Privacy Policy | RunOpti

1. Data Controller

RunOpti is the data controller responsible for your personal data. For privacy-related inquiries, contact us at [email protected].

2. Information We Collect

We collect information you provide directly:

Account information (email, name)
Payment information (processed securely by Stripe — we do not store card details)
Strategy optimization results, parameters, and settings
Usage data and self-hosted analytics (no third-party tracking)
Contact form messages

3. Legal Basis for Processing

We process your data based on:

Contract performance: To provide the optimization service you signed up for
Legitimate interest: To improve our service, prevent fraud, and ensure security
Consent: For optional marketing communications (you can opt out at any time)
Legal obligation: To comply with applicable laws and regulations

4. How We Use Your Information

Provide and improve the Service
Process payments and send receipts via Stripe
Send transactional emails (verification, optimization results, password reset)
Analyze usage to improve performance (self-hosted analytics)
Respond to support requests and contact form messages

5. Data Retention

Account data: Retained while your account is active. After deletion, personal data is permanently removed within 30 days.
Optimization data: Free plan data retained for 7 days; Pro/Enterprise retained while account is active.
Payment records: Retained by Stripe per their data retention policy.
Audit logs: Retained for 90 days for security purposes.
Authentication tokens: Automatically cleaned up after expiration.

6. International Data Transfers

Your data may be transferred to and processed in countries outside your country of residence. Payment data is processed by Stripe, Inc. (United States) under their Privacy Policy. We ensure appropriate safeguards are in place for international transfers.

7. Third-Party Services

Stripe: Payment processing — processes card details directly, we only store subscription IDs.
Resend: Transactional email delivery.
Umami: Self-hosted, privacy-focused analytics — no personal data shared with third parties.

8. Data Security

We implement industry-standard security measures to protect your data, including encryption in transit (TLS), hashed passwords (bcrypt), HTTP-only secure cookies, and CSRF protection. Your TradingView credentials are never stored on our servers.

9. Your Rights

Under applicable data protection laws (including GDPR), you have the right to:

Access: Request a copy of your personal data
Rectification: Request correction of inaccurate data
Erasure: Request deletion of your data (via account settings)
Data portability: Export your data in a machine-readable format
Restriction: Request restriction of processing in certain circumstances
Objection: Object to processing based on legitimate interest
Withdraw consent: Withdraw consent at any time for consent-based processing

To exercise these rights, visit your account settings or contact [email protected].

10. Supervisory Authority

If you believe your data protection rights have been violated, you have the right to lodge a complaint with your local data protection supervisory authority.

11. Contact

For privacy-related inquiries, contact us at [email protected]