Legal

Privacy Policy

1. Data Controller

The controller responsible for data processing on this website, within the meaning of the General Data Protection Regulation (GDPR), is:

Hendrik Hangmann

Leopoldstr. 2-8
32051 Herford
Germany

Email: datenschutz@partiqon.com

Phone: +49 155 11556245

2. General information on data processing

We only process personal data of our users to the extent necessary to provide a functioning website and our content and services.

Each processing described in this privacy policy states its legal basis in its own section. We rely in particular on Art. 6(1)(b) GDPR where the processing is necessary to perform a contract with you or to take steps at your request before entering into one (for example the waitlist, section 7, the emails in section 7a, the datasets you upload, section 7b, the strategy templates you publish, section 7c, and a paid plan and its payment, section 7e, and the AI strategy assistant and the Pine Script import, section 7f), and on Art. 6(1)(f) GDPR where it is necessary for our legitimate interests (for example the server log files, section 4, the usage recording in the application, section 6a, the error tracking, section 7d, and keeping the proof of your statements about a paid plan, section 7e). Where the law obliges us to process data, the legal basis is Art. 6(1)(c) GDPR (for example keeping invoices and booking records, section 7e). Where we ask for your consent, the legal basis is Art. 6(1)(a) GDPR; you can withdraw such consent at any time with effect for the future.

3. Your rights as a data subject

You have the following rights regarding personal data concerning you:

You can download a copy of the data stored for your account yourself, on your account page with "Download my data": your records as JSON and CSV files and your files as they are stored, for example datasets in the format you uploaded them. The copy is prepared when you ask for it, offered for download for 24 hours and then deleted. If you cannot sign in, write to datenschutz@partiqon.com from the email address of your account.

The supervisory authority responsible for partiqon:

Landesbeauftragte für Datenschutz und Informationsfreiheit Nordrhein-Westfalen (LDI NRW)

Kavalleriestraße 2–4, 40213 Düsseldorf

Phone: 0211 384 24-0

Postal address: Postfach 20 04 44, 40102 Düsseldorf

Email: poststelle@ldi.nrw.de

www.ldi.nrw.de

4. Data collected when visiting the website

Each time our website or the partiqon application is accessed, our web server records the request in its log files (server log files):

The programs that run the website and the application also write technical messages to the server's system log, for example when an error occurs; such a message can contain details of the request concerned.

The server log files and the system log serve to ensure trouble-free operation and the security of our IT systems, for example to investigate misuse (Art. 6(1)(f) GDPR); our legitimate interest lies in these purposes. This data is not combined with other data sources, nor is it evaluated for marketing purposes. We delete it 14 days after the end of the day on which it was recorded.

In addition, the partiqon application keeps its own record of every request it answers: the date and time, the kind of request (HTTP method), which function of the application was called, the access status and how long the answer took. The function is recorded in its general form (for example /api/graph/get/<name>), without the names of your strategies or datasets. When you are signed in, the record contains a code for your account instead of your email address: the first ten characters of a SHA-256 hash calculated from the address, from which the address cannot be read, but which the same address always produces again. It contains no IP address and nothing you entered. For an address that matches no function of the application, the address requested is recorded, shortened to 200 characters; an email address contained in it is replaced by its code in the same way. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in operating the application securely, in investigating misuse and in knowing which functions are used before one is changed or removed. The records of each day are deleted 180 days after the end of that day; this also applies when you delete your account, so until then the records made before the deletion remain, with the code of your account. After the deletion we no longer hold your email address, so we can no longer assign these records to you unless you give us the address again. Records made before this version of the privacy policy may contain the email address itself instead of the code; they are deleted after the same period.

4a. Visitor statistics

To know how many people visit our website and which pages they read, we evaluate a second log of our web server ourselves, on our own server. No other company is involved, no cookie is set, nothing is stored in your browser, and the pages load no script for it.

For each page you open, this log records: your IP address, shortened before it is written (the last of its four parts set to zero for an IPv4 address, the last 80 of its 128 bits for an IPv6 address), so that it no longer identifies your connection; the date and time; the page, without anything after a question mark; the access status and the amount of data transferred; the website you came from, its address only, without the page; and your browser's identification (user agent). Requests from programs that identify themselves as automated (search engine crawlers, for example) are not recorded.

Once a night we compute a summary from this log: the number of visits and visitors per day, the pages read, the websites visitors came from, and the browsers and operating systems used. The summary contains no IP address, and only we can open it.

The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in knowing how our website is used, in order to improve it. We delete this log 14 days after the end of the day on which it was recorded; the summary is replaced every night and covers only these 14 days. You may object to this processing at any time on grounds relating to your particular situation (Art. 21 GDPR), for example by email to datenschutz@partiqon.com.

