Privacy statement
This statement explains which personal data Luxabit processes, why, and what your rights are. The Dutch version is leading; this English version is a translation.
Who is responsible
Luxabit is the controller for the processing described here.
- Chamber of Commerce (KvK): 42192384
- Email for privacy questions: support@luxabit.nl
What we process
| What | Examples |
|---|---|
| Account | First and last name, email address, password (stored hashed by our authentication provider) or, if you log in with Google, the link to your Google account, if you turn on two-factor authentication the key of your authenticator app (kept by our authentication provider) and your recovery codes (stored hashed), language, plan, the date you confirmed the risk statements and that you are 18 or older |
| Your trading plan | Your rules, limits, trading hours and timezone |
| Your journal | Trades, prices, position sizes, fees, results, tags, notes, your answers per rule, Discipline Score |
| Conversations and reviews | Your messages to the coach, its answers, the trade plans recorded in them, post-trade reviews and the chart images you add to them |
| Exchange connection (if you connect OKX, Bybit, or Binance) | Your read-only API key (encrypted) and the trades imported with it |
| Platform connection (if you connect cTrader) | The access you gave Luxabit to view your accounts (encrypted), the number of the account you chose, and the trades imported with it |
| Daily routine | Your check-in before trading (whether you trade, read your plan, your focus and intention), your reflection at the end of the day, and the days that count for your streak. If you turn on reminders: their times and, per device, the push address your browser gives out |
| Payments | Plan, subscription status, Stripe customer number. Card and bank details are handled by Stripe; we don't see them |
| Usage and quality | Number of coach messages and reviews per month, technical usage data per answer (model, tokens, cost), and a log of the coach's answers with the result of the automatic check and any report you made |
| Technical data | IP address, browser and access times in our hosting provider's logs |
| Visit statistics | Per page view, without cookies: the page, the website you came from, campaign tags in the link, country, type of device, and a code made from your IP address and browser with a key that changes every day. We don't store your IP address or link visits to your account. Our hosting provider Vercel also counts the same page views for us (Web Analytics), likewise without cookies: the page, the website you came from, campaign tags, country, browser, operating system and type of device |
We don't ask for special categories of personal data (such as health). Please don't put those, or other people's personal data, in your notes or charts.
Why, and on what basis
| Purpose | Legal basis |
|---|---|
| Providing your account, trading plan, journal, coach, reviews and exchange import | Performance of the contract |
| Payment, invoices and tax administration | Performance of the contract; legal obligation (tax retention) |
| Applying the limits of your plan | Performance of the contract |
| Checking the coach's answers so that it gives no investment advice, handling reports, and spot checks of answers | Legitimate interest: keeping the service safe and within the law |
| Security, preventing abuse, troubleshooting | Legitimate interest |
| Counting visits to improve the website and app | Legitimate interest |
| Service emails (confirming your email address, password reset, security notices such as two-factor authentication being turned off, important changes) | Performance of the contract |
We don't use your data for advertising and don't sell it.
The AI coach
The coach runs on Claude, an AI model of Anthropic. To answer, it receives your trading plan, the relevant trade data and your messages, notes or charts. Amounts of money are removed from messages and notes first. Anthropic processes this data on our behalf and, under its commercial terms, does not use it to train its models.
The Discipline Score, the pre-trade check and the patterns in your journal are calculated from your own data, only for you. They don't lead to decisions with legal effects for you or that affect you similarly significantly.
Who receives your data
We use these service providers. They only process your data on our instructions and under a data processing agreement.
| Provider | For | Where |
|---|---|---|
| Supabase | Database, login, file storage, account emails | EU (Ireland) |
| Vercel | Hosting of the website and app, visit statistics | EU (Dublin); US company |
| Anthropic | The AI model that runs the coach | United States |
| Stripe | Payments, invoices | EU and United States |
| Resend | Emails about your account and plan | United States |
If you log in with Google, Google tells us your name and email address (and your profile photo, which Luxabit doesn't use); Google's own privacy statement applies to your Google account. Stripe is also responsible itself for part of the payment data (for example to prevent fraud and meet financial rules); its own privacy statement applies to that. If you connect an exchange (OKX, Bybit, or Binance) or a platform (cTrader), Luxabit fetches your trades from it with your key or the access you gave, and the balance of your trading account for the position size calculator (shown in your browser, not stored); the exchange's or platform's own privacy statement applies to your account there. If you use dictation in the chat, your browser turns speech into text (in some browsers through its maker's speech service); Luxabit only receives the text you send. If you turn on reminders, they are delivered through your browser's push service (Google for Chrome and Android, Apple for Safari and iPhone, Mozilla for Firefox, Microsoft for Edge). It receives only the encrypted notification and when to deliver it; the text can't be read by the push service.
We only give data to others when the law requires it, for example to the tax authorities.
Transfers outside the EU
Anthropic, Resend, Stripe and Vercel are (part of) American companies. Where data goes to the United States, this is covered by the EU–US Data Privacy Framework or the European Commission's standard contractual clauses. [Draft: check per provider which basis applies.]
How long we keep your data
| Data | Retention |
|---|---|
| Account, trading plan, journal, conversations, reviews, charts, exchange connection, usage data | As long as your account exists. When you delete your account, they are deleted immediately |
| Log of the coach's answers | 12 months, or earlier when you delete your account |
| Invoices and payment details | 7 years, as Dutch tax law requires (with Stripe) |
| Hosting logs | Only briefly, as set by our hosting provider |
| Visit statistics | 13 months (at Vercel: as set by Vercel) |
Deleted data can remain in backups for a short time, until they are overwritten. [Draft: add the retention of backups and what happens to inactive accounts.]
Security
Your data is sent encrypted (HTTPS). Every user can only reach their own data (row level security). Chart images are in private storage. Exchange keys are encrypted (AES-256-GCM) before they are stored, and must have read-only rights. Only what is needed to run and support the service is accessible to us.
Cookies and local storage
Luxabit only uses functional cookies, with no consent needed:
- locale: remembers your language (1 year);
- theme: remembers whether you chose the dark or the light look (1 year);
- sb-luxabit-auth-token: keeps you logged in.
The app also remembers the layout of your workspace in your browser (local storage). Visits are counted without cookies (see above). We don't use tracking or advertising cookies.
Your rights
You have the right to access, correct and delete your data, to restrict or object to processing, and to receive your data in a usable format. Much of this you can do yourself: change your plan and journal in the app, export your journal as CSV, or delete your account. For anything else, email support@luxabit.nl. We reply within one month.
You can also file a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens). We would appreciate it if you contact us first.
Minors
Luxabit is only for people aged 18 or older.
Changes
We update this statement when our processing changes. The date at the top shows the latest version. We tell you about important changes by email or in the app.