Privacy Policy

1. Data controller

The controller of your personal data is 2MANYOPTIONS S.L.U. (NIF B93930667), registered address Calle Marbella 1, 1º, 28034 Madrid (Spain), contact [email protected]. We have not designated a DPO (the LOPDGDD art. 34 thresholds are not met). We are established in the EU (Spain), so a GDPR art. 27 EU representative is not required.

2. Data we collect

• Account email and name, and authentication metadata (via Supabase).
• Subscription and billing state and events. Card data is handled by Stripe and never stored by us.
• Support correspondence sent to our role addresses.
• Security and server logs (via Cloudflare).
• Cookieless, aggregate analytics (via Plausible).

3. Recipients / processors and other controllers

We engage the recipients below. Each processor acts only on our instructions under a data processing agreement (GDPR Article 28 DPA). Stripe acts as an independent / joint controller for payments and fraud prevention (its own PCI/AML obligations), not merely as our processor — see Stripe's own privacy policy.

• Stripe Payments Europe — independent/joint controller (payments, fraud prevention, PCI/AML obligations) + processor for the act of taking payment on our instruction. Billing & fraud prevention. Transfer basis: EU-US DPF (Stripe certified) + SCCs/TIA fallback.
• Supabase — processor. Authentication & application database (email, profile, saved entries, billing events). Transfer basis: EU — no transfer for hosting (Ireland).
• Cloudflare — processor. CDN, DNS, WAF / rate limiting, security telemetry. Transfer basis: EU-US DPF (Cloudflare certified) + SCCs/TIA fallback.
• Plausible Analytics — processor. Cookieless, EU-hosted aggregate analytics. Transfer basis: EU — no transfer.
• Hetzner Online GmbH — processor. Server hosting / compute. Transfer basis: EU — no transfer.
• Cloudflare R2 — processor. Object storage (market-data parquets, backups). Transfer basis: EU-US DPF + SCCs/TIA fallback.
• Google Ireland Limited (Google Workspace) — processor. Email delivery & support correspondence (personal data). Transfer basis: EU-US DPF (Google LLC certified) + SCCs/TIA fallback.
• AC PM LLC (Postmark) — processor. Transactional email delivery (account and service emails). Transfer basis: EU-US DPF (AC PM LLC certified) + SCCs.

4. Legal bases (per purpose)

• Service delivery and authentication — Art. 6(1)(b) (performance of a contract).
• Billing and invoice retention — Art. 6(1)(c) (legal obligation; LGT art. 66, Código de Comercio art. 30).
• Security, abuse prevention, rate limiting, aggregate analytics, and fraud prevention — Art. 6(1)(f) (legitimate interest in operating a secure, sustainable service; we performed a balancing test, Recital 47).
• Consent — Art. 6(1)(a) — only where an actual consent purpose exists (e.g. a future newsletter); we do not rely on a vague placeholder consent.

5. International transfers

Some recipients are in the United States. For DPF-certified recipients (Stripe, Cloudflare, Google, Postmark) we rely on the EU-US Data Privacy Framework (DPF); otherwise on Standard Contractual Clauses (SCCs) plus a transfer impact assessment. You can request a copy of the safeguards at [email protected] (art. 13(1)(f)).

6. Retention

Account data: deleted/anonymised within 6 months after account closure. Billing records: retained per Spanish law — LGT art. 66 (4 years, tax) and Código de Comercio art. 30 (6 years, accounting).

7. Your rights

You have the rights of access, rectification, erasure, restriction, portability, and objection, the right to withdraw consent at any time (Art. 7(3)) without affecting prior processing, and rights regarding automated decision-making and profiling (Art. 22). We do not make automated decisions producing legal or similarly significant effects on you; Stripe may run automated fraud checks (Radar) as part of payment processing — if any such decision would significantly affect you, the art. 13(2)(f) information applies. You may lodge a complaint with Agencia Española de Protección de Datos (AEPD).

8. Analytics

We use Plausible, which is cookieless and stores nothing in your browser. IP address and user-agent are processed transiently to produce aggregate, non-identifying counts and are not retained in identifiable form. (An IP address is personal data while it is processed — CJEU C-582/14, Breyer.) See our Cookie Policy.

9. Security and changes

We apply appropriate technical and organisational measures. Material changes to this policy update the effective date above. Contact: [email protected].