Privacy Policy

Effective 2026-09-09.

This document is provided in English. The English version is the official and legally binding version; any translations are for convenience only — in case of conflict the English version prevails.

This policy explains what personal data we collect when you use TSP Core, why we collect it, the legal bases on which we rely, and what you can do about it.

1. Who is the data controller

The data controller for personal data processed through TSP Core is Maksym Rudevych, a sole proprietor (ФОП) registered in Ukraine, operating the website at tspcore.com. Contact for privacy questions and rights requests: [email protected].

2. What we collect

• Account data — email, first name, surname, and a cryptographically-protected password. Optional: referral code presented at sign-up.
• Google Sign-In data — if you choose to sign in with Google we receive a limited profile from Google: a Google account identifier, your email address and its verified flag, first name, surname, avatar picture and language preference. We never see your Google password.
• Activity data — login timestamps, last-active timestamp, cumulative session duration, IP address and User-Agent header of each authenticated session.
• Configuration data and saved content — your alert preferences (sound, duration, email opt-in), saved chart drawings, registered price alerts, chart layouts and workspaces, saved setups and chart snapshots. If you create a share link for a snapshot or setup, the shared page is public: anyone with the link can view that content until you delete it.
• Device records — a random device identifier (see the Cookies policy) and, for signed-in accounts, a server-side record of the devices that used the account. Used to enforce per-account device limits and the one-free-trial-per-device rule.
• Subscription and trial records — your current plan, trial start and end dates, and whether a free trial has been used on the account or device.
• Product analytics — only after you accept the cookie banner: a random first-party analytics identifier, page views and feature-usage events, and acquisition attribution (the referrer, campaign tags and landing page of your first visit). Independently of the banner, server-side lifecycle events tied to your account (for example sign-up, trial start, first chart opened, subscription changes) are recorded as part of operating the service.
• Consent record — your accept/reject choice from the cookie banner.
• Email logs — subject lines and delivery status of transactional and service emails (verification, password reset, alert fan-out, billing and subscription-lifecycle notices). We do not store message bodies after dispatch.
• Limited payment metadata from Paddle — customer id, subscription id, plan, payment status, billing period and transaction status. We do not see or store card numbers, bank details, or full billing addresses; those stay with Paddle.

We do not collect payment card data or government IDs. Beyond the limited Google Sign-In profile described above, we do not collect third-party social profiles.

3. How we use it

• To authenticate you and run the platform.
• To send transactional and service email — email verification, password reset, price-alert notifications, and billing, plan-change and subscription-lifecycle notices about your own account. These are part of operating your account and cannot be switched off while the account exists.
• To send occasional product email about TSP Core itself — what has changed in the platform, and reminders to come back if you have not used it for a while. This is separate from the service email above: every such message carries a one-click unsubscribe link, and you can turn it off at any time without affecting your account or the service email you still receive.
• To detect abuse and operational issues (rate limits, sign-in anomalies, per-account device limits).
• To administer the free trial — including enforcing that a free trial is used once per account and once per device.
• To measure how TSP Core is used with our own first-party analytics, only after you accept the cookie banner.
• To attribute referrals between accounts.
• To provide and renew paid access (acting on payment confirmations received from Paddle).

We do not sell personal data. We run no third-party advertising or analytics trackers anywhere on the site; the only analytics is our own first-party measurement described above, and its browser identifiers are set only with your consent.

4. Legal bases

Where the GDPR or an equivalent law applies, we rely on the following legal bases:

• Performance of a contract — for account data and any processing required to provide the service you signed up for, including paid subscriptions.
• Legitimate interest — for security and activity logs (keeping the platform secure, preventing abuse — including device limits and one-free-trial-per-device enforcement — and troubleshooting operational issues), for server-side lifecycle records about your own account, for service emails about your account, billing and trial state, and for protecting our legal rights.
• Legitimate interests — for product email about TSP Core sent to people who already hold an account, so we can tell existing users what has changed in the product they signed up for. We balance this against your interests by keeping the volume low, by carrying an unsubscribe link in every such message, and by honouring an objection immediately and permanently.
• Consent — for optional alert emails, for the first-party analytics and attribution cookies, and for other non-essential storage on your device (see Cookies policy). You can withdraw consent at any time — the footer's Cookie settings link reopens the banner — without affecting processing carried out before withdrawal.
• Legal obligation — for tax, accounting and fraud-prevention records related to paid transactions.

