AIamond
LoginRegister
← Back to Home

Privacy Policy

Last updated: November 3, 2026

This privacy policy is published in English, German, Spanish and French. If the versions differ, the Spanish version prevails legally; the other versions are for information only.

1. Data controller

Lennart Schreiber
Calle de los Sargos 4
30383 Los Nietos, España / Spain
Email: [email protected]

2. Purposes of processing

We process personal data to:

  • provide the service: your account, your settings, the alerts you set up and the news analysed by AI
  • process payments for subscriptions concluded earlier
  • send service e-mails (see 3.1)
  • keep the service secure and prevent abuse (server logs, rate limits)
  • understand which channels bring visitors and sign-ups, and how the site is used (see 7)

3.1. Service e-mails and advertising e-mails

Service e-mails: the e-mails your account needs (confirming your address, a welcome after confirmation, password reset), the alerts you have set up and the confirmations of payments, cancellations and withdrawals are part of the service you asked for (Art. 6(1)(b) GDPR). Alert e-mails link to the page where you manage or delete the alert. The daily digest and the DAX pre-open brief are switched off for now; if we switch them on again they will be service e-mails with their own unsubscribe link.

Advertising e-mails, only with your consent: the welcome e-mails with tips in the first days (switched off for now). Legal basis: Art. 6(1)(a) GDPR, art. 21 LSSI and § 7(2) no. 2 UWG. You give consent by ticking the box (unticked by default) when you sign up, or with the switch in Settings; signing up without ticking it, or with Google, gives no consent. As proof we keep the grant or withdrawal with date and time, IP address, browser (user agent) and the version of the text, for as long as we need it to prove the consent.

You can withdraw consent at any time, free of charge, with the link in each of those e-mails, the switch in Settings, or by unsubscribing from all e-mails; withdrawal only affects the future and does not stop service e-mails.

Google Ads: only if you have given this consent, we send Google your e-mail address in hashed form (SHA-256) to measure which ads led to a sign-up.

Delivery records: our e-mail provider Brevo tells us whether each e-mail was delivered, opened, clicked, bounced or marked as spam. We store this per e-mail (time and counts) to see whether mails arrive and are read, and to stop sending to addresses that bounce or report spam.

3.2. What data we process

Depending on what you use:

  • Account: e-mail address, password (stored only as a salted hash), language, time zone, the date you accepted the terms, the Google ID if you sign in with Google and, if you came through a referral link, who referred you.
  • Settings and content you create: your preferences, watchlists and alert rules and, if you switch it on, two-factor authentication (the secret of your authenticator app and hashed backup codes).
  • Security records: when you register, log in, change your password or send a cancellation or withdrawal, we record the event with date and time, IP address and browser (user agent).
  • Cookie banner: when you use the cookie banner we record that you made a choice, with date and time, IP address, browser (user agent) and the version of the text, linked to your account if you are logged in.
  • Payments for earlier subscriptions: Stripe customer and subscription IDs, subscription status and invoices (amounts, VAT, dates). Card details are handled by Stripe only.
  • Cancellation and withdrawal forms: name, e-mail address, the reason if you give one, and a reference number; a copy of the confirmation goes to our own mailbox.
  • Analyze page: the topic or web address you type in (up to 255 characters) is kept in a cache without your account.
  • API keys (only if you create one on /developers): the name you give it, its first characters, the SHA-256 hash of the key (the key itself is not stored), when it was created, last used and revoked, and per day the number of calls per endpoint, without IP address. Purpose and legal basis: the key and its daily limit are the service you asked for (Art. 6(1)(b) GDPR); the counts per day also tell us whether the data is used more than once (Art. 6(1)(f) GDPR, our legitimate interest in knowing whether the open data is used; you can object under Art. 21 GDPR by writing to [email protected]). Deleted when you delete your account; a revoked key stays listed as revoked until then.

4. Third-party processors and recipients

We share data with the following processors:

  • OpenAI, Inc. (USA) – AI analysis of news articles (GPT models)
    Privacy policy → | Data retention: 30 days (API logs). We do not send fine-tuning data.
  • Anthropic, PBC (USA) – AI analysis of news articles (Claude models)
    Privacy policy → | Data retention: see Anthropic's privacy policy
  • Stripe, Inc. (USA) – payment processing for subscriptions concluded earlier; no new subscriptions are sold
    Privacy policy → | Data retention: 7 years (financial records), per legal requirements
  • Brevo (Sendinblue SAS) (France/EU) – delivery of service e-mails, with delivery records
    Privacy policy → | Data retention: duration of the service + 3 years
  • Netcup GmbH (Germany/EU) – hosting infrastructure (servers, database)
    Privacy policy (German) → | Data retention: duration of the contract + 90 days (backups)
  • Google Ireland Limited (Ireland/EU) – web analytics (Google Analytics 4) and conversion measurement for Google Ads, only with your consent
    Privacy policy → | Data retention: 2 months (user-level data), 14 months (event data). IP anonymization enabled.

AI analysis: the news we analyse comes from the public RSS feeds of publishers. The AI providers receive only the title and summary of those articles (after cleaning), aggregated analysis results and, for translations, texts shown on the site. They do not receive your name, e-mail address, IP address or other account data. The one exception: the market names that readers follow on their watchlists are put, grouped by audience and without any identifier, into the prompt that writes e-mail subject lines. We also run a language model on our own hardware; nothing is sent to a third party for that.

Our feature “AI Trading: News Picture” summarises publicly available financial news. The news pictures of the last 30 days are available to everyone. No personal trading activity or positions are collected or stored. The news pictures are generated from published news, not from individual user data.

Sign in with Google: if you accept “Third-party Authentication” in the cookie settings, the Google sign-in button is loaded and Google receives your IP address and browser details. We receive only your Google ID and e-mail address.

