Privacy Policy

Profitable ("we", "our", "us") is committed to protecting your personal data and respecting your privacy in accordance with the General Data Protection Regulation (GDPR) and applicable data protection laws. This Privacy Policy explains how we collect, use, store, and protect your information when you use our Service.

The data controller responsible for your personal data is Profitable. You can contact us at: support@profitable-journal.com

We collect the following categories of data:

• Account data: Your name, email address, and profile photo — provided automatically via Google OAuth when you sign in. We do not have access to your Google password.
• Trading data: Trade records (asset, P&L, date, side, risk, notes, tags, compliance status) that you enter manually or import via CSV file. CSV files are parsed server-side and immediately discarded — only the extracted trade data is persisted.
• Trading plan & preferences: Rules, parameters, and calendar display preferences you configure in the application.
• Billing data: Payment processing is handled entirely by Stripe. We store only your Stripe Customer ID (a non-sensitive reference token). We never see, store, or process your credit card number or banking details.
• Usage data: Session tokens (for authentication) and cookie preferences stored in your browser. We do not use analytics tracking cookies.

We do not collect: payment card numbers, bank account details, trading account credentials, or any sensitive financial information beyond the trade data you explicitly enter.

We process your personal data on the following legal bases:

• Contract performance: To provide the Service you subscribed to.
• Legitimate interest: To improve and secure the Service.
• Consent: For optional cookies and analytics (where applicable).
• Legal obligation: To comply with applicable laws and regulations.

• To authenticate you and maintain your account.
• To provide, operate, and improve the Service.
• To process payments and manage subscriptions via Stripe.
• To analyze trade data against your trading rules using AI.
• To respond to support requests.
• To comply with legal obligations.

We never sell your personal data to third parties. We never use your trading data for advertising purposes.

We use the following third-party service providers ("sub-processors") who may access or process personal data on our behalf. Each is bound by data processing agreements compliant with applicable privacy law.

We do not sell your data to any third party, and we do not use it for advertising purposes.

We use the following types of cookies:

• Essential cookies: Required for authentication, session management, and secure access to the Service. These cannot be disabled.
• Analytics cookies: Used to understand how the Service is used and improve it. Only set with your consent.
• Payment cookies: Set by Stripe to process payments securely.

You can manage your cookie preferences through the consent banner displayed on your first visit.

We retain your personal data for as long as your account is active or as needed to provide the Service.

Right to erasure (right to be forgotten): You can delete your account and all associated data at any time directly within the application:

1. Go to Account Settings from the sidebar.
2. Scroll to the Danger Zone section.
3. Click Delete Account and confirm.

This immediately and permanently deletes all your trades, trading rules, preferences, and your authentication account. This action is irreversible.

We may retain billing records (invoices, payment references) for up to 7 years where required by tax and accounting law. These records do not contain trading data.

If you are located in the European Economic Area, you have the following rights:

• Right of access: Request a copy of the personal data we hold about you.
• Right to rectification: Request correction of inaccurate data.
• Right to erasure: Request deletion of your personal data ("right to be forgotten").
• Right to restrict processing: Request that we limit how we use your data.
• Right to data portability: Request your data in a structured, machine-readable format.
• Right to object: Object to processing based on legitimate interest.
• Right to withdraw consent: Withdraw consent at any time where processing is based on consent.

To exercise any of these rights, contact us at: support@profitable-journal.com. We will respond within 30 days.

We implement industry-standard security measures including AES-256-CBC encryption for sensitive credentials, TLS/HTTPS for all data in transit, and role-based access controls. No method of transmission over the Internet is 100% secure, and we cannot guarantee absolute security.

The Service is not directed to individuals under the age of 18. We do not knowingly collect personal data from children. If you believe we have inadvertently collected data from a child, please contact us immediately.

We may update this Privacy Policy from time to time. We will notify you of material changes via email or a notice on the Service. Your continued use of the Service after such changes constitutes acceptance of the updated policy.

For privacy inquiries or to exercise your rights: support@profitable-journal.com