This policy explains which personal data we process, and why, when you visit inbestplanners.com or inbestplanners.es without an account, when you subscribe to the weekly newsletter and when you register and take out a plan: what we collect, on what legal basis, how long we keep it, who we share it with and how you can exercise your rights.
1. Data Controller
We are not required to appoint a Data Protection Officer (Art. 37 GDPR), but we have a data protection contact point: for any question about your personal data, write to the email address above.
2. What Data We Collect
2.1 Data You Provide to Us
| Data | When | Required |
|---|---|---|
| Email address | Registration | Yes |
| Password | Registration | Yes, unless you sign in with Google (we store only a bcrypt hash, never the password) |
| Selected universes | Account configuration | No |
| Alert preferences | Notification settings | No |
| Securities recorded in your portfolio or watchlist (security identifier, direction and date of the entry) | Use of the portfolio tracking tool | No |
| League participation: public alias, selected signals and their outcomes | Voluntary activation of the League | No |
| Email address and language, without an account | Subscribing to the weekly newsletter on the site | No |
| Reason for cancelling and optional comment (free text) | Cancelling the subscription on the site | No |
| Username (also your public alias if you take part in the League) | Profile settings | No |
| Preferred language | Registration, or changing the language on the site | No |
| Two-factor authentication: the one-time-code secret (encrypted) and the backup codes (stored as hashes) | If you turn on two-factor authentication | No |
| Alerts you set up (security, alert type and target price or score) | When you create an alert | No |
| Favourites, saved screener searches, saved comparisons and saved articles | When you save them | No |
| The emails you send us (questions, exercise of rights) and whatever you include in them | When you write to us | No |
2.2 Payment Data
| Data | When | Who manages it |
|---|---|---|
| Credit/debit card details | Subscription | Stripe (not us) |
| Payment history | Subscription | Stripe + us (amount, date, status) |
| Name (or company name, if you buy as a business), billing address and country, for the invoice and the VAT calculation | Payment in Stripe Checkout | Stripe; they appear on your invoices |
| Free-trial anti-abuse registry: keyed hash (a pseudonym that cannot be reversed without the key) of your normalised email address and of your card's fingerprint | When you start a free trial | Us (neither the email address nor the card number is stored in clear; Stripe provides the fingerprint) |
| Tax identification number (NIF or VAT number), only if you enter it | Payment in Stripe Checkout (optional) | Stripe; it appears on your invoices |
Important: We do not store card numbers or CVV. This data is processed exclusively by Stripe under PCI-DSS standards.
2.3 Usage Data
| Data | Purpose |
|---|---|
| IP addresses | Security, fraud prevention |
| Requests to the server (address requested and outcome), in the technical logs | Security and error diagnosis |
| Features you use in your account | Providing the contracted service. Usage analytics and ad measurement, only with your consent (Google Analytics, Google Ads and the Meta pixel, see section 9) |
| Date and time of access; on your account, the date of your last sign-in and of your last use (recorded at most once a day) | Security, logs and the retention period of unused accounts (section 5) |
| Browser type and device | Compatibility |
| Push notification subscription | Delivering browser push notifications |
| Counters of failed sign-in attempts (a hash of your email address and the IP) and of failed two-factor checks (your account) | Security: temporarily blocking repeated attempts |
| Where your sign-up came from: the utm parameters of the address you arrived on in the visit in which you register (source, medium, campaign, ad and term), the site you came from (its domain only) and the first page you saw (without parameters) | Knowing, in aggregate, which campaigns and channels bring us sign-ups (section 3) |
2.4 External Authentication Data (OAuth)
If you register or sign in with Google, Google gives us:
| Data | Use |
|---|---|
| Google ID | Link account |
| Your Google account's email address | Identification |
We do not access your Google password or any other data of your Google account. Google LLC processes the sign-in as an independent controller (section 6).
2.5 Data We Do NOT Collect
- Personal financial data other than what you choose to record in the portfolio tracking tool: we do not collect information about your wealth, income, positions held outside the Platform, or statements from your accounts or brokers. Securities you record in your portfolio or watchlist are processed in accordance with sections 2.1, 3 and 4.
- Health data
- Biometric data
- Data about ethnic origin, religion, or sexual orientation
- Precise geolocation data
2.6 Market Data Sources
Stock market data displayed on the Platform (prices, historical data, technical indicators, and fundamental metrics) is obtained from third-party market data providers that aggregate publicly available financial information. This data is processed by our automated algorithms to generate analyses, signals, and scores. We do not collect or process personal data through these market data sources.