5. Hosting

This website is hosted by an external service provider. The personal data collected on this website is stored on the hosting provider's servers.

The hosting provider is Strato AG, Otto-Ostrowski-Straße 7, 10249 Berlin, Germany. Servers are located in Germany. A data processing agreement (Art. 28 GDPR) has been concluded with the hosting provider.

The use of the hosting provider serves to fulfill our contractual obligations toward our prospective and existing users (Art. 6(1)(b) GDPR) and is in our interest of a secure, fast, and efficient provision of our online services (Art. 6(1)(f) GDPR).

6. Cookies and similar technologies

Our website uses technically necessary local storage required for the operation of the site, for example to store your theme preference. These preferences are not used for marketing purposes.

When you sign in to the partiqon application, a technically necessary cookie (partiqon_session) keeps you signed in. It is used for nothing else and expires no later than seven days after you last used the application.

We do not use any third-party analytics, tracking or measurement service, no advertising cookies and no tracking across other websites. Within the application, we do record ourselves how signed-in users use it, as described in section 6a. No cookie is used for that recording.

When you open the order form for a paid plan in the application, it loads the payment form of our payment provider Stripe (section 7e) from js.stripe.com; Stripe's script is loaded only there and then. To prevent fraud, Stripe stores two cookies on this site (__stripe_mid and __stripe_sid), sets further cookies of its own and of the services it uses against fraud within its payment form, and collects information about your device and how the payment form is used. This is technically necessary for the payment you ask for (section 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act, TDDDG); Stripe processes the information as described in section 7e.

6a. Usage recording in the application

When you use the partiqon application while signed in, we record how you use it. Unlike the server log files described in section 4, these records are assigned to your account (your email address), and they go beyond the request record described there. They contain:

If an error occurs on our server while you are not signed in, the same technical details are recorded without being assigned to an account.

We use these records to improve partiqon, to find and fix errors, and to help you when you contact us for support. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in exactly these purposes. The records are collected and evaluated by us alone: they are not passed on to third parties (apart from the hosting provider named in section 5, which stores them on our behalf), not used for advertising and not combined with data from other sources.

We delete these records 180 days after they were recorded (see section 9).

Right to object: you may object to this processing at any time on grounds relating to your particular situation (Art. 21 GDPR), for example by email to datenschutz@partiqon.com. We will then no longer process your usage data for these purposes, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves the establishment, exercise or defence of legal claims.

You can also object directly in the application, on your account page under “Usage recording”. From the moment your objection is entered, nothing about how you use the application is recorded for your account any more, and the records stored for your account until then are deleted. You can withdraw your objection there at any time; recording then resumes from that moment.

7. Waitlist sign-up

If you sign up via our waitlist form, we collect your email address, the time of the sign-up, the language of the page you signed up on and, if you leave one, your note (up to 140 characters). We use this data solely to notify you when access to partiqon becomes available to you.

The legal basis is Art. 6(1)(b) GDPR (a pre-contractual measure taken at your request).

The service that receives the form deletes your sign-up 12 months after you signed up. The list from which we send the invitations keeps it until the first of these applies: 12 months have passed since you signed up and you have not registered, also if we invited you; 30 days have passed since we decided not to invite you; or an account has been created with your email address, in which case we delete it no later than one day after the account was created. You can ask us at any time to delete your sign-up earlier, for example by email to datenschutz@partiqon.com.

We keep a copy of the waitlist as a backup on a storage device we operate ourselves. A new copy is made every day and each copy is deleted after 14 days, so a deleted sign-up remains in these copies for up to 14 days after its deletion. The copies are used only to restore the waitlist after a loss of data.

7a. Sending emails

We send the emails required for using partiqon via the Transactional Email service of Scaleway SAS, 8 rue de la Ville-l'Évêque, 75008 Paris, France. These are in particular invitations from the waitlist, emails to confirm your email address, to reset your password and to confirm a change of your password or address, notices before unused datasets are deleted, the confirmation of a paid plan with the withdrawal instructions, notices about failed payments, confirmations of a cancellation or withdrawal you declared, notices of a change of the Terms or of a price, and notifications you set up yourself in pipelines. Feedback you send through the platform's feedback function reaches us via the same service.

In doing so, your email address, the content of the respective message and technical delivery data are processed: the time of sending, the delivery status and the answer of the mail server receiving the message on your side. We query the delivery status to establish whether a message has reached your mail server; in particular, a dataset is deleted only if the notice about it has demonstrably been delivered. Processing takes place in the European Union, in Scaleway's data centres in the Paris region.

