ClariMarkets UG (haftungsbeschränkt)
Grethenweg 125, 60598 Frankfurt am Main
E-Mail: contact@glanwick.com
A statutory Data Protection Officer is not required under Art. 37 GDPR in conjunction with § 38 BDSG (UG with fewer than 20 persons permanently engaged in automated processing). Internal contact for data protection matters: the managing director, reachable at contact@glanwick.com.
The service is intended exclusively for persons aged 18 or older. At registration, users explicitly confirm their majority via a confirmation checkbox (Art. 8 GDPR in conjunction with § 3 of the Terms); no date of birth is collected. We do not knowingly process personal data of minors. If we become aware that an account belongs to a minor, it will be deleted without delay.
a) When visiting the website: Server log files (IP address, browser type, timestamp). Legal basis: Art. 6(1)(f) GDPR (legitimate interest in stability and security). If you open the admin area (/admin) without being authorized, we additionally store the IP address, the time of the first and of the last request of a day, the number of requests on that day, the requested path, the browser identifier (user agent) and, if you are signed in, the ID of your account. Purpose: protecting our systems and the data of our users against unauthorized access and pursuing such attempts. Legal basis: Art. 6(1)(f) GDPR; our legitimate interest is to detect and fend off unauthorized access attempts and to be able to pursue them under criminal and civil law. Retention: 90 days, after which the entries are deleted automatically; an entry needed as evidence in criminal or civil proceedings is kept until those proceedings are concluded. The data is accessible to administrators only. If we file a criminal complaint or assert claims, we transmit the relevant entries to the competent law enforcement authority, the competent court and lawyers we instruct. You may object to this processing at any time on grounds relating to your particular situation (Art. 21(1) GDPR); an email to contact@glanwick.com is enough. Entries we need to fend off an attack or for proceedings may be kept despite an objection (Art. 21(1), second sentence, GDPR).
b) For email registration (waitlist): Email address, consent status, source, IP address and timestamp as consent proof. Purpose: launch notification (double opt-in). Legal basis: Art. 6(1)(a) GDPR (consent). Retention: until withdrawal of consent or 12 months after registration without conversion to a registered account, whichever is earlier.
c) For account creation: Email address, encrypted (hashed) password, usage behavior within the platform. Purpose: contract fulfillment, platform operation. Legal basis: Art. 6(1)(b) GDPR. If you create your account by signing in with Google, no password is stored with us; details are set out in section 2e.
d) When withdrawing via the withdrawal function: Name, details identifying the contract (account email address or order number), the email address you provide for the confirmation of receipt, the part of the contract withdrawn, and the date and time of receipt. Purpose: receiving and processing the withdrawal declaration and issuing the statutory confirmation of receipt via the withdrawal function pursuant to § 356a BGB. Legal basis: Art. 6(1)(c) GDPR (legal obligation) together with Art. 6(1)(b) GDPR (unwinding of the contract). Retention: six years pursuant to § 257 HGB, as the declaration documents why a contract ended and a payment was refunded. The data is accessible to administrators only.
To further develop the platform (e.g. improving analytics features and AI models), we analyze usage data in anonymized form. Anonymization takes place before analysis: real names, email addresses, user IDs and other identifying attributes are removed or replaced with non-traceable values so that no link to a person can be established. Anonymized data is not personal data within the meaning of the GDPR (Recital 26).
The legal basis for the anonymization process itself is Art. 6(1)(f) GDPR (legitimate interest in improving and securing our services). No data is shared with third parties.
You can object to this analysis at any time with effect for the future (Art. 21 GDPR): via the toggle in Settings under "Privacy" or informally at contact@glanwick.com.
On our public pages we measure which sections are read and which buttons are used, how far visitors scroll, and how long a visit lasts. We record exclusively: a random key for the respective session, the page accessed, the type of event, the device category (mobile, tablet, desktop), and the internet host you arrived from. We store neither your IP address nor your browser identifier, neither screen dimensions nor language setting, and of the referrer only the host, never the full address including any search query. Nothing is stored on or read from your device for this purpose; the session key exists only in the memory of the browser tab. The legal basis is Art. 6(1)(f) GDPR; the data is deleted after 180 days.
In addition, our hosting provider (Lovable Labs AB, see section 6) counts visits to the public pages on our behalf and shows them to us as visitor analytics: visits, page views, origin, device category, and country. For this purpose our site transmits, per page view, exclusively: a random key for the respective session, the time, the path accessed without identifiers and without parameters (except campaign tags such as utm_source), the device category (mobile, tablet, or desktop; for mobile devices with the indication iOS or Android), the internet host you arrived from, and the two-letter country code derived from the IP address. The device category is derived from your browser identifier; the identifier itself, your language setting, and the full address including any parameters are removed before transmission. Nothing is stored on your device for this purpose; the session key exists only in the memory of the browser tab and expires on reload. This counting does not take place in the signed-in area. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in the reach measurement of our own service); the analysis reaches back up to 90 days.
To monitor the operation of our site and to see which content is being used at any given moment, we maintain a snapshot of ongoing sessions. We record exclusively: a random key for the respective session, the page pattern accessed without search queries or identifiers, the country derived from the IP address (the two-letter country code only, no region, city, or coordinates), the device category, the internet host you arrived from, and whether the session is signed in.
Your IP address is not stored, not even in truncated or hashed form; it serves solely to derive the country and is discarded thereafter. Nor do we store your user identifier: for signed-in sessions it is checked exclusively in order to honour a declared objection, and is not carried into the data set. Nothing is stored on or read from your device for this purpose — the session key exists only in the memory of the browser tab and expires on reload. Consent under Section 25 TDDDG is therefore not required.
The legal basis is Art. 6(1)(f) GDPR (legitimate interest in the secure operation and reach measurement of our own service). No behavioural profile is created: there is exactly one record per session, which is continuously overwritten and deleted no later than 30 minutes after the last contact. Signed-in users may object at any time with effect for the future (Art. 21 GDPR): via the toggle in Settings under "Privacy" or informally at contact@glanwick.com.
Within the signed-in application we record which areas are accessed, how long they are used, and at which point a session ends. We record exclusively: your account identifier (a random number assigned by us, not your name), a random key for the respective session, the page pattern accessed without search queries or identifiers, the type of event (such as "page viewed" or "import completed"), the time spent, and coarse categories and size classes. We do not record free text, notes, chat content, amounts, account balances, or credentials.
Nothing is stored on or read from your device for this purpose; the session key exists only in the memory of the browser tab and expires on reload. Consent under Section 25 TDDDG is therefore not required. The data is stored exclusively in our own infrastructure (Supabase, EU region), evaluated only in aggregated form, and automatically deleted after 180 days; it is likewise deleted when you delete your account.
The legal basis is Art. 6(1)(f) GDPR (legitimate interest in improving our product, in particular in identifying where users get stuck). You can object to this analysis at any time with effect for the future (Art. 21 GDPR): via the toggle in Settings under "Privacy" or informally at contact@glanwick.com. The objection is enforced on our servers; thereafter nothing further is recorded, and nothing changes about your access.