3. How We Use Your Data
Create and manage your account
Data: Email address, password hash, username, language and, if you turn it on, two-factor authentication
Legal basis: Performance of the contract
Provide the contracted service
Data: Selected universes, alerts and their preferences, favourites, saved searches, comparisons and articles, push notification subscription and the features you use
Legal basis: Performance of the contract
Process payments
Data: Payment data (via Stripe)
Legal basis: Performance of the contract
Show you prices and charge you in the currency of the country you visit from (pounds in the United Kingdom, dollars in the Americas, reals in Brazil, euros elsewhere)
Data: The country inferred from your IP at that moment, with a database held on our own server (DB-IP); the IP is not stored for this or sent to anyone
Legal basis: Performance of the contract and pre-contractual steps
Send transactional emails
Data: Email address, language
Legal basis: Performance of the contract
Send investment alerts
Data: Alerts set up and their preferences; email address or push notification subscription
Legal basis: Performance of the contract
Detect and fix technical failures of the website and the API
Data: Technical error data (browser, page without its parameters, stack trace) and a 10% sample of performance measurements, without account data (Sentry does not store the IP); and the server's technical logs
Legal basis: Legitimate interest
Check that whoever submits the sign-up, newsletter or password-reset form is a person
Data: IP and technical browser signals during the check (Cloudflare Turnstile), only when those forms are used
Legal basis: Legitimate interest
Prevent fraud and abuse
Data: IP, technical logs and counters of failed sign-in attempts
Legal basis: Legitimate interest
Comply with legal obligations
Data: Billing and tax data, and whatever a court or competent authority requires from us
Legal basis: Legal obligation
Show you the securities you follow and the signals affecting them
Data: Securities recorded in your portfolio or watchlist
Legal basis: Performance of the contract
Manage your participation in the League and display your public profile to other users
Data: Public alias, selected signals and their outcomes
Legal basis: Consent
Send the weekly newsletter to readers who subscribe without an account
Data: Email address, language
Legal basis: Consent
Prevent repeated free trials (clause 7.1 of the Terms and Conditions)
Data: Keyed hash (pseudonym) of the normalised email address and of the card fingerprint
Legal basis: Legitimate interest
Keep, blocked, the evidence of your consents after account deletion
Data: Document acceptances (document, version, date, IP, browser) and the request for the service to start immediately
Legal basis: Legal obligation
Keep evidence of the emails sent, including mandatory communications
Data: Recipient, email type, subject, date, outcome of the send and, if it failed, the error
Legal basis: Legitimate interest
Understand why subscriptions are cancelled
Data: Reason and comment given when cancelling
Legal basis: Legitimate interest
Send subscribers the service's weekly summaries
Data: Email address, language, email preferences
Legal basis: Performance of the contract
Process your withdrawal and, where due, its refund
Data: Email address, contract, date of the request and amounts
Legal basis: Legal obligation
Record your cookie choice so that we can show what you chose and when
Data: Choice, date, IP address and browser
Legal basis: Legal obligation
Tell you once, after 24 hours, that your sign-up was not completed: that the unpaid account will be deleted after 48 hours and how to complete it
Data: Email address, language
Legal basis: Pre-contractual steps at your request (Art. 6(1)(b) GDPR)
Measure how the website is used (Google Analytics), only if you accept analytics cookies
Data: Pages visited, referring site, device and browser, approximate location (country and city), a pseudonymous identifier stored in the _ga cookie and the steps of signing up (registration and its method, going to payment, start of the trial or purchase) with the plan, its price and the Stripe payment session identifier, which only we can relate to your account. Never your email address or your user id. Google Signals and ad personalisation are turned off; the sign-up steps reach Google Ads only if you also accept ad measurement (next row)
Legal basis: Consent (Art. 6(1)(a) GDPR), which you can withdraw at any time from Cookie settings
Measure which of our ads on Google, Instagram and Facebook bring sign-ups (Google Ads and the Meta pixel), only if you accept ad measurement
Data: Google Ads: the identifier of the click on the ad, stored in the _gcl cookies. Meta pixel: a pseudonymous identifier stored in the _fbp and _fbc cookies (the latter with the click identifier if you arrive from a Meta ad), the pages you visit, the referring site, your browser and device, and your IP address, which Meta receives with every request. For both, whether that visit ends in a sign-up, the step to payment, the start of a trial or a purchase, with the plan and its price. Never your email address, your name or your user id. We do not use it to show you personalised ads or to build audience or remarketing lists; Meta also processes its pixel data for its own purposes, as an independent controller (section 6)
Legal basis: Consent (Art. 6(1)(a) GDPR), which you can withdraw at any time from Cookie settings
Knowing which campaigns and channels bring us sign-ups, counted in aggregate
Data: The utm parameters of the address you arrived on in the visit in which you register, the domain of the site you came from and the first page you saw, stored on your account. We use no measurement or advertising cookie for it: the browser keeps it in memory during that visit only (if you sign up with Google, it travels in the address that brings you back to our site), and we do not share it with advertising platforms