Neither Scaleway nor we record whether or when you open an email or click a link in it. The emails contain no tracking image: the only image is the partiqon logo, which your email program may load from partiqon.com under the same address for every email, so loading it does not reveal who opened which email. Every button and link in the emails leads to partiqon.com directly. Scaleway's service offers no open or click recording at all.

We store the language in which you receive these emails (English or German) with your sign-up or your account. It follows from the language of the page you signed up on and can be changed at any time in your account settings.

The legal basis is Art. 6(1)(b) GDPR (performance of a contract or pre-contractual measures). Scaleway processes this data on our behalf under a data processing agreement pursuant to Art. 28 GDPR.

7b. Datasets you upload

Datasets you upload (for example historical price data) are stored in a storage area assigned to your account and processed only on your behalf, to provide the functions you use. They are not made accessible to other users, not passed on to third parties other than the hosting provider named in section 5, not combined with other users’ data, and not used as training data, including for AI models. Section 4 of the Terms states the same.

The legal basis is Art. 6(1)(b) GDPR (performance of a contract). How long datasets are kept is set out in section 9.

7c. Strategy templates and reports

You can offer the structure of one of your strategies to other users as a template. A template contains the blocks, how they are connected and laid out, the names you gave them and the text of formulas. It contains neither your parameter values nor any data. Before a template is published, an administrator of partiqon reviews it. With the template we store your email address, so that you can see and withdraw your submissions, together with the time of submission and of the review. Once a template is approved, its title, description, category, tags and structure are visible to all signed-in users. Your email address is shown only to the administrators who review templates, never to other users.

The legal basis is Art. 6(1)(b) GDPR: publishing a template and reviewing it are services you request under your contract with us. A template you withdraw, or one that is not approved, is no longer shown to other users. When you delete your account, all your templates are deleted with it, including published ones.

A withdrawn template is deleted 30 days after you withdrew it, one that was not approved 90 days after that decision, so that you can read the reviewer's note in the meantime. Deleting it removes the template with its title, description, structure and your email address, together with every report about it.

If you report a published template, we store your email address, the reason you selected, the note you may add (up to 500 characters), the time of the report and how an administrator dealt with it. Only the administrators who review templates see reports. The author of the template is not told that it was reported, nor by whom. We use reports to check the reported template and, if it breaks the rules of the platform, to take it down. The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in preventing misuse of the platform and protecting its users. A report is deleted together with the template it concerns, when you delete your account, and when the author of the reported template deletes theirs.

7d. Error tracking

To find and fix errors in partiqon, we use the error tracking service Sentry of Functional Software, Inc., 45 Fremont Street, 8th Floor, San Francisco, CA 94105, USA. When an error occurs on our server or in the application in your browser, a report about it is sent to Sentry. It contains:

The report contains no information about your account, no email address, no cookies, no sign-in data, nothing you entered and no record of where you clicked. When the report comes from your browser, your browser sends it directly to Sentry, which technically receives your IP address in the process; it is not stored with the report. Sentry stores the reports in its data region in the European Union.

The legal basis is Art. 6(1)(f) GDPR; our legitimate interest lies in operating a service that works and is secure. Sentry processes this data on our behalf under a data processing agreement pursuant to Art. 28 GDPR. Error reports are deleted no later than 90 days after they were received.

7e. Paid plans and payments

If you book a paid plan (Pro or Premium), the payment is processed by Stripe Payments Europe, Limited, The One Building, 1 Grand Canal Street Lower, Dublin 2, Ireland ("Stripe"). You enter your payment details in Stripe's payment form, which is shown in the order dialog of the application and is run by Stripe. Card numbers and the other data of your payment method go straight to Stripe and never reach our servers.

Stripe receives from us your email address, the language of the payment form and the plan and billing interval you chose. In its payment form Stripe collects the data of your payment method and, where the payment method requires it, your name and billing address; the payment method you pay with is stored with your customer record at Stripe for the renewals. Stripe then holds the subscription, the invoices and the payments. From Stripe we receive, and store with your account, the identifiers of your customer record and of your subscription at Stripe, the plan, the billing interval, the state of the subscription, when it started and, once it has ended, when it ended, the end of the current billing period and, after a failed payment, the date until which your plan is kept. We do not receive your card number.

With your order, you ask us to begin the service before the end of the withdrawal period and confirm what that means for your right of withdrawal (see the withdrawal instructions). We store this statement as proof: its wording, its version and language, the time you made it, the plan and, once your first payment is through, the identifier of the subscription at Stripe. Declarations you make on our contract pages (a cancellation or a withdrawal) are stored with what you entered (your name, your email address, the contract, the kind of declaration and, for a cancellation, its reason and the end you asked for) and the time we received them.

