← Back to TradinZ · Terms of Use · Disclaimer

Privacy Policy

TradinZ is operated by Dinzel IT d.o.o., Ulica Lea Müllera 43, 10090 Zagreb, Croatia · OIB 94890617087. Contact: dinz@dinzzz.com.

Last updated: 22 October 2026 · Related: Terms of Use · Disclaimer · Methodology & Disclosures

1. The short version

TradinZ is built to know as little about you as possible. Explore is available without an account. Personal workspaces and purchases require sign-in. We do not run advertising or third-party analytics trackers, and we do not sell personal data. We process information to provide the Service. Optional public-page click counts are described below.

2. What we process, and why

• Account and sign-in information. We store your account identifier, email address, linked sign-in provider identifiers and, for email sign-in, a salted password hash. Session tokens are stored securely; Apple authorization grants used for revocation are encrypted. Verification and recovery emails are delivered through Resend. Legal basis: performance of the contract with you (Art. 6(1)(b) GDPR).
• Subscription records. When payments are enabled, Stripe processes web checkout and Apple processes App Store purchases. TradinZ verifies App Store subscription status directly with Apple. We associate provider customer or subscription identifiers, product, status, expiry and AI usage counts with your TradinZ account. Payment providers receive the details needed to process and manage your purchase; TradinZ does not receive your full card number. Legal basis: performance of the contract (Art. 6(1)(b)) and compliance with tax and accounting obligations (Art. 6(1)(c)).
• Brokerage API credentials. Broker portfolio sync uses a read-only API credential — configured in the Service's server configuration for specifically authorized accounts, or supplied by you where the product offers that — used solely to fetch positions from the broker so they can be displayed and analysed. Legal basis: performance of the service you requested. The connection cannot trade or move money. Access can be revoked at the broker at any time.
• Portfolio and research data you enter. Manual portfolios, theses, saved screens, logged predictions, and preferences are stored so the Service can show them back to you — on the server for portfolio-type data, and in your own browser's local storage for view preferences. Legal basis: performance of the service.
• Technical logs and IP addresses. Standard, short-lived server logs (timestamps, requested endpoints, error messages) used to keep the Service running. Your IP address is processed transiently for security rate limiting and abuse prevention on sign-in and public endpoints. Legal basis: legitimate interest in operating and securing the Service.

We do not process special categories of personal data, we do not profile you, and we make no automated decisions with legal or similarly significant effect.

Optional public-page click counts.

Click measurement on public information pages is off by default. If you enable it in the page footer, the website sends only a fixed page label and button type when you select Explore, Plans or the App Store. We store daily aggregate counts for 90 days in the active measurement store. We do not store a visitor identifier, account identifier, IP address, full URL or referrer in these counts, and do not use a third-party analytics service. Normal infrastructure request handling and technical logs still apply. These counts are not linked to accounts or purchases.

Your optional choice is saved in this browser’s local storage and can be turned off in the footer at any time. No click event is sent before you opt in; browsers signalling Do Not Track or Global Privacy Control remain off. Turning it off stops future measurement. Existing aggregate counts cannot identify or single out your contribution. This feature applies to public web pages, not the native iPhone app.

3. What we do not do

• No advertising, ad networks, or cross-site tracking.
• No sale, rental, or sharing of personal data with third parties for their own purposes.
• No third-party analytics scripts.
• No marketing emails from the current product. Account verification and recovery emails are transactional.

4. Third-party data sources

To display market information, the Service's server requests data from third-party providers (market-data APIs, regulatory-filing systems, public financial websites and feeds). These requests are made by the server on its own behalf and do not include your identity, your portfolio contents, or any personal data of yours. Your brokerage credentials are only ever sent to your own broker.

Sign-in uses Apple or Google if you select those providers; opening the sign-in screen on the web loads Apple's and Google's sign-in scripts from their servers, which involves your device's IP address like any web resource. Web payments use Stripe; App Store subscription validation communicates directly with Apple. The AI companion sends your question and the relevant requested research or portfolio context (which can include your holdings) to Anthropic to generate an answer; under Anthropic's commercial API terms, inputs and outputs are not used to train models and are retained only for a limited period. These providers process information under their service terms and privacy policies.

5. Cookies and local storage

The Service does not use tracking cookies. Sign-in uses host-only, HttpOnly session and challenge cookies. The iOS app stores its session in the Keychain. The web app uses your browser's local storage for functional preferences only (for example: the active screen, saved comparison tickers, builder settings). These values stay on your device and can be cleared at any time via your browser settings.

6. Retention

Account, portfolio and research data is kept while your account is active and removed from the active service when you delete it or complete a removal request. Recovery backups are stored separately from the active service: scheduled daily backups are retained for six days and weekly backups for 27 days; release recovery snapshots require separate deletion. Restoring a backup must preserve subsequent account deletions and revocations. Account deletion closes the associated web subscription; App Store subscriptions must be cancelled separately. Payment providers may retain transaction records for their own statutory obligations. Brokerage credentials are kept until replaced or revoked. Technical logs are retained for a limited period and deleted or overwritten during routine maintenance; they are not used for profiling.

7. Security

We apply reasonable technical measures appropriate to the data held — restricted file permissions for credentials, read-only broker scopes, salted password hashes instead of plaintext passwords, HttpOnly session cookies, encrypted Apple authorization grants and hosted payment collection. No system is perfectly secure; do not reuse sensitive credentials, and prefer read-only API keys wherever your broker offers them.

8. Your rights (GDPR)

If you are in the EU/EEA, you have the right to access, rectify, erase, restrict, or object to the processing of your personal data, the right to data portability, and the right to lodge a complaint with a supervisory authority (in Croatia: AZOP, azop.hr). To exercise any right, contact dinz@dinzzz.com. We will respond within the statutory deadlines.

9. Children

The Service is not directed at children under 16 and does not knowingly process their data.

10. International transfers

Third-party market-data providers the server queries may be located outside the EU/EEA (notably in the United States). Account hosting, sign-in, transactional email, payment validation and requested AI processing can involve providers outside the EU/EEA. Infrastructure hosting uses Railway; sign-in uses your selected Apple or Google provider; transactional email uses Resend; payment processing uses the selected Stripe or Apple service when enabled; requested AI processing uses Anthropic. Transfers to these providers outside the EU/EEA rely on an Article 46 GDPR safeguard — the European Commission's Standard Contractual Clauses in each provider's data-processing terms and, where the provider is certified, the EU-U.S. Data Privacy Framework adequacy decision. Contact us for information about the providers and safeguards applicable to your account.

11. Changes

We may update this policy; the "Last updated" date reflects the current version. Material changes will be signposted on the Service.

12. Contact

Data controller: Dinzel IT d.o.o., Ulica Lea Müllera 43, 10090 Zagreb, Croatia. Contact: dinz@dinzzz.com.