Legal basis: Legitimate interest (Art. 6(1)(f) GDPR): deciding which advertising to invest in without tracking you across sites. You can object by writing to us (section 8) and we delete it from your account
Answer the emails you send us and your requests to exercise your rights
Data: Email address and content of the message
Legal basis: Legitimate interest (answering you); legal obligation when you exercise your rights (Art. 12 GDPR) and to keep business correspondence (art. 30 of the Spanish Commercial Code)
| Purpose | Data used | Legal basis |
|---|---|---|
| Create and manage your account | Email address, password hash, username, language and, if you turn it on, two-factor authentication | Performance of the contract |
| Provide the contracted service | Selected universes, alerts and their preferences, favourites, saved searches, comparisons and articles, push notification subscription and the features you use | Performance of the contract |
| Process payments | Payment data (via Stripe) | Performance of the contract |
| Show you prices and charge you in the currency of the country you visit from (pounds in the United Kingdom, dollars in the Americas, reals in Brazil, euros elsewhere) | The country inferred from your IP at that moment, with a database held on our own server (DB-IP); the IP is not stored for this or sent to anyone | Performance of the contract and pre-contractual steps |
| Send transactional emails | Email address, language | Performance of the contract |
| Send investment alerts | Alerts set up and their preferences; email address or push notification subscription | Performance of the contract |
| Detect and fix technical failures of the website and the API | Technical error data (browser, page without its parameters, stack trace) and a 10% sample of performance measurements, without account data (Sentry does not store the IP); and the server's technical logs | Legitimate interest |
| Check that whoever submits the sign-up, newsletter or password-reset form is a person | IP and technical browser signals during the check (Cloudflare Turnstile), only when those forms are used | Legitimate interest |
| Prevent fraud and abuse | IP, technical logs and counters of failed sign-in attempts | Legitimate interest |
| Comply with legal obligations | Billing and tax data, and whatever a court or competent authority requires from us | Legal obligation |
| Show you the securities you follow and the signals affecting them | Securities recorded in your portfolio or watchlist | Performance of the contract |
| Manage your participation in the League and display your public profile to other users | Public alias, selected signals and their outcomes | Consent |
| Send the weekly newsletter to readers who subscribe without an account | Email address, language | Consent |
| Prevent repeated free trials (clause 7.1 of the Terms and Conditions) | Keyed hash (pseudonym) of the normalised email address and of the card fingerprint | Legitimate interest |
| Keep, blocked, the evidence of your consents after account deletion | Document acceptances (document, version, date, IP, browser) and the request for the service to start immediately | Legal obligation |
| Keep evidence of the emails sent, including mandatory communications | Recipient, email type, subject, date, outcome of the send and, if it failed, the error | Legitimate interest |
| Understand why subscriptions are cancelled | Reason and comment given when cancelling | Legitimate interest |
| Send subscribers the service's weekly summaries | Email address, language, email preferences | Performance of the contract |
| Process your withdrawal and, where due, its refund | Email address, contract, date of the request and amounts | Legal obligation |
| Record your cookie choice so that we can show what you chose and when | Choice, date, IP address and browser | Legal obligation |
| Tell you once, after 24 hours, that your sign-up was not completed: that the unpaid account will be deleted after 48 hours and how to complete it | Email address, language | Pre-contractual steps at your request (Art. 6(1)(b) GDPR) |
| Measure how the website is used (Google Analytics), only if you accept analytics cookies | Pages visited, referring site, device and browser, approximate location (country and city), a pseudonymous identifier stored in the _ga cookie and the steps of signing up (registration and its method, going to payment, start of the trial or purchase) with the plan, its price and the Stripe payment session identifier, which only we can relate to your account. Never your email address or your user id. Google Signals and ad personalisation are turned off; the sign-up steps reach Google Ads only if you also accept ad measurement (next row) | Consent (Art. 6(1)(a) GDPR), which you can withdraw at any time from Cookie settings |
| Measure which of our ads on Google, Instagram and Facebook bring sign-ups (Google Ads and the Meta pixel), only if you accept ad measurement | Google Ads: the identifier of the click on the ad, stored in the _gcl cookies. Meta pixel: a pseudonymous identifier stored in the _fbp and _fbc cookies (the latter with the click identifier if you arrive from a Meta ad), the pages you visit, the referring site, your browser and device, and your IP address, which Meta receives with every request. For both, whether that visit ends in a sign-up, the step to payment, the start of a trial or a purchase, with the plan and its price. Never your email address, your name or your user id. We do not use it to show you personalised ads or to build audience or remarketing lists; Meta also processes its pixel data for its own purposes, as an independent controller (section 6) | Consent (Art. 6(1)(a) GDPR), which you can withdraw at any time from Cookie settings |
