Privacy Policy

GapperLab ("we," "us," or "our") is committed to protecting your privacy. This Privacy Policy explains what information we collect, how we use it, and what choices you have regarding your data when you use the GapperLab platform ("the Platform").

By using the Platform, you agree to the collection and use of information in accordance with this policy.

Data controller: the operator of GapperLab, identified in our Legal Notice, is the data controller responsible for your personal data. For any data protection request, contact info@gapperlab.com.

Account information: When you register, we collect your name, email address, and a hashed version of your password. We never store passwords in plain text.

Platform usage data: We collect data you create while using the Platform, including strategy configurations, backtest parameters, and backtest results. This data is stored to provide you with access to your work across sessions.

Technical data: We may collect basic technical information such as IP address, browser type, and operating system to ensure the security and proper functioning of the Platform.

Communication data: If you contact us by email, we retain the content of that communication to respond to your inquiry.

We use the information we collect to:

• Provide, operate, and maintain the Platform and your account.
• Process and fulfill your subscription, including billing and plan management.
• Respond to support requests and communications.
• Monitor and analyze usage patterns to improve the Platform's performance and features.
• Detect, prevent, and address security issues or abuse.
• Send essential service communications, such as account confirmations and billing notifications.

We do not use your strategy data or backtest results for any purpose other than providing you with the service.

Legal bases for processing (GDPR Art. 6): we rely on the following legal bases:

• Performance of a contract (Art. 6(1)(b)): creating and maintaining your account, running backtests, and processing your subscription.
• Legal obligation (Art. 6(1)(c)): keeping billing and accounting records that we are legally required to retain.
• Legitimate interests (Art. 6(1)(f)): keeping the Platform secure, preventing fraud and abuse, monitoring for technical errors, and improving our features.

We do not sell your personal data, and we never share your strategy data or backtest results with anyone. If you consent to analytics and advertising cookies, Google receives browsing data from our site and may use it to show you our ads elsewhere. That is the only advertising-related sharing that happens, it never includes your strategies, and it does not happen at all unless you accept.

We rely on the following trusted service providers (processors), strictly to operate the Platform:

• Stripe — subscription billing and payment processing (we never store full card details).
• A cloud hosting and database provider located in the European Union (Germany).
• Google — sign-in with Google, only when you choose to use it to log in or register.
• Sentry — error monitoring to detect and fix technical faults.
• Email delivery provider — transactional emails (account confirmation, billing notices).

International transfers: some of these providers (Stripe, Google, Sentry) may process data on servers located in the United States. Where that happens, the transfer is covered by appropriate safeguards such as the European Commission's Standard Contractual Clauses and/or the EU-US Data Privacy Framework.

We may disclose information if required to do so by law, court order, or governmental authority, or to protect the rights, property, or safety of GapperLab, our users, or the public.

Your account data and platform content are stored on servers located in the European Union (Germany). We implement industry-standard security measures including encrypted connections (TLS/HTTPS), hashed password storage (bcrypt), and access controls to protect your information against unauthorized access. Certain processors (see Section 4) may process limited data outside the EU under appropriate safeguards.

While we take reasonable steps to protect your data, no method of transmission over the internet or electronic storage is 100% secure. We cannot guarantee absolute security.

To keep you logged in, we use JSON Web Tokens (JWT) stored in your browser's local storage, which expire automatically. These are strictly necessary for the service to work and are not used for tracking.

We also use analytics and advertising cookies, and we ask for your consent before they are set. We use Google Analytics 4, including Google Signals and remarketing, which lets us measure how the site is used and reach people who have visited it. Until you accept, these are blocked and no analytics or advertising cookies are written. You can change your choice at any time from our Cookie Policy.

Some third-party services set their own cookies only when you actively use them: Google (if you choose to sign in with Google) and Stripe (during checkout).

We retain your account data and platform content for as long as your account is active. If you delete your account, we will permanently delete your personal data and platform content within 30 days, except where retention is required by law.

Anonymized, aggregated data that cannot be linked back to any individual may be retained indefinitely for analytical purposes.

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Rectification: Request correction of inaccurate or incomplete data.
• Erasure: Request deletion of your personal data (right to be forgotten).
• Portability: Request your data in a structured, machine-readable format.
• Objection: Object to the processing of your data in certain circumstances.
• Restriction: Request that we limit the processing of your data.

To exercise any of these rights, contact us at info@gapperlab.com. We will respond within 30 days.

Right to complain: if you believe we have not handled your data correctly, you have the right to lodge a complaint with a data protection supervisory authority. In Spain this is the Agencia Española de Protección de Datos (AEPD), www.aepd.es.

The Platform is not directed to individuals under the age of 18. We do not knowingly collect personal information from minors. If we become aware that we have inadvertently collected data from a person under 18, we will delete that information promptly.

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top of this page. For significant changes, we will notify registered users via email or an in-app notice. Your continued use of the Platform after changes are posted constitutes your acceptance of the updated policy.

If you have questions, concerns, or requests regarding this Privacy Policy or how we handle your data, please contact us at info@gapperlab.com.