1. Data controller
The controller of personal data processing is Sébastien Codus EI (see legal notices).
For any question regarding your personal data or to exercise your rights, contact us at team@screener.trading.
2. Data collected
We collect and process the following categories of data:
- Identification: email address (magic-link authentication, no password stored).
- Preferences: language, theme, chart display settings.
- Business data you create: screeners, lists, paper-trading accounts and simulated order history, backtests, chart annotations, indicator configurations.
- Technical usage data: pages visited, actions performed, internal API performance, user-agent, session identifier. To measure the audience of visitors who have not consented to analytics cookies, a pseudonymous identifier is derived by non-reversible hashing of the IP address and user-agent with a daily-rotating key: the IP address is never stored and no cross-day tracking is possible. No cookie or local storage is used for this counting, performed both internally and via PostHog in cookieless mode (see section 8).
- Event logs: CRUD actions on your data, application events (account creation/deletion, ToS acceptance).
- Billing data: if you subscribe to a paid plan, your Stripe customer and subscription identifiers and your billing history. Card data is entered and processed directly by our payment provider Stripe (PCI-DSS compliant); it never passes through our servers and is never stored by Screener.Trading.
3. Processing purposes
Your data is used to:
- Operate your user account
- Personalise your experience on the platform
- Improve our services through aggregated usage statistics
- Send you account-related notifications (auto-scans, account deletion)
- Detect and prevent abuse (rate-limiting, security logs)
4. Legal basis
Depending on the purpose, processing is based on:
- Contract performance (GDPR art. 6.1.b) — to create and manage your account, deliver the features, and send transactional notifications.
- Legitimate interest (GDPR art. 6.1.f) — for internal usage statistics (self-hosted, no third-party transfer), abuse detection, platform security, and strictly anonymous audience measurement performed without cookies or trackers (exempt from consent under article 82 of the French Data Protection Act — see sections 2 and 8). You can object to this processing (see section 6).
- Your consent (GDPR art. 6.1.a) — for analytics cookies and session recording (Posthog). No analytics cookie is set and no session is recorded until you accept via the consent banner. You can revoke your consent at any time (see section 10); cookie setting and recording cease immediately.
5. Retention periods
- Account and business data: for the entire duration of your subscription. When your account is deleted, your direct personal data (email, name) is anonymised immediately and irreversibly.
- Analytics activity logs (pages visited, API calls, CRUD events, application events): 13 months maximum, in line with the CNIL recommendation for this type of processing. A daily automatic purge removes records older than that threshold.
- Form events (including email entered before full registration): 6 months maximum.
- Accounting invoices (issued when you subscribe to a paid plan): 10 years, French accounting obligation.
6. Your rights
In accordance with the General Data Protection Regulation (GDPR), you have the following rights:
- Right of access to your personal data
- Right to rectification of your data
- Right to erasure (right to be forgotten)
- Right to data portability
- Right to object to processing
- Right to restriction of processing
The right to erasure can be exercised directly by deleting your account from your profile page. For all other rights (access, rectification, portability, objection, restriction), send your request by email to team@screener.trading specifying the email address associated with your account. For the right to portability (art. 20), we will reply with a JSON file containing all your data as soon as possible.
7. Data security
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, modification, disclosure or destruction: TLS encryption in transit, passwordless authentication (magic links), granular access control (roles), rate-limiting on sensitive routes, logging of administrator actions.
8. Sub-processors
Your data is processed by the following sub-processors, under a strict data processing agreement (DPA):
- Scaleway SAS (France, EU) — PostgreSQL database hosting, application hosting (containers), and transactional email delivery via Scaleway Transactional Email Manager. Data stored exclusively in the European Union.
- Functional Software, Inc. (Sentry) (United States company, data hosted on their European Union infrastructure in Frankfurt, Germany) — application error monitoring. Email addresses, IP addresses, usernames and sensitive data (passwords, tokens, cookies) are stripped by our code before transmission. IP storage is disabled at the Sentry project level to prevent any geographic enrichment. Session recording (replay) is entirely disabled.
- PostHog Inc. (United States company, data hosted on their European Union infrastructure in Frankfurt, Germany —
eu.i.posthog.com instance) — audience measurement, product analytics and session recording (replay). Without your consent, only cookieless audience measurement is performed: no cookie or local storage, pseudonymous identifier computed server-side by non-reversible hashing (IP address + user-agent + daily-rotating key), IP address never stored, no cross-day tracking and no individual profile. Analytics cookies and session recording are activated only after your explicit consent via the banner (see section 10); if you refuse or revoke your consent, they cease immediately. Session recording masks all input fields before transmission. IP address is anonymised at project level. - Stripe Payments Europe, Ltd. (Dublin, Ireland, EU) — payment processing and subscription billing management, under a data processing agreement (DPA) and PCI-DSS compliant. Card data is entered and processed directly by Stripe; it never passes through our servers and is never stored by Screener.Trading.
9. Cookies
The platform uses cookies strictly necessary for the service to function (authentication, preferences, storage of your consent choice). No advertising cookies are used. Posthog, activated only after your explicit consent, sets third-party analytics cookies (and uses localStorage) to measure usage and replay browsing sessions (input fields masked). Without consent, none of these cookies are set — audience measurement then relies exclusively on a cookieless, storage-free mechanism (see sections 2 and 8). During the payment checkout, Stripe may set cookies strictly necessary to secure the transaction and prevent fraud.
10. Managing your consent
You can change your choice about analytics cookies at any time. Your decision is stored locally on this device; a refusal automatically expires after 6 months so we can ask you again.