)(b) GDPR.
• Security, prevention of fraud and free-trial abuse (including the free-trial identifier), usage limits, backups, error diagnosis and aggregated internal metrics on beta usage: legitimate interest in protecting and improving the service, Art. 6(1)(f) GDPR.
• Notifying you when packs, API access or more validations become available, when you ask for it: your consent, Art. 6(1)(a) GDPR, which you can withdraw at any time without affecting earlier processing.
• Handling your requests and rights and meeting legal obligations: Art. 6(1)(c) GDPR.

4. Commercial communications

We do not send advertising or newsletters. Availability notices are only the ones you request, about the option you choose, and are never a condition for using the free service. If we ever offer commercial news, we will ask for separate, unticked and revocable consent.

5. Retention

• Sign-in links and email-change requests: links expire after 15 minutes; their records are deleted automatically 24 hours after the request.
• Sessions: expire after 30 days of inactivity or 90 days from sign-in and are then deleted; sessions you end are deleted 24 hours later.
• Account, validations, reports and credits: while you keep your account.
• If you delete your account: we immediately erase your email (replaced by a placeholder with no data), your sessions, sign-in links and notices. The configurations, results and reports of your validations are deleted automatically within hours (the task runs every hour; 72 hours at most). For 12 months we keep a minimal record of the deleted account (internal identifier, dates and the version of the Terms accepted), of its validations (dates and status) and of its credit movements, with no email and no validation content, to keep credits consistent and handle possible incidents; it is then erased for good.
• Free-trial identifier: 12 months from when the trial is granted, even if you delete your account earlier, and then deleted automatically. Deleting your account immediately breaks its link to the account.
• Notices without an account: unconfirmed requests are deleted after 7 days; confirmed ones when you withdraw them or, at the latest, 12 months after you confirmed them.
• Notices with an account: until you withdraw them from your account or delete it. The evidence of each request and withdrawal (date, notice and version of the text shown) is kept with the audit records.
• Audit records (pseudonymised identifiers, no clear-text email or IP): 24 months, then deleted automatically.
• Server technical logs (access, errors, background tasks and infrastructure; may include IP addresses, never passwords, tokens or cookies): 30 days, then deleted automatically.
• Backups: taken every night. Copies on the server are deleted after 30 days (the most recent one is always kept) and off-site copies after 90 days. Data you erase may remain in earlier copies until they expire; they are used only to recover the service after an incident and, if one had to be restored, we would re-apply the erasures already made. One-off copies taken before technical changes are deleted after 90 days.

6. Recipients and processors

We do not sell or share your data. Only providers that deliver technical services to the controller access it:

• OVH SAS (France), processor: hosting of the server, database, reports and on-server backups, in the European Union.
• Cloudflare, Inc. (USA), processor: DNS, delivery network and protection (all web traffic passes through Cloudflare, which processes IPs and technical request data), storage of off-site backups in R2 (located in the EU, encrypted at rest) and forwarding of emails sent to @flawline.io addresses (Email Routing).
• Resend (Plus Five Five, Inc., USA), processor: sending of service emails (sign-in links, notices and notifications). Emails are sent from infrastructure in the European Union (Ireland), but Resend stores sending data in the United States.
• The controller's email provider: receives and keeps in the controller's mailbox the messages you send to @flawline.io addresses.

7. International transfers

OVH processes data in the European Union. Cloudflare and Resend are companies based in the United States: Resend stores sending data there and both may access data from outside the European Economic Area. According to their public documentation, both are certified under the EU-U.S. Data Privacy Framework (European Commission adequacy decision of 10 July 2023), and their data processing agreements also include the Commission's standard contractual clauses (Decision 2021/914), which apply if that certification ceases to be valid.

The controller's email provider may process the messages you send us outside the EEA. You can ask for information on the safeguards for any transfer by writing to privacy@flawline.io.

8. Your rights

You can exercise your rights of access, rectification, erasure, objection, restriction and portability, and withdraw consent at any time:

• Delete your account: from the Account page, without writing to us.
• Withdraw notices: from the Account page or with the link in the confirmation and in every notice.
• Any other right: email privacy@flawline.io from your account address. To prevent impersonation we may ask you to confirm the request from a link sent to that address. We answer within one month, extendable where the GDPR allows.
• If you believe we have not respected your rights, you can complain to the Spanish Data Protection Agency (www.aepd.es) or your local supervisory authority.

9. Source of data and automated decisions

You provide the data or it is generated when you use the service. Market data comes from public sources and contains no personal data. FLAWLINE makes no decisions with legal effects about you based solely on automated processing: verdicts concern strategy configurations, not people.

10. Security

We apply reasonable technical and organisational measures: encryption in transit (HTTPS), one-time passwordless sign-in links, protected cookies, keyed hashes instead of clear identifiers, owner-only access control, usage limits and daily backups (off-site copies encrypted at rest). No system is completely invulnerable; if a breach affecting you occurred, we would act as the GDPR requires.

11. Minors and changes

The service is intended for people aged 18 or over. If we change this policy we will publish the new version with its date and, for material changes, tell you.