The legal basis for processing your data to conclude and perform the subscription, including the payment, is Art. 6(1)(b) GDPR. Invoices and the records we need for bookkeeping are processed to meet our statutory retention obligations under tax and commercial law (Art. 6(1)(c) GDPR). Keeping the proof of your statement and of your declarations after the contract has ended rests on Art. 6(1)(f) GDPR; our legitimate interest lies in being able to prove, in the event of a dispute, what was agreed and declared.

Stripe processes payment data on our behalf and, in addition, as a controller in its own right for its own purposes, such as preventing fraud and meeting its legal obligations as a regulated payment services provider; for that processing Stripe's own privacy policy applies (stripe.com/privacy). Stripe may transfer data to Stripe, Inc. in the USA. According to Stripe, it bases such transfers on the EU-U.S. Data Privacy Framework, under which Stripe, Inc. is certified, and on the standard contractual clauses approved by the European Commission.

Invoices and booking records are kept for eight years and business letters for six years, each counted from the end of the calendar year in which they were created (section 147 of the German Fiscal Code and, where it applies, section 257 of the German Commercial Code). The proof of your statement is kept with your account. When your account is deleted, it is kept without your email address or any other information that identifies you directly (only a pseudonymous reference, the wording and version of the statement, the time it was made, the plan and the Stripe identifiers of the customer record and the subscription) until the end of the third calendar year after the year in which the subscription ended, and is then deleted automatically. That is the period in which claims about the contract can be asserted (sections 195 and 199 of the German Civil Code); until then it is excepted from erasure under Art. 17(3)(e) GDPR. Declarations made on our contract pages are kept for the same period, counted from the year we received them, whether or not you delete your account. When your account is deleted, your customer record at Stripe (your email address, the payment method stored with it and, where given, your name and billing address) is not deleted with it: it is the addressee of the invoices, which must be kept. It is kept until the end of the eighth calendar year after the year in which your account was deleted and is then deleted automatically; if no invoice was ever sent to you, it is deleted within a day of the deletion of your account (Art. 6(1)(c) and Art. 17(3)(b) GDPR). Stripe keeps the invoices and payments themselves as its own legal obligations require.

7f. AI strategy assistant and Pine Script import

Two functions of the application use an AI model of an external provider: the strategy assistant, which turns a strategy you describe in a chat into a strategy graph, and the import of TradingView Pine Script code into a strategy graph. Nothing is sent to the provider unless you use one of these functions.

When you send a message to the strategy assistant, we pass on to the provider your message together with the earlier messages of the same conversation (yours and the assistant's replies, up to a number of messages we set), the market and timeframe you selected, and our own instructions to the model. When you import Pine Script code, we pass on the code and the name you give the strategy. We do not pass on your email address, any other information about your account, your IP address or your datasets; the provider receives the request from our server, not from your browser. Please do not put personal data into your messages or into the code.

The provider that processes these requests is Anthropic Ireland, Limited, 6th Floor, South Bank House, Barrow Street, Dublin 4, D04 TR29, Ireland ("Anthropic"). We can switch both functions to OpenAI Ireland Ltd, 1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland ("OpenAI"); only one of the two processes the requests at any time, and unless we switch, it is Anthropic. Each processes the data on our behalf under a data processing agreement pursuant to Art. 28 GDPR, which is part of its terms for business customers.

Both providers belong to groups based in the USA, and your requests may be processed on servers outside the European Union, in particular in the USA. For such transfers, Anthropic's data processing agreement incorporates the standard contractual clauses approved by the European Commission; OpenAI's bases them on those clauses or on an adequacy decision of the European Commission. Neither provider uses the requests sent through its interface for business customers to train its models. According to their terms, Anthropic deletes requests and answers within 30 days, but may keep a request it has flagged as a possible breach of its usage policy for up to two years, and OpenAI keeps requests and answers for up to 30 days to detect misuse, unless the law requires longer.

The legal basis is Art. 6(1)(b) GDPR: the assistant and the import are functions you request under your contract with us.

We do not store the content of a conversation with the assistant on our servers; your browser keeps it until you start a new conversation. For your account we store an identifier for each conversation with the number of follow-up questions the assistant asked in it and the times it was started and last used, and delete it 30 days after it was last used. We also count your messages to the strategy assistant per day, to apply the limits of your plan, and delete each day's count 14 days after the end of that day.

