Privacy Policy

1. Data controller

The controller of personal data is Blue Vision, s.r.o., with its registered office at Kaprova 42/14, 110 00 Praha 1 - Staré Město, IČO: 29415268, DIČ: CZ29415268, represented by Martin Kysela. For matters concerning data protection, contact us at info@axiomjournal.com.

2. What data we process

• Registration data: name and e-mail address.
• Billing and payment data: processed by the payment gateway; the payment card number is not stored with us.
• Journal content: data about trades and the portfolio that you enter into the Service (including notes and screenshots); it is stored in encrypted form.
• Broker access credentials: if you connect a broker account (Interactive Brokers, Flex Query), we store the token and query ID in encrypted form and, on your instruction, pass them to the broker to download your statement.
• Public profile and sharing: the public name and contact e-mail shown on the Track record with your consent, and the data you publish yourself via the Track record or a journal link.
• Access for a mentor: if you invite a mentor, or we assign you one as part of coaching or a programme, we give them (another user of the Service) access to the journal modules selected by you or by us: trades including notes, screenshots according to your choice, daily journal entries, plan, rules, setups and investment data. The mentor can comment on them and give you tasks and goals. The purpose is guidance and feedback from the mentor. You can change the scope, the screenshot choice and the end date of the access at any time and revoke the access at any time in Settings. After the end date or after revocation the mentor has no access to your journal. In connection with mentoring we also process:
  • the read status of comments for each reader, so that the Service can show new comments;
  • private notes by the mentor about you and on your trades, and the status the mentor gives a trade and the session queue: they belong to the mentor and help them prepare the guidance, you do not see them in the Service and they are not part of the export of your data. Notes are stored in encrypted form. After the access is revoked or after the end date they stay stored, and the mentor can reach them only if you give access again;
  • tasks and goals from the mentor: you see them, you tick them off and they are part of the export of your data that we provide on request. They stay with you after the access ends;
  • a record of when the mentor opened the journal, at most one a day: we show you only the date of the last opening;
  • an overview for the mentor within the scope of the access: the time of the last change in the journal, the number of changes in 30 days, counts of unread comments and tasks, and expectancy from your benchmark metrics if they have access to the Trading module and your journal holds at least 30 trades. Expectancy is an exception to the Benchmark metrics item: your mentor sees this one value;
  • a daily e-mail summary, at most one a day: to you the numbers of new comments and tasks, to the mentor your name (or e-mail if you have not filled in a name) and the numbers of new comments and completed tasks. The e-mail does not contain the comment text. You can turn it off in Settings or with the link in the e-mail.
  We keep this data for as long as the account exists and delete it when your account or the mentor account is deleted. E-mails already sent stay in the mailbox of the recipient.
• Benchmark metrics: once your journal holds at least 30 trades, we store its summary statistics (for example win rate, profit factor and maximum drawdown) on each sync for an anonymous comparison with other users; others only see a summary of the whole group, never your individual values. The exception is a mentor you have given access to: they see your expectancy on their students page.
• Technical data: IP address, device and browser type, website traffic data.
• Device fingerprint: during detailed measurement on the main page of the website, your browser computes a short code (fingerprint) from technical data and sends it to our server together with that data (section 5).

3. Purposes and legal bases of processing

• Performance of the contract: maintaining the account and providing the Service, including features you turn on yourself (broker connection, mentor access, sharing via a link, Track record).
• Legal obligation: issuing and keeping records of tax documents.
• Legitimate interest: securing the Service, a basic server-side record of website visits (IP address, browser, the page visited and where the visitor came from), determining the country and city from an IP address for traffic and user statistics, and anonymous benchmark metrics.
• Commercial communications: we send e-mails about news and offers of the Service to existing users on the basis of legitimate interest under Section 7(3) of Czech Act No. 480/2004 Coll., on certain information society services. Each one contains a link you can use to refuse further commercial communications with one click at any time.
• Transactional e-mails (sign-in codes, password reset, payments, notices that access is ending) and important service announcements are part of the Service and are sent to perform the contract.
• Consent: detailed analytical traffic measurement in the browser including the device fingerprint, third-party marketing cookies, and publishing your public profile on the Track record (may be withdrawn at any time).

4. Processors and third parties

To operate the Service, we use carefully selected processors that comply with the GDPR:

• WEDOS Internet, a.s.: hosting and databases (Czech Republic / EU).
• Stripe: payment processing.
• Meta Platforms Ireland Ltd.: conversion measurement (Facebook Pixel and Conversions API), only on the basis of your consent (section 5 describes the exception for time zones outside Europe).

Payments and invoices may be processed instead of Stripe by the FAPI system (fapi.cz) where the payment is made through its payment form; the details entered in the form (name, address, e-mail) and the payment data are then processed by FAPI. When you open the Charts section in the app or load a chart in a trade detail, your browser loads a widget from TradingView (a company based in the USA), which thereby receives technical data (IP address and browser details) and the selected symbol, not your trades. On your instruction, we pass your broker access credentials to that broker (Interactive Brokers) to download your statement.

