1. Who we are
Nexrate is operated by a sole trader based in the Czech Republic ("we", "us", or "our"). We provide a web-based forex fundamental analysis platform at nexrate.io. For any privacy-related questions, contact us at info@nexrate.io.
2. What data we collect
We collect the minimum data necessary to operate the service:
- Name and country — first name, last name, and country of residence, provided at registration for account identification purposes.
- Email address — used to create and manage your account, and to contact you about your subscription.
- Payment information — handled entirely by Stripe. We never see or store your card details. Stripe stores billing name, card last four digits, and billing country on our behalf.
- Usage data — basic server logs (IP address, browser type, pages visited) retained for up to 30 days for security and debugging purposes.
- Support messages — if you contact us via the Support form, we store the content of your message to respond to it.
3. Why we process your data
- Contract performance — to provide you access to the platform you subscribed to.
- Legitimate interest — to maintain security, prevent fraud, and improve the service.
- Legal obligation — to comply with applicable accounting and tax law.
We do not sell your data. We do not use your data for advertising or profiling.
4. Third-party processors
We use the following sub-processors to operate the service:
- Supabase — database and authentication. Data stored in EU region (Frankfurt).
- Stripe — payment processing. PCI-DSS Level 1 certified. Data processed in accordance with Stripe's Privacy Policy.
- Vercel — web hosting and deployment. Servers in the EU where available.
- Groq — AI-generated text summaries only. We send anonymized market data (pair name, score, rates). No personal data is shared with Groq.
5. How long we keep your data
Account and subscription data is kept for the duration of your subscription plus 3 years, as required by Czech accounting law. If you delete your account, personal data is removed within 30 days, except where retention is required by law.
6. Your rights under GDPR
As a data subject under EU/EEA law, you have the right to:
- Access — request a copy of the personal data we hold about you.
- Rectification — request correction of inaccurate data.
- Erasure — request deletion of your data ("right to be forgotten").
- Portability — receive your data in a structured, machine-readable format.
- Objection — object to processing based on legitimate interest.
- Restriction — request that we limit how we process your data.
To exercise any of these rights, email us at info@nexrate.io. We will respond within 30 days. You also have the right to lodge a complaint with the Czech Data Protection Authority (ÚOOÚ).
7. Cookies
We use only technically necessary cookies for session management (Supabase auth token). We do not use tracking cookies, analytics cookies, or advertising cookies. No consent banner is required for strictly necessary cookies under ePrivacy Directive Article 5(3).
8. Changes to this policy
If we make material changes to this policy, we will notify you by email at least 14 days before the changes take effect. Continued use of the service after that date constitutes acceptance of the updated policy.