1. Data controller
The controller of personal data processing is Sébastien Codus EI (see legal notices).
For any question regarding your personal data or to exercise your rights, contact us at team@screener.trading.
2. Data collected
We collect and process the following categories of data:
- Identification: email address (magic-link authentication, no password stored).
- Preferences: language, theme, chart display settings.
- Business data you create: screeners, lists, paper-trading accounts and simulated order history, backtests, chart annotations, indicator configurations.
- Technical usage data: pages visited, actions performed, internal API performance, user-agent, session identifier.
- Event logs: CRUD actions on your data, application events (account creation/deletion, ToS acceptance).
- Billing data: if you subscribe to a paid plan, your Stripe customer and subscription identifiers and your billing history. Card data is entered and processed directly by our payment provider Stripe (PCI-DSS compliant); it never passes through our servers and is never stored by Screener.Trading.
3. Processing purposes
Your data is used to:
- Operate your user account
- Personalise your experience on the platform
- Improve our services through aggregated usage statistics
- Send you account-related notifications (auto-scans, account deletion)
- Detect and prevent abuse (rate-limiting, security logs)
4. Legal basis
Depending on the purpose, processing is based on:
- Contract performance (GDPR art. 6.1.b) — to create and manage your account, deliver the features, and send transactional notifications.
- Legitimate interest (GDPR art. 6.1.f) — for internal usage statistics (self-hosted, no third-party transfer), abuse detection and platform security. You can object to this processing (see section 6).
- Your consent (GDPR art. 6.1.a) — for third-party analytics tools (Posthog). No event is transmitted to these sub-processors until you accept via the consent banner. You can revoke your consent at any time (see section 10); transmission ceases immediately.
5. Retention periods
- Account and business data: for the entire duration of your subscription. When your account is deleted, your direct personal data (email, name) is anonymised immediately and irreversibly.
- Analytics activity logs (pages visited, API calls, CRUD events, application events): 13 months maximum, in line with the CNIL recommendation for this type of processing. A daily automatic purge removes records older than that threshold.
- Form events (including email entered before full registration): 6 months maximum.
- Accounting invoices (issued when you subscribe to a paid plan): 10 years, French accounting obligation.
6. Your rights
In accordance with the General Data Protection Regulation (GDPR), you have the following rights:
- Right of access to your personal data
- Right to rectification of your data
- Right to erasure (right to be forgotten)
- Right to data portability
- Right to object to processing
- Right to restriction of processing
The right to erasure can be exercised directly by deleting your account from your profile page. For all other rights (access, rectification, portability, objection, restriction), send your request by email to team@screener.trading specifying the email address associated with your account. For the right to portability (art. 20), we will reply with a JSON file containing all your data as soon as possible.
7. Data security
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, modification, disclosure or destruction: TLS encryption in transit, passwordless authentication (magic links), granular access control (roles), rate-limiting on sensitive routes, logging of administrator actions.
8. Sub-processors
Your data is processed by the following sub-processors, under a strict data processing agreement (DPA):
- Scaleway SAS (France, EU) — PostgreSQL database hosting, application hosting (containers), and transactional email delivery via Scaleway Transactional Email Manager. Data stored exclusively in the European Union.
- Functional Software, Inc. (Sentry) (United States company, data hosted on their European Union infrastructure in Frankfurt, Germany) — application error monitoring. Email addresses, IP addresses, usernames and sensitive data (passwords, tokens, cookies) are stripped by our code before transmission. IP storage is disabled at the Sentry project level to prevent any geographic enrichment. Session recording (replay) is entirely disabled.
- PostHog Inc. (United States company, data hosted on their European Union infrastructure in Frankfurt, Germany —
eu.i.posthog.com instance) — product analytics and session recording (replay). Activated only after your explicit consent via the consent banner (see section 10). No event is transmitted before your acceptance. If you refuse or revoke your consent, recording and event capture cease immediately. Session recording masks all input fields and all rendered text before transmission; only DOM structure and interactions (clicks, navigation, scroll) are captured. IP address is anonymised at project level. - Stripe Payments Europe, Ltd. (Dublin, Ireland, EU) — payment processing and subscription billing management, under a data processing agreement (DPA) and PCI-DSS compliant. Card data is entered and processed directly by Stripe; it never passes through our servers and is never stored by Screener.Trading.
9. Cookies
The platform uses cookies strictly necessary for the service to function (authentication, preferences). No advertising cookies are used. Posthog, activated only after your explicit consent, sets third-party analytics cookies (and uses localStorage) to measure usage and replay browsing sessions (with masking). Without consent, none of these cookies are set. During the payment checkout, Stripe may set cookies strictly necessary to secure the transaction and prevent fraud.
10. Managing your consent
You can change your choice about analytics cookies at any time. Your decision is stored locally on this device; a refusal automatically expires after 6 months so we can ask you again.