When we open the traffic or user statistics in the website administration, the server sends the ipwho.is service the IP addresses of website visitors and the last known IP addresses of users whose location we have not yet determined, and receives back the country and city. We store the result (section 7).

5. Cookies

The website uses necessary cookies for sign-in and language settings (for example, the sign-in session and language choice); the service cannot be used without them. A basic record of each visit (IP address, browser, the page visited and where the visitor came from) is stored by the server without cookies on the basis of legitimate interest. Only with your consent (the exception for time zones outside Europe is described below) do we run detailed analytical measurement in the browser (time on page, scroll depth, technical device data including a device fingerprint derived from it) and store a cookie recording where you came from. We also use, only with your consent (exception below), marketing cookies (Facebook Pixel).

Device fingerprint. Detailed measurement runs on the main page of the website. During it your browser computes a fingerprint: a short code derived from the browser identification (User-Agent), screen resolution and colour depth, time zone, graphics card, number of processor cores, memory size and number of touch points. We store the fingerprint together with this and other technical data (browser languages, window size, connection type, colour scheme, the "do not track" setting) with the visit record, not with a user account. It lets us recognise visits from the same device even when the IP address changes: in the website administration we see, for a visitor, a list of other IP addresses with the same fingerprint. Another device with the same parameters can have the same fingerprint. The browser "do not track" signal (Do Not Track) does not limit the measurement, we only store its value.

Outside Europe. We show the consent bar when the browser reports a European time zone (or the time zone of an EU territory outside Europe) or reports none. For other time zones we do not show the bar and start detailed measurement and marketing cookies straight away. You can change your choice at any time using the Cookie settings link in the website footer.

6. Security

We protect both personal data and journal content with modern technical and organizational measures. Sensitive journal data is encrypted (AES-256) even in the server storage, sign-in can be protected with two-factor authentication, and the Service and its database run on servers in the EU.

7. Retention period

We process personal data for the duration of the account and thereafter for the period required by law (for example, tax documents for the statutory period). After the account ceases to exist, we delete the data that we are not obliged to retain.

Website visit records (IP address, visited page, referring page, UTM parameters and technical device data including the fingerprint) are kept for no longer than 25 months and are then deleted automatically. Results of IP location lookups (IP address, country, city) are deleted once they are older than 25 months and the IP address is no longer in the visit records.

8. Transfers outside the EU

We process data in the European Union. If a transfer outside the EU occurs (for example, within the Meta tools on the basis of your consent), it takes place on the basis of safeguards corresponding to the GDPR (standard contractual clauses). The TradingView widget (see section 4) is loaded by your browser directly from that company, which may process the data outside the EU, including in the USA. The ipwho.is service (see section 4) may process the data outside the EU.

9. Public Track record

Track record is an optional public page with your performance at its own address with a random code. Each module has its own card. You turn it on yourself in the configurator; it cannot be turned on without consent in your Public profile (Settings). The address is not password-protected: anyone who has the address or QR code can read the page without signing in. We instruct search engines not to index it.

What the card shows:

• the title, if you enter one, and with your consent the public name and contact e-mail from your Public profile;
• for Trading and Options, the period and summary metrics in the chosen units (currency, R, and for Trading also % of account), the account type and data origin (for example manual entry or import) and, depending on your settings, the equity curve, results by month and a list of trades (date, instrument, side, result);
• for Investing, the portfolio value, total return, realized and unrealized gain, XIRR, dividends, number of positions, maximum drawdown and, depending on your settings, the value over time and changes by month.

The card data does not contain your sign-in e-mail, trade notes, screenshots or broker access credentials. If you hide the list of trades, the curve and results by month are coarsened to groups of 5 trades for Trading and Options. Account size can be worked out from amounts and percentages, so consider which units you publish.

Storing and refreshing the figures. Your browser computes the card figures and sends them to the server, where they are stored in encrypted form and served at the public address according to the card settings. While the card is on and the module is active, the figures refresh automatically after the journal changes. When access to the module ends they stop refreshing and the card stays publicly available with the last published figures until you turn it off or delete it; both are possible without an active subscription.

Card visitors. For each card we record the number of views and the time of the last view. Its views are not written to the website visit records (section 7), and neither detailed measurement nor marketing tools run on it. We use the visitor IP address briefly to limit the number of requests. The choice of light or dark appearance is stored only in the visitor browser.

How to take the card down. You can turn the card off at any time (the address stops working, including printed QR codes), change its address or delete it. Withdrawing consent in your Public profile removes the name and contact and turns off all your cards. Deleting the account removes the cards. We cannot take back what someone has copied, saved or printed in the meantime.

10. Your rights

You have the right to access your data, to have it corrected, erased (the "right to be forgotten"), to restrict processing, to data portability, and the right to object; you may withdraw a granted consent at any time. We will handle a request within 30 days at the latest. You also have the right to lodge a complaint with the Office for Personal Data Protection (uoou.cz). We would be glad if you contacted us first.

11. Contact

With any questions regarding data protection, contact us at info@axiomjournal.com.