Privacy Policy

Who is responsible

BasisPoint (basispointbot.com) is the controller of the personal data described here. Contact: admin@basispointbot.com. A registered company will take over as controller; when it does, we will name it here and tell account holders by email. This policy follows the EU General Data Protection Regulation (GDPR).

What we collect

• Your email address and a securely hashed password (or your Google sign-in, if you use it).
• What you enter in the blueprint, and a history of your changes to it.
• If you use the contact form: your email address, the topic and your message, and our replies. They are kept as long as we need them to help you and follow up, and you can ask us to delete them.
• If we host your bot: the bot's settings and its simulated trading records and history, stored on a server we run in Germany. They are yours and are used only to run your bot.
• If you use Playbot: your practice game (points on a made-up market) and any feedback you send about it.
• Security records: sign-ins (and failed attempts), account changes and data exports, with a scrambled fingerprint of your IP address rather than the address itself. They help us spot attacks on accounts.
• If you turn on two-factor sign-in: the setup of your authenticator app (held by Supabase).
• If you joined through someone's invite link: who invited you. They see only a count of people who joined, never who. There are no rewards for invites.
• Standard technical data our host records when any page is loaded (such as IP address, browser and time), used to deliver the site and keep it secure.
• If you book a call: the name, email, time zone and times you give us, what you would like to know, and notes from the call. We use them only to arrange and hold the call and to follow up about BasisPoint.
• Your email choices: whether you want follow-up emails and whether you asked for news and offers, and which follow-up emails we sent you.
• Anonymous page counts: for public pages only, how many times each page was opened per day, the name of the site a visit came from (or a campaign tag in the link), and whether the screen was a phone, tablet or computer. This can't identify you: no IP address, no cookie, nothing stored on your device, and it isn't linked to your account. Browsers that ask not to be tracked aren't counted.
• Anything you send us by email.

This website never asks for brokerage credentials, account numbers or payment card details. If you connect your own broker, its API key is entered only inside your bot, kept there encrypted and used only to place your bot's orders; for a bot we host, that means on our server, inside your bot's own encrypted storage, and it is deleted with your bot. Your signed real-money agreement (your name, the date and the wording) and your limits are kept in your bot as a record. There is no advertising, no tracking across sites and no analytics cookies. We count page views anonymously, without cookies (see above).

Why we use it, and on what legal basis

• To provide what you asked for - your account, understanding and building the tool you want, answering your messages, hosting your bot if you choose that, and contacting you about it (GDPR Art. 6(1)(b): performing our agreement with you).
• To keep the service and your account secure - security records, rate limits and the password breach check (Art. 6(1)(f): our legitimate interest in protecting accounts and the service).
• To arrange and hold a call you booked, and to follow up about BasisPoint afterwards (Art. 6(1)(b): steps you asked for before a possible agreement).
• Follow-up emails about the account you made - a few short emails while you set up, and reminders about your blueprint or price (Art. 6(1)(f): our legitimate interest in helping you finish what you started). Every email has a link to stop them, and you can switch them off on Account & security.
• News and offers - only if you tick "News and offers" (Art. 6(1)(a): your consent, which you can withdraw any time on Account & security or through the link in any email).
• Anonymous page counts - to see which pages help people and where visits come from (Art. 6(1)(f): legitimate interest; the counts contain no personal data).
• To meet legal obligations, such as accounting records once you have bought something (Art. 6(1)(c)).

We don't sell your data, don't use it for advertising, and don't make automated decisions about you that have legal or similar effects. What you tell us about your strategy is never passed to our own trading software.

Password breach check

When you choose a password, we check it against known data breaches using the Have I Been Pwned service. Only the first 5 characters of a scrambled (hashed) version are sent - never the password itself, and never your email address.

Who processes it for us

• Supabase - database and sign-in, hosted in the EU (Frankfurt, Germany).
• Google Workspace - our email, including the account emails sent from admin@basispointbot.com.
• Netlify - hosts and delivers the website.
• GitHub - runs our scheduled jobs (sending replies to contact-form messages, health checks) and keeps encrypted backups of our database for 14 days.
• netcup - the German hosting company whose server runs our own bot and, if you choose hosting, yours.
• Google - only if you choose to sign in with Google.
• Our sales partner - an independent contractor in the United States who holds the calls people book. He works on our behalf under a written agreement, sees only what is needed for the call (the booking details and his own call notes), and keeps it in our systems. This transfer relies on the European Commission's standard contractual clauses in that agreement.

They process data only on our instructions and under data-processing terms. Google and Netlify may process data in the United States; such transfers rely on the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.

Cookies

Sign-in uses essential cookies only. Your browser keeps them for 30 days if you tick "Keep me signed in", and otherwise only until you close it. Because they are strictly necessary, no cookie banner is needed.

How long we keep it

• Your account, requests, blueprint and Playbot game: for as long as you keep your account.
• Your hosted bot's settings and records: while we host it, and for a short time after so you can take a copy.
• When you delete your account, they are deleted. Security records are kept only as long as needed to protect accounts and investigate abuse, and lose your email address when the account is deleted, so they can no longer be linked to you by name.
• Emails: for as long as needed to answer you and follow up.
• Call requests and call notes: deleted 24 months after the last contact, or sooner if you ask.
• Email choices and the list of follow-up emails sent: while the account exists.
• Anonymous page counts: kept as daily totals; they contain no personal data.
• Encrypted backups of our database: 14 days.
• Accounting records for what you buy: for the period Bulgarian law requires.

Your rights

You can ask to see, correct, export or delete your data, to restrict how we use it, or object to uses based on our legitimate interests. You can download your data and delete your account yourself under Account & security in your dashboard, or write to admin@basispointbot.com; we answer within one month. You can also complain to a data protection authority - in Bulgaria, the Commission for Personal Data Protection (cpdp.bg) - or the one where you live.

Children

BasisPoint is not meant for anyone under 18, and we don't knowingly collect their data.

Changes

The date at the top shows the latest version. We will email account holders before an important change takes effect.

Contact

admin@basispointbot.com