Last updated: [date].
1. Who is responsible. The operator of L.WIN named on our Legal information page ("we") is the controller of your personal data. Contact: lwin.app.team@gmail.com.
2. Data you give us. Your email address, a securely hashed password, your country of residence, and the data you save in the Service: watchlist, sector labels, analysis settings, portfolio, trading journal and monthly entries.
3. Data we collect for security. When you sign up and sign in, we record the date and time, your IP address, your approximate country derived from it, your browser and operating system type, your time zone, and a random device identifier stored in your browser. We use this to keep accounts secure and to detect account sharing and repeated trial accounts.
4. Usage data. When you run an analysis, we record the time, the stock symbol, the AI model used, token counts and the estimated cost. We use this to improve the Service and plan pricing.
5. Payment data. Payments are handled by [payment provider] as merchant of record. We do not receive or store your card number. We receive your subscription status, payment dates and amounts.
6. What we never collect. Your Finnhub and Claude API keys stay in your browser and never reach our servers. Requests to Finnhub, Anthropic and TradingView go directly from your browser to those providers, under their own privacy policies. We only record whether a key is connected (yes or no), never the key itself. We do not store the text of your AI reports.
7. Why we use your data (legal bases). To provide the Service and your subscription (performance of a contract). To keep the Service secure and prevent abuse (legitimate interests). To understand how the Service is used and plan pricing (legitimate interests). To keep tax and accounting records (legal obligation). To send service emails such as email verification, beta and billing notices (performance of a contract).
8. Account codes on pages. Some subscriber pages, and images you choose to share, show a short code linked to your account, to discourage redistribution. The code does not reveal your email address.
9. Who we share data with. Our hosting and database provider [name], our email delivery provider [name], and [payment provider]. They process data only on our instructions. We do not sell your data and we do not use advertising trackers.
10. International transfers. Your data may be stored and processed in countries other than the one where you live. When we transfer data between countries, we use the safeguards required by applicable data protection laws.
11. How long we keep data. Account data: while your account exists. Your saved data (watchlist, journal, settings): deleted 40 days after your trial or subscription ends, unless you subscribe again. Security logs: [90 days]. Usage data: [24 months]. Payment records: as long as tax law requires, in anonymized form after account deletion.
12. Your rights. Depending on the data protection laws that apply to you, you can access, correct, export or delete your data, and object to or restrict certain processing. You can export your data from Settings and delete your account from the Account page. For other requests, email lwin.app.team@gmail.com. You may also have the right to complain to the data protection authority in your country.
13. Cookies and local storage. We use your browser's storage only for essential functions: keeping you signed in, remembering your theme, storing your API keys on your device, and a random device identifier used for account security. We do not use advertising or analytics cookies.
14. Children. The Service is not for anyone under 18. We do not knowingly collect data from children.
15. Changes. We will notify you of material changes to this policy by email or on the Service.