In addition to signing in with an email address and password, we offer sign-in with a Google account ("Continue with Google"). Using it is voluntary and equivalent: you can register and sign in with an email address and password instead at any time. As long as you do not click the button, no connection to Google is established; no content is loaded from Google and no data is transmitted to Google.
When you click the button, we redirect you to Google. In doing so, Google receives your IP address, technical information about your browser and device, and the information that a sign-in to GlanWick is intended; if you are signed in to your Google account, Google can associate the process with that account. Google acts as an independent controller for this processing. For users in the European Economic Area the provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; Google bases any transfer to Google LLC in the USA on the EU-US Data Privacy Framework and EU Standard Contractual Clauses. For details, see Google's privacy policy at policies.google.com/privacy.
After you confirm at Google, we receive your email address, the information whether Google has verified that address, a permanent identifier for your Google account, and the basic profile information stored there (display name and, where available, the address of your profile picture). We receive neither your Google password nor access to your emails, contacts, files or any other Google services. We store this information in our user management system; it serves solely to create your account, to recognise you on subsequent sign-ins, and to communicate with you about your account.
The legal basis is Art. 6(1)(b) GDPR (creating and operating your account at your request), supplemented by Art. 6(1)(f) GDPR (legitimate interest in a secure and user-friendly sign-in procedure). Technically, the sign-in is handled through our infrastructure partner Lovable Labs AB (sign-in broker at oauth.lovable.app, user management via Supabase Auth); details on these processors are set out in sections 4 and 6. On your device, only the session data that also arises when signing in with a password is stored (section 5.1).
If you register via Google, you confirm our Terms, this privacy policy and that you are of legal age before the process starts; we log this confirmation with a timestamp and version number as evidence. The link to your Google account exists for as long as your account with us exists and is removed when that account is deleted. You can also revoke the connection at Google itself at any time (myaccount.google.com/permissions); signing in via Google is then no longer possible, while your account with us and your data remain unaffected. In that case, please contact us at contact@glanwick.com so that we can set up an alternative way for you to sign in.
When you create an account, we record how you arrived at our site during the visit in which the registration takes place. We record exclusively: the internet host of the referring page (for example "instagram.com", never the full address including any search query), any campaign identifiers contained in the link you followed (so-called UTM parameters), the first page of our service you accessed, and the time of this capture. These details are stored once when the account is created and are not modified thereafter.
Nothing is stored on or read from your device for this purpose; until registration, the details exist only in the memory of the browser tab. Consent under Section 25 TDDDG is therefore not required. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in understanding through which channels users find our service). The data is evaluated exclusively in aggregated form per channel; it is likewise deleted when you delete your account.
We offer registration only in certain countries. When you open the sign-in and registration page, we therefore determine which country you are accessing it from. To do so, your browser first retrieves a piece of technical information from the network through which our site is delivered (Cloudflare, section 6 h); we read only the two-letter country code from it. If this route yields nothing, for example because an ad blocker blocks it, our server queries the service ipapi.co and transmits your IP address to it for this purpose; again only the country code comes back. If that also yields no result, we derive the country from the time zone and, where necessary, the language setting of your browser.
The provider of ipapi.co is Kloudend, Inc., 1887 Whitney Mesa Dr #4080, Henderson, NV 89014, USA. Kloudend processes the IP address on our behalf and, according to its own information, keeps it in server logs for security and debugging, typically for two to six months and for less than one year. We ourselves store neither your IP address nor the country determined during the country check. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is to open registration only where we can legally and fiscally provide our service. The transfer to the USA is secured by a data processing agreement with EU Standard Contractual Clauses (SCCs). Signing in with an existing account remains possible from anywhere.
After registration we guide you once through a short setup. In it we ask for your first name, your trading experience (one of three levels), your country, and how you heard about GlanWick (one to three answers from a list; if you choose “Other” and add a note, we store that text). These four details are required to complete the setup. At the end you choose a first asset for your watchlist. If you import a file during the setup, this choice is skipped: we then adopt an asset only if the imported trades contain one of the assets on offer. We store these details in your profile. In the same flow you can voluntarily subscribe to emails from us (sections 3a and 3b).
We are gradually introducing an additional step in this setup. If it is shown to you, it asks what you want to change about your trading, how you keep track of your trades today, and what you mainly trade (one answer each from a fixed list; these three answers are required to continue). You can also voluntarily write one sentence in your own words (280 characters at most). We store these answers in your profile as well, together with the time at which you last gave or changed them.
We use your first name to address you in the application and in emails, and in the voice assistant (section 7d). The country is pre-filled based on the time zone and language of your browser. If you choose a different country, we switch the time zone in which GlanWick shows you times to that country and store it in your profile. From the countries of the accounts we also form figures that can be retrieved without signing in: from how many countries and from which regions GlanWick is used, as well as the country and calendar day of the most recent registrations, in each case without names, without account identifiers and without the time of day. The asset you choose becomes the first entry in your watchlist. With your country and the remaining answers we want to understand who uses GlanWick, through which channels users find us and what the product is meant to help with, and to align what we build next accordingly. For this purpose we also evaluate how accounts with a particular answer go on to use GlanWick, for example whether they return or take out a subscription. Where only a few accounts have given the same answer, such an evaluation can relate to a single account. On our side, only the people who operate GlanWick can view the answers; the service providers we use are listed in section 6.
While you go through the setup, we record events for usage analytics (section 2d) and, only with your consent, for statistics (section 5.2): that the setup was started, which step was completed and how long it took, plus categories from your details (language, experience, country, the acquisition channels you tapped, the type and symbol of the first watchlist asset and, for an import, the path, the broker, the size class and whether rows were skipped or invalid) and whether a free-text field was filled in; on completion we add how long the setup took in total. Text you typed freely and your first name are not contained in these events, which we report ourselves. For the additional step, the only addition is whether the text field was filled in; your answers are not contained in the events. If you have consented to statistics, they additionally record automatically what you click on a page and show in session recordings what is visible there (section 5.2); this can include the greeting with your first name. While the additional step is displayed, session recording and the capture of click and mouse positions are paused, and the statistics do not record clicks on the answer fields.
The legal basis is Art. 6(1)(b) GDPR insofar as we use your first name, country and watchlist asset to set up your account (form of address, time zone, first watchlist entry). Otherwise it is Art. 6(1)(f) GDPR: our legitimate interest is to align the service with what users actually need. We store the details for as long as your other account data (section 6a). We remove the answers from the additional step from your profile as soon as you request the deletion of your account; section 6 l applies to data backups. You can object at any time to processing based on our legitimate interest (Art. 21 GDPR), informally by email to contact@glanwick.com.
At glanwick.com/plan we offer a short quiz, which we mainly point to through a dedicated link on our Instagram channels. It asks about your goal in trading, what is holding you back, what you last spent money on for your trading, how much reaching your goal would be worth to you per month (not every version of the quiz shows this question), what you trade and how often (one answer each from a fixed list) and, voluntarily, your first name. If you choose “Something else” as your goal, you can voluntarily write one sentence in your own words (200 characters at most). We then show you a plan with three steps in GlanWick and a matching offer. Which of several designs of the offer page you see is determined at random when the page is opened; this lets us compare which design makes the decision easier for visitors.