Discord and Telegram: we post market summaries into our own public channels. We only post; we store no data about the members of these channels, and the privacy policies of Discord and Telegram apply to your membership.

International transfers: Transfers to the USA (OpenAI, Stripe) comply with the EU-U.S. Data Privacy Framework or use Standard Contractual Clauses (SCCs) approved by the European Commission. Transfers to Anthropic rely on the Standard Contractual Clauses (SCCs) in Anthropic's Data Processing Addendum. You can find more information about the protection measures applied in each processor's privacy policy linked above.

5. Data retention

Data is stored only as long as needed for the service and legal compliance. Fixed periods:

  • accounts whose e-mail address is not confirmed are deleted after 7 days
  • the sign-up source (see 7) is deleted from your account 90 days after sign-up
  • payment notifications received from Stripe are deleted after 90 days; invoices are kept as required by law (see 6)
  • request counters used for rate limiting expire after one hour

6. Your rights

You have the right to:

  • Access (Art. 15 GDPR): request a copy of your personal data
  • Rectification (Art. 16): correct inaccurate data
  • Erasure (Art. 17): delete your data (“right to be forgotten”). Note: financial records are retained for 10 years per legal obligations.
  • Data portability (Art. 20): export your data in machine-readable JSON format
  • Objection (Art. 21): object to data processing
  • Restriction (Art. 18): restrict processing

How to exercise your rights:
• Export data: Settings → Export your data
• Delete account: Settings → Delete your account. The button asks for your password; if your account has none (you signed up with Google only), write to us instead. Deleting replaces your e-mail address with a placeholder, removes your password and the Google link and deletes your preferences and notifications; invoices are kept for legal reasons.
• Other requests: write to [email protected]

You can also lodge a complaint with the Spanish Data Protection Agency (AEPD).

Supervisory authority:
Agencia Española de Protección de Datos (AEPD) – www.aepd.es

7. Cookies and tracking

Without your consent we use only what the site needs to work, listed below. Optional services (Google Analytics 4, sign-in with Google, Google Ads measurement) are activated only after your explicit consent.

Stored in your browser without consent:

  • auth_token (local storage): your login token. It is valid for 7 days at most and removed when you log out; after 15 minutes without activity you are logged out (last_activity, local storage).
  • cookie_consent (local storage): your choice in the cookie banner.
  • preferred_language (cookie for 1 year, and local storage): your language, saved when you pick one.
  • td_disclaimer_seen (session storage): that the trading notice has already been shown in this session.
  • aiamond_vid (first-party cookie, 1 year): a random visitor ID that is set only while we test two wordings of the home page, so that you see the same wording each time.

Only with your consent: the Google Analytics 4 cookies (_ga, _ga_*) and, in session storage, utm_data (the sign-up source, see below).

Google Analytics 4 (GA4): When you accept analytics cookies, we use GA4 to understand how you use our platform. Data collected: pages visited, time on site, country/city (derived from anonymized IP), device type. Your IP address is anonymized before storage. You can manage your consent anytime from the cookie banner at the bottom of the page.

First-party offer measurement: Until Premium was switched off (1 November 2026) we recorded on our own servers, for free accounts, which Premium offers were shown and which were clicked, and whether checkout was started or completed (user ID, date, page, amount). Since then offers are no longer shown or measured. Payments we receive for subscriptions concluded earlier are still recorded as an event (user ID, date, invoice and Stripe customer reference, amount). Existing records are deleted 12 months after they were created at the latest. No cookies and no third parties. Legal basis: Art. 6(1)(f) GDPR (legitimate interest).

Sign-up source: To know which channels bring us users, when you create an account we store with it, where available: the domain of the page you came from (e.g. “reddit.com”, never the full address), the landing page and time of your first visit, and the link's campaign parameters (utm_*, Google Ads click ID). Until you sign up, this data exists only in the page's memory; it is written to your browser's session storage (sessionStorage) only if you have accepted analytics cookies. No cookies of our own and no third parties; we do not pass it to advertising partners. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in measuring which acquisition channels work). It is deleted from your account 90 days after sign-up. You can object to this processing under Art. 21 GDPR by writing to [email protected].

Days of use: For logged-in users we record one entry per day on which you used the site: your account and the date, no IP address and no page. It tells us whether people come back. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in knowing whether the service is used again). You can object under Art. 21 GDPR by writing to [email protected].

Test of the home page wording: While we test two wordings of the home page, we store your random visitor ID (cookie aiamond_vid), the wording you were shown and whether you then signed up with the e-mail form on the home page; if you are logged in, your account is linked. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in finding the clearer wording). You can object under Art. 21 GDPR by writing to [email protected].

See more details in our Cookie Policy.

7.1. Server logs and abuse protection

Our web server keeps the usual access log: IP address, date and time, the address requested, the response code, the browser (user agent) and the page you came from. The application also keeps technical logs, which can contain your e-mail address (for example when an e-mail is sent to you). We use them to run and secure the service and to find faults (Art. 6(1)(f) GDPR) and keep them only as long as needed for that.

To limit abuse, a request counter per IP address (or per account when you are logged in) is kept for one hour.

7.2. External services we do NOT use

To protect your privacy, we do NOT use:

  • Google Fonts CDN: we serve our fonts from our own server, so your IP address is not shared with Google for fonts.
  • Third-party CDNs (jsdelivr, unpkg, etc.): all JavaScript libraries are served from our server.
  • Google Analytics without consent: it is activated only after you give your consent in the cookie banner.
  • Google Login without consent: the Google sign-in button is loaded only after you accept “Third-party Authentication”.

We do not share your IP address with non-essential services without your explicit consent (Art. 6(1)(a) GDPR).

8. Contact

Email: [email protected]