7g. Emails you write to us

When you write to us by email, for example to support@partiqon.com or datenschutz@partiqon.com, or reply to an email from us, your message is received and stored in our mailbox at Migadu-Mail GmbH, Rohnen 587, 9414 Schachen, Switzerland. We process your email address, the content of your message and its attachments, and the technical data of the delivery (the time and the sending and receiving mail servers), in order to answer your request. According to Migadu, its data centres are located in France. Migadu processes this data on our behalf under the data processing agreement contained in its privacy policy (Art. 28 GDPR). The European Commission has decided that Switzerland ensures an adequate level of data protection (Art. 45 GDPR); access to the data by Migadu from Switzerland is based on that decision.

The legal basis is Art. 6(1)(b) GDPR where your request concerns a contract with us or its preparation, and otherwise Art. 6(1)(f) GDPR; our legitimate interest lies in answering your request. We answer requests concerning your rights as a data subject under Art. 6(1)(c) GDPR.

We keep your message for as long as we need it to deal with your request, and delete it at the latest at the end of the calendar year after the last message of the conversation. A message that is a business letter we are required to keep under tax and commercial law is kept for six years after the end of the calendar year in which it was received.

8. Disclosure of data to third parties

We do not transfer your personal data to third parties for purposes other than those stated. We only share your personal data with third parties if:

9. Data retention

Unless a more specific retention period is stated within this privacy policy, your personal data remains with us until the purpose for processing no longer applies. Where statutory retention periods apply (e.g., for commercial or tax reasons), deletion takes place after these periods expire.

We store datasets you upload for as long as you use them. If a dataset has not been used in any backtest for 90 days, we notify you by email; the dataset is deleted no earlier than 14 days after that message has been delivered, unless you use it again before then. Details are set out in section 4a of the Terms.

If you sign up yourself and do not confirm your email address, the account can never be used. We delete it, together with everything stored for it, 30 days after registration.

We delete records of how you use the application (which pages you open, how long you stay and which runs you start, together with your browser's identification, your country and your shortened IP address) 180 days after they were recorded.

The list of your runs in the application (backtests, optimisations and the other analyses you start, each with its settings and its result) keeps a run for 30 days after it finished and then deletes it. We keep the list to show you your runs and their results (Art. 6(1)(b) GDPR).

The application's record of the requests it answers names your account only by a code, not by your email address. It is deleted 180 days after the end of the day of the request, also when your account was deleted before then. The web server's log files and the system log are deleted 14 days after the end of the day on which they were recorded (section 4).

Our backups do not contain the application's database or the files stored for your account. They contain the daily copy of the waitlist (section 7), whose copies are deleted after 14 days, so a deletion reaches them after 14 days at the latest. Should a backup ever be restored, every deletion recorded since that backup is carried out again before the application is used.

When an account is deleted, at your request or under one of the rules in this section, we keep a record that the deletion took place: a code calculated from the email address of the account (a SHA-256 hash, from which the address cannot be read, but which the same address always produces again), the time, who carried out the deletion and the reason. We keep it to be able to show that the deletion took place (Art. 6(1)(c) GDPR in conjunction with Art. 5(2) GDPR), until the end of the third calendar year after the year of the deletion, and then delete it automatically.

Strategy templates you submit are kept while they are waiting for review or published; a withdrawn one is deleted 30 days after the withdrawal and one that was not approved 90 days after that decision, each with the reports about it. Reports you make are deleted with the template they concern, or when you delete your account (section 7c). Error reports are deleted no later than 90 days after they were received (section 7d). Emails you write to us are kept as set out in section 7g.

Data about a paid plan is kept as set out in section 7e: invoices and booking records for eight years, business letters for six years, and the proof of your statements and declarations until the end of the third calendar year after the year in which the subscription ended or the declaration was received.

When we propose a change of the Terms or a new price for your plan, we record for your account whether and when you agreed to it, declined it or objected to it, together with the words you were shown, their language and, for an answer you sent us by email, how we received it. We keep this record for as long as your account exists, to know which terms and which price apply to your contract (Art. 6(1)(b) GDPR). When your account is deleted, we keep it without your email address, under a pseudonymous reference, until the end of the third calendar year after the year of the deletion, to be able to prove in the event of a dispute what was agreed (Art. 6(1)(f) GDPR), and then delete it automatically.

10. SSL/TLS encryption

For security reasons, this website uses SSL/TLS encryption. You can recognize an encrypted connection by the fact that the address bar of your browser changes from "http://" to "https://" and by the lock icon in your browser bar.

11. Changes to this privacy policy

We reserve the right to adapt this privacy policy so that it always complies with current legal requirements, or to reflect changes to our services. The new privacy policy will apply on your next visit.

Last updated: October 2026  ·  partiqon is a product by Hendrik Hangmann.