| Knowing which campaigns and channels bring us sign-ups, counted in aggregate | The utm parameters of the address you arrived on in the visit in which you register, the domain of the site you came from and the first page you saw, stored on your account. We use no measurement or advertising cookie for it: the browser keeps it in memory during that visit only (if you sign up with Google, it travels in the address that brings you back to our site), and we do not share it with advertising platforms | Legitimate interest (Art. 6(1)(f) GDPR): deciding which advertising to invest in without tracking you across sites. You can object by writing to us (section 8) and we delete it from your account |
| Answer the emails you send us and your requests to exercise your rights | Email address and content of the message | Legitimate interest (answering you); legal obligation when you exercise your rights (Art. 12 GDPR) and to keep business correspondence (art. 30 of the Spanish Commercial Code) |
3.1 Communications You Will Receive
Transactional
Examples: Registration confirmation, password reset, invoices
Opt out: No (essential)
Service
Examples: Service changes, maintenance, security
Opt out: No (essential)
Investment alerts
Examples: The alerts you set up on the Alerts page (price, signal, new entries in the rankings or new high-conviction signals), by push notification or email
Opt out: Yes, on the Alerts page or in Settings > Notifications
Weekly newsletter (without an account)
Examples: The signals drawn at random that week
Opt out: Yes, with one click in every newsletter
Weekly service summaries (subscribers)
Examples: The weekly signals digest and, if you take part in the League, its weekly ranking. They are part of the contracted service and are sent unless you unsubscribe
Opt out: Yes, with one click in every email or in Settings > Notifications
Notice of an unfinished sign-up
Examples: A single informative email, after 24 hours, if you started a sign-up and did not complete the payment: it tells you the unpaid account will be deleted after 48 hours and how to complete it
Opt out: No (it is a one-off notice about your own sign-up)
| Type | Examples | Can you opt out? |
|---|---|---|
| Transactional | Registration confirmation, password reset, invoices | No (essential) |
| Service | Service changes, maintenance, security | No (essential) |
| Investment alerts | The alerts you set up on the Alerts page (price, signal, new entries in the rankings or new high-conviction signals), by push notification or email | Yes, on the Alerts page or in Settings > Notifications |
| Weekly newsletter (without an account) | The signals drawn at random that week | Yes, with one click in every newsletter |
| Weekly service summaries (subscribers) | The weekly signals digest and, if you take part in the League, its weekly ranking. They are part of the contracted service and are sent unless you unsubscribe | Yes, with one click in every email or in Settings > Notifications |
| Notice of an unfinished sign-up | A single informative email, after 24 hours, if you started a sign-up and did not complete the payment: it tells you the unpaid account will be deleted after 48 hours and how to complete it | No (it is a one-off notice about your own sign-up) |
Service emails and notices are managed in Settings > Notifications and on the Alerts page; the newsletter, with the unsubscribe link in every issue.
4. Legal Basis for Processing
We process your data on the basis of:
| Legal basis | When it applies |
|---|---|
| Performance of the contract (Art. 6(1)(b) GDPR) | Creating and managing your account and providing the contracted service: the portfolio and watchlist, alerts, favourites, saved searches, comparisons and articles, and push notifications; processing payments; sending transactional emails and the service's weekly summaries. As a pre-contractual step at your request, the one-off notice of an unfinished sign-up |
| Consent (Art. 6(1)(a) GDPR) | League participation and publication of your participant profile: you can withdraw at any time with "Leave the League", on the League page; withdrawal deletes the public profile and does not affect the rest of the service. Weekly newsletter for readers without an account: you confirm it from the email we send you and withdraw it with one click in any newsletter, which deletes your address. Google Analytics, only if you accept analytics cookies: you withdraw it in Cookie settings |
| Legitimate interest (Art. 6(1)(f) GDPR) | Security and prevention of fraud and abuse (technical logs, sign-in attempt counters); detecting and fixing technical errors (Sentry); the bot check on the forms (Turnstile); the anti-abuse registry that prevents repeating the free trial (clause 7.1 of the Terms and Conditions); keeping the email send log for 5 years so that the communications sent can be proved; the cancellation reason, to understand why subscriptions are cancelled; answering the emails you send us; and where each sign-up came from (which campaign or channel brought it), to decide which advertising to invest in. We have assessed that these interests are necessary, proportionate and do not override your rights (Art. 6(1)(f) balancing test documented internally) |
| Legal obligation (Art. 6(1)(c) GDPR) | Keeping invoices and tax and accounting records (Art. 30 of the Spanish Commercial Code and tax law); processing your withdrawal and, where due, its refund; recording your cookie choice so that it can be proved (Art. 7(1) GDPR); keeping the evidence of your consents blocked after account deletion (Art. 32 LOPDGDD) for the limitation period of civil actions (Art. 1964 of the Spanish Civil Code); handling the exercise of your rights (Art. 12 GDPR) and requests from courts and authorities |
4.1 Consent
When the legal basis is consent:
- We will ask for it clearly and separately.