For each run we store on our servers, under a randomly generated identifier: your answers and the voluntary sentence, how far you got and when you reached which stage, the design shown, the language of the page, the device category (phone or computer), the two-letter country code and any campaign identifiers contained in the link you followed (UTM parameters). On the offer page you can voluntarily play a short game that, depending on the score you reach, secures a voucher for the offer. We note on the run when the game was offered to you. If you play it, we additionally note when you opened the game, completed your first attempt and last finished the game, your best score, the voucher level reached with it, the number of your attempts and whether and when you redeemed the voucher and at which level. We do not store your first name on our servers; it is used only to address you. We first read the country code from the technical information of the network through which our site is delivered (Cloudflare, section 6 h). If you proceed to checkout or to the free account, we check the country as we do at registration (section 2g), because we offer accounts only in certain countries, and we note on the run if a purchase is not possible from your country. Unlike at registration, we store the country code determined here with the run; we do not store your IP address here either.
For the quiz itself, the page initially places nothing on your device; the identifier of the run exists only in the memory of the browser tab. Only when you proceed to checkout or to the free account do we store your plan in your browser’s local storage (identifier of the run, design, answers, first name, plan, time). This way the plan arrives in your account after payment and registration, your first name is ready as a suggestion when you set up your account (section 2h), and if you cancel at checkout you return to your offer instead of the first question. For this purpose the page queries this entry when it is opened. It is deleted as soon as the plan is linked to your account; after 30 days we no longer use it and remove it the next time our site queries it. You can delete it yourself at any time via your browser settings. Under Section 25(2) no. 2 TDDDG this storage is permitted without consent because it is strictly necessary to provide the service you requested.
If you play the game on the offer page, we check the voucher at checkout so that it only applies if the game was actually played that way. For this purpose, when the game starts we create an entry on our servers with a randomly generated identifier, a random starting value for the playing field, the time and the identifier of the run. In deviation from the previous paragraph, after each flight the page places the identifier of the game, the starting value, the course of your flights (size of the playing field, times of your taps in game ticks, duration and score) and the time in the session storage of your browser tab. If you then choose Starter or Pro on the yearly plan in this tab, we send this information with the request to checkout; our server replays the flights, determines the voucher level from them, transmits the voucher to Stripe as a discount (section 6) and notes on the game’s entry the replayed score, the level granted, the time of the check and the identifier of the Stripe payment session. We do not store the course of the flights on our servers. The entry in session storage ends when you close the tab; we use it for checkout for 24 hours at most. Under Section 25(2) no. 2 TDDDG this storage is permitted without consent because it is strictly necessary to provide the voucher you earned. We delete the game’s entry on our servers after 30 days. The legal basis is Art. 6(1)(b) GDPR.
If you then create an account, we link the run to your account: via the identifier from local storage, via the identifier carried in the confirmation link of your registration, or via the identifier of the Stripe payment session, which we note on the run if you paid through the quiz. Your plan then appears as a checklist in your dashboard; we store which steps you opened or ticked off and whether you hid the checklist. For our evaluation we link the runs to the subscription status of the linked accounts to see which questions and which design lead to a subscription. We evaluate in aggregated form, and our own accounts and devices are not counted; where only a few runs gave the same answer, an evaluation can relate to a single run. On our side, only the people who operate GlanWick can view the voluntary sentence, and only with a second sign-in factor. If you have consented to statistics (section 5.2), session recording, the heatmap and the capture of clicks are paused in the quiz; only opening and leaving the page are recorded there.
We delete the identifier of the Stripe payment session after 30 days, the voluntary sentence after 90 days and runs without an account after twelve months. If a run is linked to your account, it is kept for as long as your account exists, because it holds your checklist. If you delete your account, the link is removed; the identifier of the payment session and the voluntary sentence are deleted the following night, and the rest of the run twelve months after it began. The legal basis for the quiz, your plan, its transfer to your account and the checklist is Art. 6(1)(b) GDPR. For the evaluation it is Art. 6(1)(f) GDPR: our legitimate interest is to understand which questions and which design help visitors find the right offer. You can object to this processing at any time (Art. 21 GDPR), informally by email to contact@glanwick.com. The service providers we use are listed in section 6.
Transactional emails (confirmations, password reset, launch notification, price alerts you set up) are sent via Plus Five Five Inc. ("Resend"), San Francisco, USA. A Data Processing Agreement (DPA) with EU Standard Contractual Clauses is in place. Legal basis: Art. 6(1)(a)/(b) GDPR.
If you have consented to occasional feedback emails (when setting up your account or in your settings, where you can revoke it at any time) and have not signed in for a longer period, we send you a one-off invitation to a short survey. Without this consent, no such invitation is sent. Its sole purpose is to understand what kept you from using GlanWick. The invitation contains a randomly generated token that links your answer to your account; no login is required. We use no tracking pixel and do not measure whether you opened the email. We do record the time the survey page was opened through your link.
In the survey we store the answers you select, an optional free-text comment and, if you provide one, an email address for a reply. Answers are saved as soon as you click them, even if you do not finish the survey; we state this on the page itself. The legal basis for sending the invitation is your consent (Art. 6(1)(a) GDPR, sec. 7(2) no. 2 German UWG), and for evaluating the answers our legitimate interest in improving our own service (Art. 6(1)(f) GDPR), and for the voluntarily provided contact address your consent through active entry (Art. 6(1)(a) GDPR). For a fully completed run we credit your account once; the credit does not depend on what you answer. If you delete your account, the link is removed and the answer remains in anonymized form.
On request we send you our market newsletter “The Sunday News Club” once a week (Sundays) with a recap of the past week and the upcoming week’s calendar; individual issues may include notes on GlanWick offers and features. Signing up is voluntary and happens exclusively through an unticked consent. If you sign up without a GlanWick account, you then confirm your address via a link in a confirmation email (double opt-in); without this confirmation, no newsletter is sent. If you sign up while logged in to your account, whose email address you already confirmed at registration via a link or through your Google sign-in, that confirmation serves as proof; a further confirmation email may then be omitted. We store your email address, a first name you may voluntarily provide for the salutation, the time and source of the signup, the chosen language, the time and type of confirmation (confirmation email or confirmed account address) and, for abuse prevention, the IP address used at signup and confirmation.
Delivery is handled by the provider named in section 3. Parts of the content are drafted with AI assistance from price, calendar and news data and are labeled accordingly in the email. The legal basis is your consent (Art. 6(1)(a) GDPR, sec. 7(2) no. 2 German UWG). You can withdraw it at any time via the unsubscribe link in every issue; your address is then blocked for the newsletter. During onboarding you can also consent via a never pre-ticked checkbox to receiving occasional promotional and offer emails from GlanWick; if the checkbox text also names the newsletter and occasional feedback questions (section 3a), it covers these as well. The time of this consent is stored in your profile. You can withdraw this consent at any time as well, via the unsubscribe link in any such email or informally to contact@glanwick.com.
