1. Who we are

The controller of your personal data is Damian Michalski ("we", "us"). Contact: contact@bitcoininsightsframework.com.

Purchases are processed by Gumroad, Inc., acting as the merchant of record. Gumroad is an independent controller of the data it collects during checkout (name, email, country, payment and VAT data) - see Gumroad's privacy policy for details.

2. What data we process, why, and on what legal basis

a) Account and license data - your email address, license key, and device identifier - to activate and verify your access, prevent license abuse, and provide support. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
b) Portfolio and simulator data - the parameters you save in My Portfolio (risk profile, capital, BTC holdings, lending and futures allocations, notes) and simulator settings - to provide the product's features, including using this data as context for the AI Assistant. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
c) AI Assistant conversations - the messages you send to the Assistant, together with your saved portfolio data, are transmitted to our AI provider (see section 4) to generate responses. We do not store your conversation content on our servers. Your conversation history is stored only locally in your browser (localStorage) and you can delete it at any time using the "Reset conversation" button or by clearing your browser data. We store only a per-license message counter (number of messages used). Legal basis: performance of a contract (Art. 6(1)(b) GDPR).
d) Usage analytics - events describing how the site is used (pages visited, features used, message length as a number - never message content), collected via PostHog after you consent. Legal basis: consent (Art. 6(1)(a) GDPR), which you can withdraw at any time via the cookie settings.
e) Technical logs - IP addresses and request logs processed by our infrastructure providers for security, abuse prevention, and rate limiting. Legal basis: legitimate interest (Art. 6(1)(f) GDPR) in keeping the service secure.

3. What we do NOT do

We do not sell your data. We do not use your portfolio data or conversations for advertising. Your conversations and portfolio data are used solely to provide the service described above. Our AI provider does not use API data to train its models (see section 4).

4. Recipients of your data (processors and providers)

Supabase (database and backend functions) - data hosted in the EU (West EU, Ireland).
xAI (Grok API) - processes your Assistant messages and portfolio context to generate responses. xAI is a US-based provider; transfers are safeguarded by the EU Standard Contractual Clauses incorporated in xAI's Data Processing Addendum. Per xAI's current API terms, API inputs and outputs are retained for up to 30 days for abuse monitoring and are not used to train xAI's models.
PostHog (analytics) - EU cloud region, activated only after your consent.
Gumroad (payments) - independent merchant of record, see section 1.
Hosting/infrastructure providers for the website.

5. International transfers

Account, portfolio, and analytics data are stored in the European Economic Area. The only transfer outside the EEA is the processing of AI Assistant requests by xAI in the United States, safeguarded by Standard Contractual Clauses (Art. 46(2)(c) GDPR).

6. How long we keep data

Account, license, and portfolio data: for as long as we provide the service (access is lifetime), and after an account deletion request - up to 12 months to the extent necessary to handle disputes and claims, then deleted.
Message counter: as above.
Conversation content: not stored by us (browser-only; xAI retains API data up to 30 days per section 4).
Analytics data: retained for as long as necessary for the purposes described in section 2(d), subject to the retention terms of our analytics provider's plan.
Technical logs: up to 90 days.

7. Your rights

You have the right to access, rectify, delete, or receive a copy of your data, restrict or object to processing, and withdraw consent (for analytics) at any time. To exercise these rights, email contact@bitcoininsightsframework.com. We respond within one month. You also have the right to lodge a complaint with a supervisory authority - in Poland, the President of the Personal Data Protection Office (UODO).

8. Cookies and local storage

We use: (a) essential local storage (license key, activation token, browser-based activation identifier, your locally stored conversation history) - required for the service to function, no consent needed; (b) analytics cookies/storage (PostHog) - set only after you accept them in the cookie banner. You can change your choice at any time via the "Cookie settings" link in the site footer.

9. Automated processing

The AI Assistant generates responses automatically based on your messages and saved portfolio data. It provides general market analysis based on the Framework's published logic; it does not make decisions producing legal or similarly significant effects concerning you (Art. 22 GDPR).

10. Children

The Service is intended for adults. It is not directed at children, and we do not knowingly process the personal data of anyone under 18 years of age. If you believe a minor has provided us with personal data, please contact us and we will delete it.

11. Changes

We may update this policy as the service evolves. Material changes will be announced on the website. The current version is always available at this address.

Privacy Policy