- You can withdraw it at any time without retroactive effect.
- Withdrawal does not affect the lawfulness of prior processing.
5. How Long We Keep Your Data
| Data | Retention period |
|---|---|
| Account data | While you have a contract in force and while you use the account. If you cancel your subscription, or a trial before its first charge, the account is kept without a plan, with its data, until you delete it or until 24 months pass without you using it (neither signing in nor visiting with your session open). In that case we email you 30 days beforehand, giving the date; signing in before that date is enough to keep it. Otherwise it is deleted as if you had deleted it yourself (clause 17 of the Terms and Conditions). An account whose sign-up is never completed follows the "Sign-ups started and never completed" row |
| Data after account deletion | Deleted immediately when you delete the account; there is no recovery period. Only the records described in the consents, free-trial anti-abuse registry, withdrawal requests, email send log and invoices rows are kept. The encrypted backups hold the deleted data until they rotate out, within about 12 months ("Backups" row) |
| Invoices and tax and accounting records | 6 years from the last entry (Art. 30 of the Spanish Commercial Code; tax law requires at least 4). They are kept complete and identifiable, because their purpose requires it; they are not anonymised until the period expires |
| Payment data in Stripe | Customer record and invoices: 6 years from the last entry, which for the customer record is its last invoice (Art. 30 of the Spanish Commercial Code), also if you delete your account. On deletion we cancel the subscription and mark the record as closed, but do not erase it, because the law requires the invoices to be kept (Art. 17(3)(b) GDPR). If the account never paid there are no invoices to keep: when it is purged or deleted we also erase its customer record at Stripe. Card data is held by Stripe under its own policy |
| Security logs | Rotated by volume and overwritten as new ones come in: the API's take at most about 170 MB (its two log files, 60 MB each, and 50 MB of its container's output) and each of the other services', 50 MB. Those of the scheduled jobs are rotated weekly, or on reaching 10 MB, and the last 12 are kept |
| Consents | While the account is active. On deletion, the evidence of your consents (your acceptances of the Terms and Conditions and the Privacy Policy, with document, version, date, IP and browser, and your request for the service to start immediately) is kept blocked (Art. 32 LOPDGDD) for 5 years, the limitation period of civil actions (Art. 1964 of the Spanish Civil Code), used only to defend claims or to handle a withdrawal request, and then destroyed. The cookie choices recorded while signed in are deleted with the account; those of visitors without an account have their own row below |
| Newsletter subscription | While you stay subscribed; unsubscribing deletes the address. A request not confirmed within 7 days is deleted |
| Free-trial anti-abuse registry | 24 months from your last trial. Kept even if you delete your account, then purged automatically |
| Withdrawal requests | 5 years from the last step of the request (the refund, or the refund deadline if that is later), the limitation period of civil actions (Art. 1964 of the Spanish Civil Code). Kept also after account deletion, then deleted automatically |
| Email send log | 5 years from each send (the limitation period of civil actions, Art. 1964 of the Spanish Civil Code), kept also after account deletion, then deleted automatically |
| Backups | Encrypted off-site copies rotated 30 daily, 8 weekly and 12 monthly. Deleted data disappears from every copy within about 12 months |
| Sign-ups started and never completed | An account whose sign-up is not completed at Stripe, either by a payment or by starting the trial with a card, is deleted after 48 hours, together with its customer record at Stripe, with no consent evidence blocked; only the entries of the emails sent to it remain, in the email send log |
| Cookie choices of visitors without an account | 24 months from the last change of the choice, so that we can show what you chose and when (the record holds the choice, its date, the IP address and the browser), then deleted automatically |
| Website usage data (Google Analytics) | 14 months from collection, then deleted by Google; the _ga cookies expire after 13 months or as soon as you withdraw consent. Google Analytics does not store your IP address |
| Technical errors (Sentry) | Sentry keeps them for at most 90 days and then deletes them |
| Bot check (Turnstile) | We keep nothing of the check itself: our server receives a single-use code, checks it with Cloudflare together with your IP and discards it; the request remains only in the technical logs ("Security logs" row). Cloudflare processes the IP and browser signals to run the check, under its Turnstile privacy addendum, and its __cf_bm cookie lasts 30 minutes |
| Counters of failed sign-in attempts | 24 hours from the last failed attempt; then they delete themselves |
| Emails you send us | In the mailbox, 6 years from the date of each email, together with our reply: it is business correspondence, which art. 30 of the Spanish Commercial Code requires us to keep for that period. They are then deleted automatically, except those that must be kept longer because of a claim or proceedings in progress, and only for as long as these last |
| Ad measurement data (Google Ads and Meta) | The _gcl, _fbp and _fbc cookies expire after 90 days or as soon as you withdraw consent. Google and Meta keep conversion data under their own privacy policies |
When data is no longer needed, we delete it or irreversibly anonymise it; deleted data remains in the encrypted backups until they rotate out.