5. Payments

Paid subscriptions and checkout are processed by Paddle, our Merchant of Record and payment provider. We do not collect or store payment card numbers. Paddle may process billing details, tax information, payment identifiers, receipts, invoices and transaction history in accordance with its own buyer terms and privacy notice. We receive limited payment-related information from Paddle — customer id, subscription id, plan, payment status, billing period and transaction status — so that we can provide or update paid access.

6. Cookies

We use a small number of first-party cookies: strictly-necessary cookies for authentication, CSRF protection, your consent choice and abuse prevention, plus — only with your consent — first-party analytics and attribution cookies. Full details, lifetimes and controls: Cookies policy.

7. Where data lives

Account and activity data is stored on servers operated by TSP Core in the European Union. Transactional and service email (verification, password reset, alert notifications, billing and subscription-lifecycle notices) and product email about TSP Core are delivered via an external email-sending provider. Market data is ingested directly from supported exchanges.

8. Service providers

We use third-party service providers for hosting, email delivery, payment processing, security, logging and infrastructure operations. These providers process personal data only as needed to provide their services to us, under contract, and only for the purposes we instruct. The categories we use are:

• Hosting / infrastructure — a cloud infrastructure provider operating data centres in the European Union.
• Edge / CDN / DDoS protection — a global edge network provider that fronts the website.
• Transactional email delivery — an external email-sending provider used for account verification, password reset, alert notifications and subscription-lifecycle notices.
• Payments — Paddle, our Merchant of Record (see section 5).

We can name the specific providers in each category on request — email [email protected].

9. International transfers

Some service providers may process data outside your country or the European Economic Area. Where required, we rely on appropriate safeguards such as adequacy decisions, EU Standard Contractual Clauses, or equivalent legal mechanisms to ensure your data receives a comparable level of protection.

10. Retention

Account records are kept for the lifetime of your account plus 12 months after deletion (for fraud-prevention and tax-reporting reasons). Session and activity logs are kept for 12 months. Payment-related records may be kept longer where tax or accounting law requires it. When your account is deleted, acquisition-attribution and activation records are deleted with it, and remaining product-analytics events are unlinked from your account so they no longer identify you. Cookie and identifier lifetimes are listed in the Cookies policy. You can request earlier deletion — see Your rights below.

11. Your rights

Depending on where you live, you may have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data or update outdated fields.
• Request deletion of your account and associated data.
• Export your data in a portable format.
• Object to or restrict certain types of processing.
• Withdraw consent for processing based on consent.
• Opt out of non-essential emails. Product email about TSP Core can be switched off with the unsubscribe link in any such message, which takes effect immediately and needs no sign-in; alert email notifications are opt-in already. Verification, password reset, and billing, plan-change and subscription notices are part of operating your account and cannot be disabled while the account exists.
• Lodge a complaint with your local data-protection authority.

To exercise any of these rights, email [email protected]. We respond within 30 days.

12. Security

Passwords are stored in a cryptographically-protected form and never kept in plain text. Sessions run over HTTPS only; the session cookie is HTTP-only and protected against cross-site request forgery. We never log raw passwords or password-reset tokens beyond what's strictly necessary to deliver them.

13. Children

TSP Core is not intended for users under 18. We do not knowingly collect data from anyone under that age.

14. Changes

Material changes to this policy will be announced inside the dashboard or via the email on your account. The effective date at the top of this page always reflects the latest version.