Privacy Policy

1. Data Controller

The controller responsible for processing personal data for PolySimulator is:

2. Scope and Short Summary

This Privacy Policy explains how PolySimulator processes personal data when you use our website, simulated trading features, accounts, paid plans, API beta, waitlists, alerts, analytics, support, and related services. It is intended to be a concrete GDPR Article 13 notice rather than a generic checklist.

3. Processing Activities, Legal Bases, Recipients, and Retention

The table below maps our main processing activities to data categories, legal bases, recipients, and retention periods. Exact retention can vary if we must preserve records for legal claims, security incidents, tax/accounting obligations, backups, or abuse investigations.

Where we rely on legitimate interests under Art. 6(1)(f) GDPR, our interest is operating a secure, stable, and fairly administered Service and preventing fraud, unauthorized access, abuse, manipulation, outages, and harm to users or the platform.

4. Communications, Marketing, and Your Right to Object

Service messages about account access, security, authentication, billing, legal changes, API/beta access, season resets, support, and alerts you configure are processed where needed for contract performance, security, legal compliance, or reliable delivery of the Service.

Waitlist and beta-program emails are processed to manage the program you selected, including launch notification, access invitations, onboarding instructions, program-related reminders, and feedback follow-up.

Marketing and product-update emails are sent only with consent or, where genuinely available, a narrow existing-customer exception. Prospects and waitlist contacts are not automatically treated as marketing recipients.

We rely on an existing-customer exception only where we obtained the email address in connection with a purchase, market our own similar products or services, informed you at collection about advertising use and your right to object, include a simple free opt-out in each message, and you have not objected.

5. Cookies, Analytics, and Consent Behavior

Our consent banner/CMP stores your choices against the current legal version. Essential cookies and local storage are required for login, security, consent state, and core functionality and cannot be disabled while using the Service.

• Our first-party page-view measurement (the only first-party analytics we currently run) operates consent-free under the CNIL/DSK exempted-reach-measurement framework. It collects only path, country, and a coarse browser/OS/device-type triple; it never reads your raw IP, full User-Agent, or account identifier. You can opt out at any time via Analytics opt-out.
• Optional third-party analytics tools such as Google Tag Manager/GA4, PostHog, Microsoft Clarity, and Plausible load only after analytics consent. These are not currently active by default.
• Marketing storage and Google Consent Mode advertising signals are denied by default and are set to granted only after marketing consent.
• Server, security, error, and abuse-prevention logs run independently of optional analytics consent where needed for operation and security.
• You can change your choices through Cookie settings.

6. Providers, Processors, Controllers, and External Third Parties

The provider inventory below separates currently active or feature-conditional providers from planned/not-yet-live providers. Notes such as "where enabled" mean the provider is used only for the relevant feature. We update this page for material changes.

7. Waitlists and Beta-Access Programs

When you join a waitlist or beta-access program, we process your email address, IP address, timestamp, selected program, invitation status, and program-related follow-up status.

The purpose is to manage the relevant waitlist or beta program, including launch notification, access invitation, onboarding instructions, reminders related to the selected program, and feedback follow-up directly related to that program. This is not general marketing consent.

You can withdraw consent at any time through polysimulator.com/waitlist/unsubscribe or by emailing [email protected].

8. International Transfers

Some providers are located outside the EEA or use international infrastructure, including Supabase, Cloudflare, Stripe, Google, GitHub, Discord, PostHog, Microsoft, Axiom, Fly.io, Resend, OpenAI, and certain data or asset providers. Where required, we rely on adequacy decisions, the EU-US Data Privacy Framework, Standard Contractual Clauses, data-processing agreements, and additional technical/organizational safeguards. Provider roles and locations are listed above.

9. Retention Details

10. Automated Logic

We use automated logic for simulated orders, leaderboard rankings, season rules, API rate limits, API beta access, entitlement and plan checks, abuse detection, and security controls. This logic does not produce legal effects or similarly significant effects outside the simulated Service environment. We do not use fully automated profiling for decisions about real-money products.

11. Your GDPR Rights

Subject to GDPR conditions, you have rights of access, rectification, erasure, restriction, portability, objection, withdrawal of consent, and complaint to a supervisory authority.

In particular, you may object to direct marketing at any time. After objection, we will no longer process your data for direct marketing. You can do this from your profile settings or from unsubscribe links in emails.

How to exercise your rights: email [email protected] from the address on your account or use the account deletion control in your profile settings. We respond within one month of receipt under Art. 12(3) GDPR; for particularly complex requests we may extend by two further months and inform you. Self-service deletion requests normally use a 14-day grace period before final anonymization. For erasure requests (Art. 17 GDPR) we anonymise your account and delete or anonymise personal data. We retain certain records where legally required (for example, invoices for 10 years under § 257 HGB / § 147 AO) or necessary for the establishment, exercise, or defence of legal claims (Art. 17(3)(b) and (e) GDPR). Our reply itemises what was erased and what was retained, with the legal basis for retention.

12. Security

• TLS/SSL encryption in transit.
• OAuth-based authentication and access controls.
• Cloudflare protection, monitoring, logging, and abuse detection.
• Restricted operator access to production systems and logs.

Data breach notification: We notify the competent supervisory authority of a personal-data breach without undue delay and, where feasible, within 72 hours of becoming aware of it, in accordance with Art. 33 GDPR, unless the breach is unlikely to result in a risk to the rights and freedoms of natural persons. Where the breach is likely to result in a high risk to your rights and freedoms, we additionally notify you directly in accordance with Art. 34 GDPR.

13. Supervisory Authority

14. Children

The Service is not intended for children under 16. If you believe a child has provided personal data to us, please contact us.

15. Changes to This Policy

We may update this Privacy Policy when the Service, providers, purposes, or legal requirements change. For material changes, we will provide appropriate notice and update the version date.

16. Contact