6. Who We Share Your Data With
6.1 Service Providers (Data Processors)
These providers process data on our behalf to provide the service:
Stripe Payments Europe, Ltd. (with Stripe, Inc. as sub-processor)
Service: Payment processing
Data shared: Email address, name, billing address and country, NIF or VAT number if you enter it, and payment data
Location: Ireland (EU); access from the USA with DPF safeguards
IONOS SE
Service: Sending emails (transactional, summaries and the newsletter) and the mailbox where we receive the ones you send us
Data shared: Email address and content of the emails
Location: Germany (EU)
Hetzner Online GmbH
Service: Application and database hosting
Data shared: All account, portfolio and usage data; IP and technical logs
Location: Germany (EU)
Functional Software, Inc. (Sentry)
Service: Technical error logging for the website and the API
Data shared: Technical error data (browser, page without its parameters, stack trace) and a 10% sample of performance measurements; it does not store the IP and receives no account data
Location: EU (Frankfurt, Germany); US company, see section 7
Cloudflare, Inc.
Service: Bot check (Turnstile) on the sign-up, newsletter and password-reset forms. It also runs the DNS of our domains, without the site's traffic going through Cloudflare
Data shared: IP and technical browser signals during the check
Location: USA (with DPF safeguards)
Cloudflare, Inc. (R2)
Service: Off-site backup copies of the database
Data shared: A full copy of the database (all account, portfolio and usage data), encrypted with age on our server before it is sent; the decryption key is kept offline and Cloudflare cannot read it
Location: EU (R2's European jurisdiction); US company, see section 7
Google Ireland Limited (Google Analytics)
Service: Measurement of website use, only with your consent to analytics cookies
Data shared: Pseudonymous identifier, pages visited, device, approximate location and the steps of signing up with the plan, its price and the payment session identifier; never your email address or your user id. With Google Signals and ad personalisation turned off and without storing the IP. If you accept ad measurement, the property shares those sign-up steps with Google Ads (see the note on Google Ads)
Location: Ireland (EU); access from the USA with DPF safeguards
| Provider | Service | Data shared | Location |
|---|---|---|---|
| Stripe Payments Europe, Ltd. (with Stripe, Inc. as sub-processor) | Payment processing | Email address, name, billing address and country, NIF or VAT number if you enter it, and payment data | Ireland (EU); access from the USA with DPF safeguards |
| IONOS SE | Sending emails (transactional, summaries and the newsletter) and the mailbox where we receive the ones you send us | Email address and content of the emails | Germany (EU) |
| Hetzner Online GmbH | Application and database hosting | All account, portfolio and usage data; IP and technical logs | Germany (EU) |
| Functional Software, Inc. (Sentry) | Technical error logging for the website and the API | Technical error data (browser, page without its parameters, stack trace) and a 10% sample of performance measurements; it does not store the IP and receives no account data | EU (Frankfurt, Germany); US company, see section 7 |
| Cloudflare, Inc. | Bot check (Turnstile) on the sign-up, newsletter and password-reset forms. It also runs the DNS of our domains, without the site's traffic going through Cloudflare | IP and technical browser signals during the check | USA (with DPF safeguards) |
| Cloudflare, Inc. (R2) | Off-site backup copies of the database | A full copy of the database (all account, portfolio and usage data), encrypted with age on our server before it is sent; the decryption key is kept offline and Cloudflare cannot read it | EU (R2's European jurisdiction); US company, see section 7 |
| Google Ireland Limited (Google Analytics) | Measurement of website use, only with your consent to analytics cookies | Pseudonymous identifier, pages visited, device, approximate location and the steps of signing up with the plan, its price and the payment session identifier; never your email address or your user id. With Google Signals and ad personalisation turned off and without storing the IP. If you accept ad measurement, the property shares those sign-up steps with Google Ads (see the note on Google Ads) | Ireland (EU); access from the USA with DPF safeguards |
Every processor in the table:
- Processes the data only on our behalf and on our instructions, under the data processing agreement required by Art. 28 GDPR (each provider's data processing terms).