If you connect Telegram in the settings, we send notifications you have set up as a message to your Telegram chat, such as price alerts, notices about analysis criteria or about positions in the simulator. For this purpose we store the chat ID you enter as well as the time and wording of your consent. When a message is sent, Telegram receives the chat ID and the text of the notification, for example the symbol, price and trigger of the alert.
The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time in the settings; we then delete the chat ID and send nothing further to Telegram. The provider is Telegram Messenger Inc., Commerce House, Wickhams Cay 1, PO Box 3140, Road Town, Tortola, VG1110, British Virgin Islands. Telegram processes the messages as an independent controller in accordance with its privacy policy (telegram.org/privacy); according to that policy, data of users from the European Economic Area is stored in data centres in the Netherlands. There is no adequacy decision of the EU Commission for the British Virgin Islands. The transfer takes place because you have chosen this delivery channel yourself and it is necessary for the delivery you requested (Art. 49(1)(b) GDPR).
If the sign-up form showed the notice that we send you tips and our own offers by email when you registered, we use your email address to send you tips for using your account and information about GlanWick’s own similar offers. The legal basis is our legitimate interest in informing our users about our own service (Art. 6(1)(f) GDPR in conjunction with sec. 7(3) German UWG). We do not send you third-party offers this way. Delivery is handled by the provider named in section 3.
You can object at any time (Art. 21(2) GDPR): via the unsubscribe link in each of these emails or informally to contact@glanwick.com. There are no costs for this other than the transmission costs at basic rates. After your objection you will no longer receive such emails; emails that are necessary for your account (section 3) are not affected. So that we can prove the notice was on the form when you registered, we store the time and the version of the notice in your profile until your account is deleted.
This platform is operated via Lovable Labs AB (Stockholm, Sweden), acting as a data processor under Art. 28 GDPR. A Data Processing Agreement (DPA) with EU Standard Contractual Clauses is in place.
Lovable uses the following sub‑processors:
All sub-processors are contractually bound through the DPA with Lovable Labs. Transfers to the USA are secured by EU Standard Contractual Clauses (SCCs) and/or the EU-US Data Privacy Framework (DPF).
These cookies are required for the platform to function and are set without your consent. Legal basis: Art. 6(1)(f) GDPR (legitimate interest) and Art. 6(1)(b) GDPR (contractual necessity).
With your consent, we collect usage statistics. Legal basis: Art. 6(1)(a) GDPR (consent). We use (a) our own solution (atx_anon_session, internal platform analytics; stored exclusively in our own infrastructure, Supabase via Lovable Cloud) and (b) PostHog (PostHog Inc., USA; hosting and processing in the EU region, delivered via our own subdomain t.glanwick.com acting as a technical proxy). We collect page views, clicks on interface elements and their position on the page, the position of the mouse pointer, scroll depth and visible page sections, tab switches, session duration, feature usage, whether a form was started or submitted (never its content), technical errors and load times, as well as — likewise only with consent — masked session recordings: a replay of interaction steps in which all input fields as well as amounts, balances and content marked as sensitive are obscured, and payment forms are blocked entirely. Occasionally we show short product surveys; participation is voluntary. The IP address is not stored. Signed-in users are attributed pseudonymously via their account identifier, never via name or email address. A data processing agreement is in place with PostHog; any third-country transfer is secured by EU Standard Contractual Clauses. Without consent, PostHog is not loaded; you can revoke consent at any time via the cookie settings, which also ends any ongoing recording.
With your consent, we record the source of your visit (UTM parameters, campaign slug) to evaluate our own campaigns. This covers cm_attribution, cm_anon_session and internal campaign events; that data remains within our own infrastructure and is not shared with third parties. In addition, we use Google Ads conversion tracking (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). If you reach us through one of our ads, Google passes on a click identifier (gclid); if you then complete a registration or a purchase, we send a corresponding conversion signal to Google so that we can assess how well our ads perform. That signal contains the time, the type of completion and, for a purchase, the amount, but neither your name nor your email address. Without your consent to marketing cookies, no identifiers are stored on or read from your device for this purpose; in that case Google only receives cookieless signals without any device identifier (Google Consent Mode v2). Legal basis: Art. 6(1)(a) GDPR (consent). Retention: session up to 30 days for our own identifiers, up to 90 days for Google Ads identifiers.
Likewise only with your consent, we use the Meta Pixel (Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland) to measure the effectiveness of our ads on Instagram and Facebook. Without consent to marketing cookies, the pixel is not loaded, no connection to Meta is established and no identifiers are stored on or read from your device. With consent, Meta sets the cookies _fbp and, where applicable, _fbc (retention up to 90 days) and receives page views as well as events such as a completed registration or a purchase (time, type of completion and, for purchases, the amount) together with technical data such as IP address and browser information; we do not transmit your name or email address. With your consent, we additionally report registrations and purchases to Meta via our server (Conversions API) so that measurement does not depend on whether the script loads in your browser; this transmits the time and type of the event, IP address, browser information and, where present, the values of the _fbp and _fbc cookies to Meta, still neither your name nor your email address. For the collection and transmission of this data, we and Meta are joint controllers (Art. 26 GDPR, based on Meta’s Controller Addendum); for the subsequent processing, Meta acts as an independent controller. Transfers to the USA are secured by the EU-US Data Privacy Framework (DPF) and EU Standard Contractual Clauses. Legal basis: Art. 6(1)(a) GDPR (consent); you can revoke consent at any time via the cookie settings, which also deletes the Meta cookies.
Likewise only with your consent, we use the OpenAI measurement pixel (OpenAI Ireland Limited, 1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland) to measure the effectiveness of our ads in ChatGPT. Without consent to marketing cookies, the pixel is not loaded, no connection to OpenAI is established and no identifiers are stored on or read from your device. With consent, OpenAI sets the identifiers __oppref and __obref, which attribute a visit to an ad, as well as __oaiq_consent, which records your decision about measurement. OpenAI then receives page views as well as events such as a completed registration or a subscription (time, type of completion and, for subscriptions, the amount) together with technical data such as IP address and browser information. We ourselves pass neither your name nor your email address to the script. The OpenAI script does, however, include a feature called “automatic advanced matching”, which reads the email address you enter into forms on our site, converts it into an irreversible check value (SHA-256) while still on your device, and transmits that check value with the event; the address itself never leaves your device in plain text. Using this check value, OpenAI can tell whether a ChatGPT account exists for your address and attribute an ad contact accordingly. The same applies to phone number, first and last name and postal code if you enter them into a form. With your consent, we additionally report registrations and subscriptions to OpenAI via our server (Conversions API) so that measurement does not depend on whether the script loads in your browser; this transmits the time and type of the event, IP address, browser information and, where present, the values of the __oppref and __obref identifiers to OpenAI, still neither your name nor your email address. Unlike with Meta, there is no joint controllership here: under OpenAI’s Ad Tools Data Processing Addendum, we and OpenAI each act as independent controllers. Transfers to the USA are secured by the EU Standard Contractual Clauses (Module One, controller to controller). Legal basis: Art. 6(1)(a) GDPR (consent); you can revoke consent at any time via the cookie settings, which stops measurement and deletes the __oppref and __obref identifiers.
