Privacy Policy
Working draft, written from common templates in Brazil. It must be reviewed by a lawyer before it is opened to the public.
1. Who is the controller
The data controller is BackIQ. Contact, including for privacy matters: [email protected].
2. What data we process, why, and on what legal basis
- Sign-up data (e-mail, display name, optional username, password in hashed form, Google account identifier if you sign in with it): to create and maintain the account. Basis: performance of the contract.
- Content you create (backtests, strategies, metrics, indicators, notes, drawings, preferences and time zone): for the service to work. Basis: performance of the contract.
- Security and devices (browser and system, part of the IP address, access dates, login attempts): to protect the account, limit abuse and show the list of connected devices. Basis: legitimate interest and fraud prevention.
- Welcome questionnaire (how long you have been trading, what you trade most and what you want from BackIQ; optional, you can skip it): so we can get to know our audience and improve the product. Basis: legitimate interest.
- Payment (plan, status and subscription identifier at the processor): to charge and unlock the plan. Card data stays only with the payment processor. Basis: performance of the contract and legal obligation (tax).
- Conversations with the AI assistant (the messages you write to the BackIQ AI and its answers, when this feature is available): to answer you and to train and improve the AI. Basis: legitimate interest and, where required, your consent (you can object, see section 7).
- Service e-mails (confirmation, password recovery, billing and change notices): Basis: performance of the contract.
- Access logs of the application (Brazilian Internet Civil Framework, art. 15): kept for the legal period of 6 months.
3. AI training
The conversations you have with the AI assistant of BackIQ (what you write in them and what the AI answers) may be used to train and improve the AI. This applies only to the content of those conversations: your backtests, strategies, notes and journal are not used to train the AI, unless you paste or share them inside a conversation with it. So, do not write in the conversations passwords, card data, personal documents or any information you do not want to be used. We try to remove personal data before using content for training. You can object to the use of your conversations for training at any time by e-mail at [email protected] (and, when available, through the option in Account settings); the conversations are then used only to answer you.
3.1. What we do not do
We do not sell personal data, we do not use advertising trackers or third-party pixels, and we do not store your password (only an irreversible cryptographic hash).
4. Cookies and browser storage
We use only what is essential: a session cookie (to keep you signed in, HttpOnly) and a temporary cookie during Google sign-in. In the browser’s local storage we keep preferences (language, theme, sidebar state). There are no advertising or third-party analytics cookies; that is why we do not show a consent banner. If that changes, we will ask for your consent first.
5. Who we share data with
Only with the operators needed for the service: the hosting provider (StayCloud), Cloudflare (network, security and e-mail receiving), Resend (e-mail sending), Stripe (payments), the AI model provider (Anthropic, when you use the assistant) and, if you use it, Google (sign-in). They process the data only to provide the service to us. Data may be transferred internationally to servers outside Brazil, with the safeguards provided for in the LGPD. We may also share data under a legal or court order.
6. How long we keep data
- Active account: as long as it exists.
- Deleted backtests: 30 days in the trash, then erased.
- Reset account: compressed backup copy for up to 90 days.
- Deleted account: access ends immediately and data is erased within 30 days (backup copy for up to 90 days).
- Tax data and access logs: for the legal periods.
7. Your rights (LGPD, art. 18)
You can request: confirmation of processing, access, correction, anonymization or erasure, portability, information about sharing, withdrawal of consent and review of automated decisions. You can do part of this yourself in Account settings (edit profile, change password, see and disconnect devices, restore or delete backtests, reset or delete the account). For the rest, write to [email protected]; we reply within 15 days. You can also complain to the Brazilian National Data Protection Authority (ANPD).
8. Security
We adopt measures such as hashed passwords, revocable sessions, login attempt limits, encrypted connections (HTTPS), security headers, data isolation between accounts and backups. No system is 100% secure; in case of a relevant incident, we will notify you and the ANPD as required by law.
9. Children and teenagers
The service is for people over 18. We do not knowingly collect data from minors; if we learn of a minor’s account, we will close it.
10. Changes
When this policy changes in a relevant way, we will notify you and update the version at the top of the page.