Privacy Policy

1. Scope and controller

This policy explains how Biased processes personal data for its website, accounts, memberships, Community, Knowledge Base, Trading Journal, support and launch communications. The legal controller details above must be completed before launch. Biased is intended for adults aged 18 or over.

2. Personal data collected

• Account: email address, Firebase user ID, chosen nickname, authentication provider, age/legal acceptance timestamps and versions.
• Membership and billing: tier, status, subscription identifiers and transaction/accounting records. Full card details must be handled by the selected payment provider and must not be stored by Biased.
• Service content: Community posts, follows, saved preferences, journal trades, notes and optional MT4/MT5 integration metadata.
• Communications: support/privacy requests, service messages, marketing preference and consent evidence.
• Technical/security: IP address and device/browser request data processed by hosting/authentication providers, timestamps, security events and audit records.
• Optional analytics: only after Analytics consent and only if an analytics provider is configured.

Biased does not intentionally request special-category/sensitive personal data. Users should not place such data in posts, journal notes or support requests.

3. Purposes and legal bases

• Provide accounts, membership features, requested integrations and support: performance of a contract or steps requested before a contract.
• Secure the service, prevent abuse, maintain minimal audit logs and defend legal claims: legitimate interests in service security and accountability.
• Billing, tax, accounting and mandatory records: compliance with legal obligations.
• Optional analytics and marketing technologies: consent; these remain off until consent is given.
• Marketing email: consent where required. Marketing is separate from necessary service communications and is never preselected.
• Age and legal acceptance evidence: legitimate interests and, where applicable, legal obligation.

4. Sharing, processors and international transfers

Biased uses service providers only for documented purposes. The current technical register includes Google Firebase/Google Cloud, TradingView, MetaApi, MarketAux, GoldAPI, Twelve Data and FRED, plus payment and email providers that remain unselected placeholders. Some providers may process data outside the EEA. Before commercial launch, Biased must verify processing locations, execute required data-processing agreements, document subprocessor terms, and use a valid transfer mechanism such as an adequacy decision or Standard Contractual Clauses where required. No statement in this policy claims a provider is GDPR-compliant without verification.

5. Retention

• Active account data: while the account/service contract remains active.
• Inactive accounts: reviewed after 24 months of inactivity, with notice where practical.
• Operational data after deletion: removed promptly; only records required for tax/accounting, fraud prevention, legal claims, or suppression of unwanted marketing are retained for the applicable period.
• Security logs: normally 12 months unless needed for an active investigation.
• Privacy requests: 3 years after completion.
• Marketing consent/suppression evidence: subscription duration plus 3 years after withdrawal.
• Support requests: 24 months after closure unless needed for a legal claim.
• Analytics: no more than 13 months if enabled.

These periods are configurable operational rules and require confirmation against the controller’s applicable legal obligations.

6. Your GDPR rights

Subject to applicable conditions, you may request access, correction, erasure, restriction, portability, or object to processing. You may withdraw consent at any time without affecting earlier lawful processing. Account users can export data, request correction, manage marketing preferences, change cookie choices, and request deletion from Account → Privacy. You may also contact [PRIVACY CONTACT EMAIL REQUIRED]. Identity verification may be required.

7. Complaints

You may complain to the data-protection authority in your EEA country of residence, workplace, or where an alleged infringement occurred. The controller’s lead/relevant supervisory authority must be identified here once the legal entity and establishment are confirmed: [RELEVANT SUPERVISORY AUTHORITY REQUIRED].

8. Cookies and tracking

Necessary browser storage supports authentication, security, age confirmation, membership state and consent choices. Optional analytics and marketing scripts must not load before the corresponding consent. Use Cookie Settings or read the Cookie Policy.

9. Security and automated processing

Biased uses Firebase Authentication rather than manually storing passwords, TLS in transit, provider-supported encryption at rest, role-based database rules, server-held secrets and restricted admin operations. Market research labels may be produced using automated market data, but Biased does not use personal data for solely automated decisions producing legal or similarly significant effects.

10. Changes

Material changes will update the version and effective date. Where a change requires renewed consent, prior optional consent will not be treated as consent to the new purpose.