1. Who we are

The controller of your personal data is Damian Michalski ("we", "us"). Contact: contact@bitcoininsightsframework.com.

Purchases are processed by Gumroad, Inc., acting as the merchant of record. Gumroad is an independent controller of the data it collects during checkout (name, email, country, payment and VAT data) - see Gumroad's privacy policy for details.

2. What data we process, why, and on what legal basis

a) Account and license data - your email address, license key, and device identifier - to activate and verify your access, prevent license abuse, and provide support. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
b) Portfolio and simulator data - the parameters you save in My Portfolio (risk profile, capital, BTC holdings, lending and futures allocations, notes) and simulator settings - to provide the product's features, including using this data as context for the AI Assistant. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
c) AI Assistant conversations - the messages you send to the Assistant, together with your saved portfolio data, are transmitted to our AI provider (see section 4) to generate responses. We do not store your conversation content on our servers. Your conversation history is stored only locally in your browser (localStorage) and you can delete it at any time using the "Reset conversation" button or by clearing your browser data. We store only a per-license message counter (number of messages used). Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
d) Analytics data – events describing how the site is used (pages visited, features used, approximate message length – never message content), collected via PostHog (EU cloud).
- Before you make a choice or if you decline: we use a cookieless mode that counts unique visitors with a privacy-preserving hash and does not set analytics cookies or enable session recording.
- Only if you accept analytics: we enable cookies/local storage, fuller event tracking, and (where applicable) session recording.
Legal basis: consent (Art. 6(1)(a) GDPR) for the full analytics mode. You can withdraw or change your choice at any time via Cookie Settings.
e) Technical logs - IP addresses and request logs processed by our infrastructure providers for security, abuse prevention, and rate limiting. Legal basis: legitimate interest (Art. 6(1)(f) GDPR) in keeping the service secure.
f) Marketing and newsletter data - if you subscribe via a form on our site, your email address and the tag identifying which page you subscribed from - to send you analysis and product updates. Subscription uses double opt-in: you confirm your address before receiving anything. Legal basis: consent (Art. 6(1)(a) GDPR). You can withdraw consent at any time via the unsubscribe link in every email.

3. What we do NOT do

We do not sell your data. We do not use your portfolio data or conversations for advertising. Your conversations and portfolio data are used solely to provide the service described above. Our AI provider does not use API data to train its models (see section 4).

4. Recipients of your data (processors and providers)

Supabase (database and backend functions) - data hosted in the EU (West EU, Ireland).
xAI (Grok API) - processes your Assistant messages and portfolio context to generate responses. xAI is a US-based provider; transfers are safeguarded by the EU Standard Contractual Clauses incorporated in xAI's Data Processing Addendum. Per xAI's current API terms, API inputs and outputs are retained for up to 30 days for abuse monitoring and are not used to train xAI's models.
PostHog (analytics) - EU cloud region, activated only after your consent.
Gumroad (payments) - independent merchant of record, see section 1.
EmailOctopus (email marketing) - processes your email address to deliver our newsletter and product updates. EmailOctopus operates on infrastructure that includes servers outside the EEA; transfers are safeguarded by Standard Contractual Clauses under its Data Processing Agreement.
Hosting/infrastructure providers for the website.

5. International transfers

Account, portfolio, and analytics data are stored in the European Economic Area. Transfers outside the EEA are: the processing of AI Assistant requests by xAI in the United States, and the processing of newsletter subscriptions by EmailOctopus - both safeguarded by Standard Contractual Clauses (Art. 46(2)(c) GDPR).

6. How long we keep data

Account, license, and portfolio data: for as long as we provide the service (access is lifetime), and after an account deletion request - up to 12 months to the extent necessary to handle disputes and claims, then deleted.
Message counter: as above.
Conversation content: not stored by us (browser-only; xAI retains API data up to 30 days per section 4).
Analytics data: retained for as long as necessary for the purposes described in section 2(d), subject to the retention terms of our analytics provider's plan.
Newsletter subscription data: kept until you unsubscribe or withdraw consent, after which your email is removed from our active marketing list.
Technical logs: up to 90 days.

7. Your rights

You have the right to access, rectify, delete, or receive a copy of your data, restrict or object to processing, and withdraw consent (for analytics) at any time. To exercise these rights, email contact@bitcoininsightsframework.com. We respond within one month. You also have the right to lodge a complaint with a supervisory authority - in Poland, the President of the Personal Data Protection Office (UODO).

8. Cookies and local storage

We use:

(a) Essential local storage — license key, activation token, browser-based activation identifier, your locally stored conversation history — required for the service to function, no consent needed.
(b) Analytics (PostHog) — the script loads for everyone. Cookies and fuller tracking are activated only after you accept analytics in the cookie banner. If you decline, only a limited cookieless mode is used (no analytics cookies, no session recording). You can change your choice at any time via Cookie Settings.

9. Automated processing

The AI Assistant generates responses automatically based on your messages and saved portfolio data. It provides general market analysis based on the Framework's published logic; it does not make decisions producing legal or similarly significant effects concerning you (Art. 22 GDPR).

10. Children

The Service is intended for adults. It is not directed at children, and we do not knowingly process the personal data of anyone under 18 years of age. If you believe a minor has provided us with personal data, please contact us and we will delete it.

11. Changes

We may update this policy as the service evolves. Material changes will be announced on the website. The current version is always available at this address.

Privacy Policy