You can change or revoke your cookie settings at any time via the "Cookie Settings" link in the website footer.
Some pages embed videos from the YouTube service. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). The embed uses a two-click solution: when the page loads, no connection to YouTube is established and no content, cookies or thumbnails are loaded from Google. The YouTube player is only loaded once you actively start the video via the "Play video" button.
When you start the video, data is transferred to Google, in particular your IP address, device and browser information and the page visited; Google may use cookies or similar technologies. We use YouTube's privacy-enhanced mode (embedding via youtube-nocookie.com), in which, according to YouTube, no personalisation cookies are set before playback. We have no control over Google's data processing once playback starts.
The legal basis is your consent under Art. 6(1)(a) GDPR, which you give by actively clicking the play button; a corresponding notice is shown right at the video. The consent applies to the respective playback; without your click, no transfer takes place. Data may be transferred to the USA; Google bases such transfers on the EU-U.S. Data Privacy Framework and EU Standard Contractual Clauses. For more information, see Google's privacy policy at policies.google.com/privacy.
Personal data is shared with the following recipients. Most of them process it on our behalf; where a recipient acts as an independent controller or jointly with us, this is stated.
a) Lovable Labs AB, Stockholm, Sweden
Purpose: hosting, backend, database, deployment, visitor analytics of the public pages (Sec. 2c).
Safeguard: DPA with EU SCCs.
Sub-processors: Supabase Inc. (USA), Vercel Inc. (USA).
b) Plus Five Five Inc. (Resend), San Francisco, USA
Purpose: transactional email delivery (registration, password reset, launch notification, price alerts).
Safeguard: DPA with EU SCCs and EU-US DPF.
c) Functional Software Inc. (Sentry), San Francisco, USA
We use Sentry to detect and fix technical errors. Technical error data (error type, stack trace, browser, operating system) and, if you are logged in, your pseudonymous user ID are processed. No email addresses, passwords, broker API keys or chat content are transmitted; input fields and media in session replays are masked by default. Hosting is in the EU region (Frankfurt).
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in technical functionality and security of the platform).
Safeguard: DPA with EU SCCs and EU-US DPF.
d) Stripe Payments Europe Ltd., Dublin, Irland
Purpose: payment processing for subscriptions and credit packs.
Safeguard: DPA with EU Standard Contractual Clauses (SCCs); data transfers to the USA are conducted solely on this basis.
e) ElevenLabs Inc., New York, USA
Purpose: speech output (text-to-speech). When you use the read-aloud feature, the text to be read is transmitted to ElevenLabs; no account data and no email addresses are transferred.
Safeguard: DPA with EU Standard Contractual Clauses (SCCs). Legal basis: Art. 6(1)(b) GDPR (providing the feature at your request).
Purpose (voice assistant, Sec. 7d): converting your speech to text, answering it with a language model and speaking the answer. The language model is provided by Anthropic PBC, San Francisco, USA, which ElevenLabs uses as a sub-processor. Audio is not stored; the text transcript of the conversation is kept for 30 days and then deleted.
Legal basis for the voice assistant: Art. 6(1)(a) GDPR (your consent before the first conversation, revocable at any time with effect for the future).
f) PostHog Inc., San Francisco, USA (EU-Hosting: eu.i.posthog.com)
Purpose: usage analytics, masked session recordings and product surveys (only with consent, details in section 5.2).
Safeguard: DPA; processing in the EU region, any third-country transfers via EU Standard Contractual Clauses (SCCs).
g) Google Ireland Limited, Dublin, Ireland
Purpose: sign-in and registration via a Google account, if you choose that route (details in section 2e); conversion measurement for our Google Ads campaigns and embedding of YouTube videos (the latter two only with consent, details in sections 5.3 and 5a). Google acts as an independent controller in all of these cases.
Safeguard: EU-US Data Privacy Framework (DPF) and EU Standard Contractual Clauses (SCCs) for transfers to Google LLC in the USA.
h) Cloudflare Inc., San Francisco, USA
Purpose: spam and abuse protection during registration, sign-in and password reset via Cloudflare Turnstile (waitlist and newsletter: see letter m). Your IP address and technical characteristics of your browser are processed in order to distinguish automated from human access. According to the provider, Turnstile does not use cookies for cross-site recognition. In addition, Cloudflare provides the technical information from which we read your country on the sign-in and registration page (section 2g).
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in preventing abusive registrations and securing the platform). Safeguard: DPA with EU Standard Contractual Clauses (SCCs).
i) Meta Platforms Ireland Limited, Dublin, Ireland
Purpose: conversion measurement for our ads on Instagram and Facebook via the Meta Pixel (only with consent, details in section 5.3). Collection and transmission are subject to joint controllership under Art. 26 GDPR; for further processing, Meta acts as an independent controller.
Safeguard: EU-US Data Privacy Framework (DPF) and EU Standard Contractual Clauses (SCCs) for transfers to Meta Platforms Inc. in the USA.
j) OpenAI Ireland Limited, Dublin, Ireland
Purpose: conversion measurement for our ads in ChatGPT via the OpenAI measurement pixel and the Conversions API (only with consent, details in section 5.3). Under OpenAI’s Ad Tools Data Processing Addendum both parties act as independent controllers; joint controllership under Art. 26 GDPR is expressly excluded.
Safeguard: EU Standard Contractual Clauses (SCCs, Module One, controller to controller) for transfers to OpenAI in the USA.
k) IONOS SE, Montabaur, Germany
Purpose: operation of our email mailboxes (contact@glanwick.com and partner@glanwick.com). This covers the content and metadata of emails you send us or receive from us, for example support requests or partnership requests (section 6d).
Safeguard: data processing agreement under Art. 28(3) GDPR.
l) IONOS Cloud GmbH, Montabaur, Germany (storage location: Germany)
Purpose: storage of our weekly data backup, so that your data can be restored after a technical failure or an attack. The backup covers the contents of our database and the uploaded files; files you send us via the Import Concierge (section 7g) are excluded. Every backup is encrypted on our systems before it is transferred; IONOS Cloud does not hold the key needed to decrypt it. Backups are kept immutable for 35 days and deleted after six weeks at the latest. Data you ask us to delete therefore remains in a backup for up to six weeks and is not used for anything else during that time.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in the availability and recoverability of the data, Art. 32 GDPR). Safeguard: data processing agreement under Art. 28(3) GDPR.
m) Google Cloud EMEA Limited, 70 Sir John Rogerson’s Quay, Dublin 2, Ireland
Purpose: spam and abuse protection when you join the waitlist or subscribe to the newsletter, via Google reCAPTCHA Enterprise. As soon as the form is displayed, your browser loads a script from Google for this purpose. Google evaluates your IP address, technical characteristics of your browser and device and your behaviour on the page and calculates a risk score from them; Google may set a cookie for this (_GRECAPTCHA). On submission, our server checks the result with Google and transmits your IP address for that purpose. You do not have to solve a task.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest in preventing automated sign-ups). Safeguard: data processing under Google’s Cloud Data Processing Addendum with EU Standard Contractual Clauses (SCCs) and the EU-US Data Privacy Framework (DPF) for transfers to Google LLC in the USA.
n) Kloudend, Inc. (ipapi.co), Henderson, Nevada, USA
Purpose: determining the country from the IP address on the sign-in and registration page when it cannot be determined otherwise (details in section 2g).