- Offers adequate data protection safeguards.
- Accesses only the data necessary for its function.
Sign in with Google: if you choose to register or sign in with Google, Google LLC (USA) is not our processor: it processes your Google account data and the sign-in itself as an independent controller, under its own privacy policy, and it is certified under the Data Privacy Framework. We receive from Google only what section 2.4 lists.
Google Ads: only if you accept ad measurement, Google Ireland Limited (Ireland) receives the identifier of a click on one of our ads and whether that visit ended in a sign-up, a trial or a purchase, with the plan and its price (section 3). For ad measurement Google is not our processor: it processes that data as an independent controller, under the Google Ads controller-controller data protection terms and its own privacy policy. Its parent, Google LLC (USA), is certified under the Data Privacy Framework.
Meta pixel: only if you accept ad measurement, Meta Platforms Ireland Limited (Ireland) receives through its pixel the data listed in section 3. We are joint controllers with Meta for collecting that data on our site and transmitting it to Meta (Art. 26 GDPR), under the Controller Addendum to Meta's Business Tools Terms: we inform you and collect your consent, and you may exercise your rights with us or with Meta. Once received, Meta processes it as an independent controller, under its privacy policy, including for its own advertising purposes. Its parent, Meta Platforms, Inc. (USA), is certified under the Data Privacy Framework.
Browser push notifications: if you turn them on, each notice travels through the push service your browser uses (Google Firebase Cloud Messaging in Chrome, Mozilla in Firefox, Apple in Safari, Microsoft in Edge). That service receives your subscription identifier and the notice encrypted end to end, which it cannot read. Your browser chooses it, not us, and it may be located outside the EEA. You can turn notifications off at any time from Settings > Notifications or in your browser.
6.2 Third Parties We Do NOT Share Data With
We do not sell or rent your personal data, and we do not disclose it to third parties outside the cases in section 6.3.
6.3 Exceptions
We may disclose your data when:
- Required by law or judicial authority.
- Necessary to protect our legal rights.
- Necessary to protect user safety.
7. International Transfers
Several of our providers are US companies or have their parent company there, which can access the data from the USA even when it is hosted in the European Union; that is an international transfer outside the European Economic Area (EEA).
7.1 Safeguards
Each transfer outside the EEA relies on these mechanisms:
| Provider | Safeguard mechanism |
|---|---|
| Stripe | Data Privacy Framework (DPF) |
| Cloudflare | Data Privacy Framework (DPF). The R2 backups travel and are stored encrypted, and Cloudflare cannot read them |
| Functional Software (Sentry) | Data Privacy Framework (DPF) and standard contractual clauses, for access from the US to data hosted in the EU |
| Google (Google Analytics) | Data Privacy Framework (DPF) and standard contractual clauses |
| Google (Google Ads) | Data Privacy Framework (DPF); Google acts as an independent controller |
| Meta (Meta pixel) | Data Privacy Framework (DPF); once it receives the data, Meta acts as an independent controller |
The Data Privacy Framework is the adequacy mechanism recognised by the European Commission (Decision of 10 July 2023).
7.2 Copy of the Safeguards
You can ask us for a copy of the applicable safeguards by writing to admin@inbestplanners.com.