Safeguard: DPA with EU Standard Contractual Clauses (SCCs).
o) Manychat, Inc., West Hollywood, California, USA
Purpose: automated direct messages on Instagram when you comment a keyword on one of our posts (details in section 6f).
Safeguard: DPA with EU Standard Contractual Clauses (SCCs); according to its own information also certified under the EU-US Data Privacy Framework (DPF).
p) Telegram Messenger Inc., Tortola, British Virgin Islands
Purpose: delivery of notifications to your Telegram chat, provided you have connected Telegram yourself (only with consent, details in section 3c). Telegram acts as an independent controller.
q) PayPal (Europe) S.à r.l. et Cie, S.C.A., Luxembourg
Purpose: payout of commissions to partners of the partner program (details in section 6b). PayPal acts as an independent controller.
r) Anthropic Ireland, Limited, Dublin, Ireland
Purpose: the AI assistant Claude in our internal work with publicly available information about business contacts and with public comments (details in section 6g). Anthropic acts as an independent controller here.
s) SideGuide Technologies, Inc. (Firecrawl), USA
Purpose: web search by the AI Mentor for questions about current events. Only search terms are transmitted, without an account identifier and without an IP address. The basis for the transfer to the USA and all details are set out in section 7b.
Transfers to the USA are secured by EU Standard Contractual Clauses (SCCs) and/or the EU-US Data Privacy Framework (DPF), unless stated otherwise for a recipient or in the section referred to there.
We retain personal data only as long as required for the respective purpose or as mandated by statutory retention obligations.
| Data category | Retention | Legal basis |
|---|---|---|
| Server log files | 14 days | Art. 6(1)(f) |
| Access attempts to the admin area | 90 days; entries needed as evidence until the proceedings end | Art. 6(1)(f) |
| Waitlist (email) | until withdrawal / max. 12 months | Art. 6(1)(a) |
| Account master data | contract term + 30 days | Art. 6(1)(b) |
| Details from account setup (Sec. 2h) | as account master data; answers from the additional step until deletion is requested | Art. 6(1)(b), (f) |
| Quiz at glanwick.com/plan (Sec. 2i) | Stripe payment session 30 days, voluntary sentence 90 days, run without an account 12 months; with an account, as long as the account exists; plan in the browser until linked to the account, used for 30 days at most; game check at checkout 30 days, game in the browser tab 24 hours at most | Art. 6(1)(b), (f) |
| Trades, journal, analytics | until account deletion | Art. 6(1)(b) |
| Invoices / tax records | 10 years (§ 147 AO) | Art. 6(1)(c) |
| Voice assistant: conversation transcript at ElevenLabs (no audio) | 30 days | Art. 6(1)(a) |
| Voice assistant: duration and billing per conversation, consent | until account deletion | Art. 6(1)(b)+(c) |
| AI Mentor metadata | 12 months, anonymized | Art. 6(1)(b)+(f) |
| Reach measurement, public pages (no IP) | 180 days | Art. 6(1)(f) |
| Real-time reach measurement (no IP) | 30 minutes | Art. 6(1)(f) |
| Visitor analytics of the hosting provider (Sec. 2c) | Analysis up to 90 days, deletion by the provider | Art. 6(1)(f) |
| Cookie consent log | 12 months | Art. 7(1) |
| Withdrawal declarations via the withdrawal function (Sec. 2d) | 6 years (§ 257 HGB) | Art. 6(1)(c), (b) |
| Job applications incl. CV | 6 months from receipt | Art. 6(1)(b) |
| Sentry error telemetry | 90 days | Art. 6(1)(f) |
| Data backup (encrypted, Sec. 6 l) | 6 weeks at most | Art. 6(1)(f) |
| Usage analytics in the app (Sec. 2d) | 180 days | Art. 6(1)(f) |
| Partner program: click data (IP hashed only) | 90 days | Art. 6(1)(f) |
| Partner program: credit notes / settlements | 10 years (§ 147 AO) | Art. 6(1)(c) |
| Business outreach: request status (Sec. 6d) | 12 months after the last change; after an objection only name and do-not-contact note | Art. 6(1)(f) |
| Business outreach: email correspondence | up to 6 years (§ 257 HGB) | Art. 6(1)(c) |
| Feedback on social media channels (Sec. 6e) | 24 months after the comment; with consent to reproduction until withdrawal | Art. 6(1)(f), (a) |
| Import format library: pseudonymized identifier per confirmed format (Sec. 7c) | 30 days | Art. 6(1)(f) |
| Notice about tips and our own offers by email: time and version (Sec. 3d) | until account deletion | Art. 6(1)(f) |
| Feature interest markers | until removed or account deletion | Art. 6(1)(f) |
| Weekend Cup: entry, orders, results (Sec. 7f) | until account deletion | Art. 6(1)(b) |
| Import concierge: file you sent (Sec. 7g) | until resolved, at most 30 days after receipt | Art. 6(1)(b) |
We operate our own partner program without external affiliate networks. If you click a partner link ("via" parameter) or use a partner coupon code, we store the attribution between your account and the referring partner to calculate their commission (Art. 6(1)(b) and (f) GDPR). The identifier is stored locally in your browser (localStorage); no third-party tracking services are involved.
When partner links are clicked, we record a minimal technical log for abuse detection and to steer our partner program: timestamp, partner code, device category, the country derived from the IP address (the two-letter country code only, no region, city, or coordinates), and the IP address itself exclusively as a cryptographic hash (no plain-text storage). This data is deleted automatically after 90 days.
Partners only ever see pseudonymous identifiers and timestamps for referred users, never names or email addresses. From partners themselves we process master and tax data (name, country, entrepreneur status, VAT ID, payout details) as well as voluntary application details (links or handles of their own social media channels, a free-text note) for contract performance, application review and self-billing settlement; settlement records are subject to the 10-year statutory retention period (§ 147 AO).
We pay out commissions via PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg). For this purpose we transmit the PayPal address stored in the partner account, the amount and currency, the settlement month, the credit note number and an internal identifier of the payout. The legal basis is Art. 6(1)(b) GDPR (performance of the partner agreement). PayPal processes the payment data as an independent controller in accordance with its own privacy notice.
The form on our careers page lets you send a speculative application. We process the data you provide: name, email address, voluntary details on your field of work, a motivation text and a portfolio link, plus an optionally uploaded application file (PDF, DOC or DOCX, maximum 5 MB). The legal basis is Art. 6(1)(b) GDPR in conjunction with § 26(1) BDSG (pre-contractual measures at your request).