8. Your Rights
The GDPR grants you the following rights:
Access
Know what data we have about you
→ Email, or Settings > Profile > Export data
Rectification
Correct inaccurate data
→ Settings > Profile
Erasure
Delete your data ("right to be forgotten")
→ Settings > Profile > Delete account
Restriction
Restrict the use of your data
Portability
Receive all your personal data in a structured format (JSON), except credentials: the password hash, two-factor authentication secrets, push notification keys and one-time tokens
→ Settings > Profile > Export data, or email
Objection
Object to certain processing
→ Email; for service emails, Settings > Notifications or the unsubscribe link in each email
Withdraw consent
Revoke consents given
→ League: "Leave the League", on the League page. Google Analytics and ad measurement (Google Ads and Meta): Cookie settings (link in the footer) or Settings > Privacy. Newsletter: the unsubscribe link in every issue
Automated decisions
Not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you
→ We apply one: when a free trial starts we check automatically whether that email address or that card already had one (clause 7.1 of the Terms and Conditions). It is necessary to enter into the contract on its terms (Art. 22(2)(a) GDPR). If you are refused, you can ask for a person to review it, express your point of view and contest it by writing to admin@inbestplanners.com
| Right | What it means | How to exercise it |
|---|---|---|
| Access | Know what data we have about you | Email, or Settings > Profile > Export data |
| Rectification | Correct inaccurate data | Settings > Profile |
| Erasure | Delete your data ("right to be forgotten") | Settings > Profile > Delete account |
| Restriction | Restrict the use of your data | |
| Portability | Receive all your personal data in a structured format (JSON), except credentials: the password hash, two-factor authentication secrets, push notification keys and one-time tokens | Settings > Profile > Export data, or email |
| Objection | Object to certain processing | Email; for service emails, Settings > Notifications or the unsubscribe link in each email |
| Withdraw consent | Revoke consents given | League: "Leave the League", on the League page. Google Analytics and ad measurement (Google Ads and Meta): Cookie settings (link in the footer) or Settings > Privacy. Newsletter: the unsubscribe link in every issue |
| Automated decisions | Not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you | We apply one: when a free trial starts we check automatically whether that email address or that card already had one (clause 7.1 of the Terms and Conditions). It is necessary to enter into the contract on its terms (Art. 22(2)(a) GDPR). If you are refused, you can ask for a person to review it, express your point of view and contest it by writing to admin@inbestplanners.com |
8.1 How to Exercise Your Rights
Option 1 - From your account:
- Rectification: Settings > Profile
- Erasure: Settings > Profile > Delete account
- Withdraw consents: the League, with "Leave the League" on the League page; analytics and ad measurement cookies, in Cookie settings (footer) or Settings > Privacy; the newsletter, with the unsubscribe link in every issue
- Service emails and notices (summaries, alerts, push notifications): Settings > Notifications and the Alerts page
Option 2 - By email:
- Send an email to admin@inbestplanners.com
- Subject: "Data Protection - [right you wish to exercise]"
- Give the email address you registered or subscribed to the newsletter with
- We will respond within one month of receiving your request. That period may be extended by two further months where the complexity or number of requests so requires; we will inform you of the extension and its reasons within the first month (Art. 12(3) GDPR).
8.2 Complaint to Supervisory Authority
If you believe we have not properly addressed your rights, you can file a complaint with:
Spanish Data Protection Agency (AEPD)
C/ Jorge Juan, 6, 28001 Madrid, Spain
www.aepd.es
If you reside in another EU country, you may also contact your local supervisory authority.
10. Data Security
We apply technical and organisational measures to protect your data:
10.1 Technical Measures
| Measure | Description |
|---|---|
| Encryption in transit | HTTPS/TLS on all connections |
| Hashed passwords | bcrypt with salt; we never store the password |
| Secure tokens | JWT with expiration |
| Restricted access | Only authorised people access the data |
| Backups | Daily backups, encrypted with age before they leave the server and stored off-site (periods in section 5) |
10.2 Organisational Measures
- Data access only when strictly necessary.
- Periodic review of access and permissions.
- Ongoing awareness of data protection best practices.
10.3 Security Incidents
In case of a security breach affecting your data:
- We will notify the AEPD within 72 hours (if applicable).
- We will inform you if there is a high risk to your rights.
11. Children
InbestPlanners is not intended for anyone under 18 years of age.
We do not knowingly collect data from minors. If we detect that a minor has registered, we will delete their account and data.
If you are a parent or guardian and believe your child has provided data, write to admin@inbestplanners.com.
12. Changes to This Policy
We may update this Privacy Policy to reflect changes in our practices or in legislation.
| Type of change | How we will inform you |
|---|---|
| Minor (wording, clarifications) | Update on website |
| Significant (new uses, new third parties) | Email and website notice |
The "last updated" date at the top of this document indicates when it was last modified.
If you want to read an earlier version of this policy, ask for it by email at admin@inbestplanners.com and we will send it to you.
13. Contact Us
For any questions related to this Privacy Policy or the processing of your data:
admin@inbestplanners.com
Postal address
Juan José Cirera Ortiz
Calle Rioja 13, 1º C
41001 Seville, Spain
To exercise your rights, follow the procedure in section 8.1, which also gives the response times.