Application documents are stored encrypted and separately from other application data in a storage area that is not publicly accessible. Only management has access. There is no disclosure to third parties, no automated pre-selection and no profiling.
Deletion takes place no later than six months after the application is received. That period follows from the two-month limitation period in § 15(4) AGG plus a buffer for any dispute. On request we delete earlier; an informal message to contact@glanwick.com is enough. If a working relationship results, the data is transferred into the contractual relationship.
When we contact creators, publishers or coaches about a possible collaboration, or ask experienced founders, investors and experts for their advice, we process your name, your business email address, links to your public profiles or websites, the audience size shown there publicly (for example your number of subscribers or followers, kept in our overview only as a rough size class), and the status of our request (for example contacted, reply received, declined). This information comes from publicly available sources, usually your website, your legal notice or your channel description. The same applies when we review publicly available information before deciding whether to contact you.
The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is initiating a business relationship or a professional exchange. The email correspondence is kept in our mailbox with IONOS SE, Montabaur, Germany. An overview of the status of our requests, without email addresses, is kept in our database with Supabase (section 4) and is accessible only to management.
You can object to this processing at any time (Art. 21 GDPR); a short reply to our email is enough. After that we will not contact you again and keep only your name with a note that you do not wish to receive further messages, so that it stays that way. If no collaboration comes about, we delete the remaining information in the overview no later than twelve months after the last change. Emails themselves are retained where commercial retention obligations apply (§ 257 HGB, up to six years).
When you publicly comment on one of our posts, for example on Instagram, Threads, X, TikTok, YouTube or Reddit, we may keep an internal record of your comment in order to evaluate feedback on our work. For this purpose we process the wording of the comment, your username as publicly shown there, the platform, the post the comment was made on, and the date. This information comes from the publicly visible comment itself.
On Instagram this happens automatically: through the interface Instagram provides to account holders, we regularly retrieve the comments on our own posts and have new comments reported to us from there. In doing so, we additionally store the time of the comment, its number of likes, whether it is a reply to another comment and whether it is hidden; we do not store any further details from your profile. If you delete your comment on Instagram, we generally remove it from our overview as well at the next synchronization.
Through the same interface we reply to comments and hide or delete comments that are insulting or contain advertising or fraud. So that we can reply promptly, we have a reply suggestion drafted for every comment on our Instagram posts that we have not yet replied to. For this purpose, the wording of the comment, together with its age in days, the text of our post and the earlier comments in the same conversation, is sent to an AI service provider (Google Gemini, processed through our infrastructure partner Lovable Labs AB, section 6); we remove your username and mentions of other accounts beforehand. A person reviews every suggestion, and a reply is published only once we approve it. The suggestion is deleted together with the comment.
The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is to keep track of feedback on our content, to answer public questions and objections with reasonable effort, and to align our service with it. The overview is kept in our database with Supabase (section 4) and is accessible only to management. We reproduce your comment together with your username on our website or in our advertising only if you have given your prior consent (Art. 6(1)(a) GDPR); you can withdraw this consent at any time with effect for the future.
You can object to this internal record at any time (Art. 21 GDPR); an email to contact@glanwick.com is enough, and we will then delete the entry. Without consent to reproduction, we delete it no later than 24 months after the comment. The operator of the respective platform is responsible for the processing of your data on that platform; its privacy notice applies.
On individual Instagram posts we offer to send you a link by direct message if you comment a keyword named there. The message is sent on our behalf by the service Manychat (Manychat, Inc., 8605 Santa Monica Blvd, #64372, West Hollywood, CA 90069, USA), which is connected to our Instagram account for this purpose. In doing so, Manychat processes your Instagram username and further profile details that Instagram provides for this (such as display name and profile picture), your comment and the history of direct messages with us, and keeps you as a contact in our Manychat account.
The legal basis is Art. 6(1)(b) GDPR (sending the link you request with your comment) and otherwise Art. 6(1)(f) GDPR (legitimate interest in answering requests on our channel). The transfer to the USA is secured by a data processing agreement with EU Standard Contractual Clauses (SCCs); according to its own information, Manychat, Inc. is also certified under the EU-US Data Privacy Framework (DPF). You can object to this processing at any time and request that we delete your contact; a message in the chat or to contact@glanwick.com is enough. The operator of Instagram is responsible for the processing of your data on Instagram itself; its privacy notice applies.
For research, drafts and maintaining our internal overviews we use the AI assistant Claude. The provider for customers in the European Economic Area is Anthropic Ireland, Limited, 6th Floor, South Bank House, Barrow Street, Dublin 4, D04 TR29, Ireland; the inputs are also processed by Anthropic PBC in the USA. We enter into this service publicly available information about business contacts under section 6d (name, public profiles and websites, the audience size shown there and the status of our request; business email addresses as a rule only with their domain) as well as public comments under section 6e with the username shown there, when we draft a reply or record the comment. We also use it to evaluate public forum posts by third parties, without their usernames.
The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is to prepare and evaluate these matters with reasonable effort. Anthropic processes the inputs as an independent controller in accordance with its privacy policy (anthropic.com/legal/privacy) and, according to its own information, bases transfers to countries without an adequacy decision on EU Standard Contractual Clauses. You can object to this processing at any time (Art. 21 GDPR); an email to contact@glanwick.com is enough.
Requests: contact@glanwick.com
GlanWick does not engage in automated decision-making with legal or similarly significant effects on users as defined in Art. 22 GDPR. AI-powered features on the platform provide informational analysis only and do not make binding decisions regarding your financial transactions or account status.
For the AI Mentor feature, your trading data (trades, performance metrics, journal entries, psychology data) is transmitted to an AI service provider (Google Gemini, processed through our infrastructure partner Lovable Labs AB) for analysis. The transmission is based on Art. 6(1)(b) GDPR (contract performance) and requires your explicit opt-in consent on first activation.
Data is used to generate your personal analysis and is not used to train external AI models. The visible chat history exists only locally in your browser. To improve quality, we store anonymized, shortened and PII-redacted questions plus technical response metadata (e.g. language, mode, response length, whether the assistant could not answer), without user ID and only with a daily rotating session hash. Token usage metadata is retained for billing and abuse prevention purposes for a maximum of 12 months and is then automatically deleted.
Web search: for questions about current events or news, the AI Mentor can additionally search the web. For this purpose our server transmits search terms to the search service Firecrawl (SideGuide Technologies, Inc., USA). The search terms are formed from your question: as a rule recognised security and company names and keywords, or alternatively the first 100 characters of the question. Your account identifier, your email address and your IP address are not transmitted; Firecrawl receives the request from our server and cannot attribute it to any user. Personal information only reaches Firecrawl if you write it into your question yourself; please therefore do not include names or other information about individuals in questions to the Mentor. The legal basis is Art. 6(1)(b) GDPR (answering your question). Firecrawl processes the search terms in the USA. Where a question does contain personal information, we base the transfer on the fact that it is necessary for the answer you requested (Art. 49(1)(b) GDPR).
You can revoke consent at any time in Settings. The AI Mentor does not provide investment advice and does not issue buy or sell recommendations.
When importing a trade file, an AI can suggest which column of the file corresponds to which journal field. For this purpose, the column headings of the file and at most eight data rows are transmitted to an AI service provider (Google Gemini, processed through our infrastructure partner Lovable Labs AB). This happens when you choose "Detect columns". If automatic detection is enabled for your account, it also happens without a further click as soon as GlanWick does not reliably recognize the format of a file and does not find it in the format library (see below) either; the import then shows that the AI is reading the columns. Contents of columns that identify an account or a person (e.g. account number, name, email address, postal address, IBAN), as well as email addresses and IBANs in other columns, are replaced in your browser beforehand. The remaining cells may contain trading data (e.g. date, instrument, direction, quantity, prices, profit or loss).
The sole purpose is mapping the columns. GlanWick calculates the trades themselves in your browser, and you check the result before importing. The legal basis is Art. 6(1)(b) GDPR (contract performance). The transmitted content is not used to train external AI models, and the transmitted data rows are not stored by us; we only log the number of columns and rows and the token usage as described in section 7b.
Format library: if it is enabled for your account, GlanWick compares the column headings of a file whose format it does not reliably recognize with a format library on our servers; for this comparison the column headings are transmitted and not stored. After an import, we store the column headings of the file and the mapping used in the format library, so that the same file format is recognized without AI in the future, including for other users. We do not store cell contents, file names or trading data in the process. If a column heading contains an email address, an IBAN or a sequence of six or more digits (such as an account number), nothing is stored.
That your account confirmed or rejected a format is recorded only as a pseudonymized identifier, and we delete this information after 30 days at the latest; the counters of a format remain without any link to your account. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest is a reliable import for all users. You can object to this at any time with effect for the future (Art. 21 GDPR): via the toggle in Settings under "Privacy" or informally at contact@glanwick.com. The objection is enforced on our servers; thereafter your imports no longer confirm formats, and nothing changes about your import.
The voice assistant answers questions about using the software by voice. Only after your explicit consent and only while a conversation is running is your microphone used: your speech goes to ElevenLabs Inc. (New York, USA), is converted to text there, answered by a language model of Anthropic PBC (San Francisco, USA) and returned as speech. We also transmit your first name (if provided), your plan, the page currently open, the number of your trades and whether a broker is connected, so the answers fit. We do not transmit trades, prices or journal content.
Audio is not stored. ElevenLabs keeps the text transcript of the conversation for 30 days so we can find errors; it is then deleted. We ourselves only store the start, duration and billing of each conversation plus your consent. The answers and the voice are generated by AI. The legal basis is Art. 6(1)(a) GDPR; you can revoke your consent at any time with effect for the future by writing to us. Transfers to the USA are based on the EU Standard Contractual Clauses.
The voice assistant does not provide investment advice and does not issue buy or sell recommendations.
The process card lets you share metrics for a period you choose as an image. For each card we store a record with a check code: period, number of trades, win rate, profit factor, ratio of average win to average loss, longest losing streak, origin of the trades and creation date. This record is publicly retrievable at glanwick.com/c/<code>, without your name and without any link to your account, so that anyone can check whether an image matches the original. The image itself is created in your browser and is not uploaded; only what you share yourself is passed on. The card’s QR code and link lead to this check page. Anyone who registers from there is attributed to you in the referral program.
If all trades in a period come from the automatic broker synchronisation, the card carries the label “verified”. So that this label is accurate, we store for synchronised trades whether and when you later changed the result, amounts, fees, prices, quantity, symbol, date or times, and, when a synchronised trade is deleted, a note (broker, the broker’s trade ID, trading day, time of deletion). The legal basis is Art. 6(1)(b) GDPR (providing the feature) and Art. 6(1)(f) GDPR (legitimate interest in the label being accurate for third parties who see the card). This information is deleted together with your account.
If you take part in the Weekend Cup, we process the display name you choose for it, the time you joined and the version of the terms of participation you agreed to, your orders, positions, balances and results in the cup, your rank and status and, if you win, the details needed to award the prize. The purpose is running the cup under the terms of participation: executing orders, scoring, the leaderboard and awarding prizes. The legal basis is Art. 6(1)(b) GDPR.
During and after the cup, the following are publicly retrievable: your display name, rank, return and status, the number of your opened and closed trades and whether your entry is eligible for a prize; if you are in the top four, also the history of your return, and the ticker names lead changes and the winner with display name and return. Only you see your positions, individual trades and account values. So choose a display name that does not point to your real name if you do not want that.
We also name the winners with display name, rank and return in our channels, such as Instagram, TikTok, YouTube or the newsletter. The legal basis is our legitimate interest in promoting the cup (Art. 6(1)(f) GDPR); you can object at any time, an email to contact@glanwick.com is enough. We do not publish real names, photos or email addresses without your consent. To notify winners we use the account email address; voucher codes and credits are handled by our payment provider Stripe (Sec. 6).
We keep the cup data as long as your account exists, so that results of past cups remain traceable, and delete it together with your account; your name then disappears from the leaderboard and ticker. Records of prizes awarded are kept as long as tax and commercial law require.
If you choose "Send file to GlanWick" in the file import, the file you selected is transmitted to us and stored in access-protected storage at our hosting provider. The file may contain trading data and account details. We use it solely to set up the import for your broker's format and to answer your request. The legal basis is Art. 6(1)(b) GDPR.
We delete the file as soon as the request is resolved, at the latest 30 days after receipt. We keep the details of the request (time, file type, file size, processing status and your optional note about the broker) until you delete your account; we do not store the name of the file. Without this choice the file is not transmitted to us; section 7c remains unaffected.
You have the right to lodge a complaint with the competent supervisory authority: Hessischer Beauftragter für Datenschutz und Informationsfreiheit, Gustav-Stresemann-Ring 1, 65189 Wiesbaden, Germany.
If you are a California resident, you have certain rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA) regarding your personal information. These include:
GlanWick does not sell your personal information and does not share it with third parties for advertising purposes. We use your data solely to provide and improve our services as described in this Privacy Policy.
Categories of personal information we collect: Contact information (email address), usage data (trading data, journal entries, performance statistics), technical data (IP address, device information, browser type).
Feature interest markers: When a feature is temporarily unavailable, you can register your interest with one click. We store your user ID and the feature identifier to gauge demand (Art. 6(1)(f) GDPR, legitimate interest in product development). Registering interest does not trigger any email and is not a payment obligation. You can remove it at any time in the same place, and it is deleted along with your account.
To exercise your rights, contact us at: contact@glanwick.com. We will respond to your request within 45 days.
If you are a resident of Canada, the processing of your personal information is subject to the Personal Information Protection and Electronic Documents Act (PIPEDA). You have the right to:
GlanWick collects and processes personal information only with your consent and solely for the purposes described in this Privacy Policy. To exercise your rights, contact us at: contact@glanwick.com.
This privacy policy may be updated as needed. Last updated: October 2026.