Privacy Policy
Updated 10/14/2026
The data controller is Caroline Technologies s. r. o., registered office at Korunní 2569/108, Vinohrady, 101 00 Prague 10, Czech Republic, company number 29727430, entered in the commercial register kept by the Municipal Court in Prague, file no. C 450846 (the “controller”). This document explains what we process about you when you use KVERX, why, on what legal basis, for how long, and who we pass it to.
It is written to be readable. Where a legal term is unavoidable, we explain it.
Data-protection contact: [email protected], or by telephone on +420 607 969 092.
What we process
| Category | Specifically | Purpose | Legal basis | Retention |
|---|---|---|---|---|
| Account identity | e-mail, nickname, language, registration date, affiliate code | running the account | contract (Art. 6(1)(b)) | while the account exists |
| Sign-in | one-time codes (stored as a hash), sessions, IP and device of the last sign-in | signing you in, security | contract and legitimate interest (Art. 6(1)(f)) | codes 10 minutes, sessions 30 days, sign-in record 90 days |
| Kverk configuration | DNA, chosen senses, fuses, portraits, custom rules, names | providing the service | contract | while the account exists |
| Kverk results | trades, daily closes, journal, experiences, exam results, Score | running the simulation and the living track record | contract | trades and daily closes while the account exists; experiences a rolling 30-day window |
| Purchases | purchase type, amount, currency, status, Stripe payment identifier | fulfilling the order, accounting | contract and legal obligation (Art. 6(1)(c)) | 10 years (Czech Accounting Act) |
| Notifications | messages shown in the app and whether they were read | informing the user | contract | 90 days |
| Data chatbot | question and answer text, masked for personal data | providing help and checking its quality | contract and legitimate interest | 90 days |
| Support | contact-form message, e-mail, reply history | answering you | legitimate interest | 3 years |
| Product telemetry | first-party events such as “signup” or “kverk created”, no third-party cookies | improving the service | legitimate interest | 14 months, aggregated afterwards |
| Technical logs | error records, IP address, request identifier | operation and security | legitimate interest | 30 days |
Daily closes are not deleted piecemeal. One row per kverk per day is the accounting backbone of the living track record — without it the record would stop being evidence. It therefore lasts as long as the account and disappears with it. After the account is deleted, only an anonymous aggregate with no link to a person remains.
We do not process card details (only Stripe sees them), we carry out no profiling with legal effects and no automated decision-making about you, and we do not sell your data. Analytics tools (Google Analytics, Hotjar) run only if you allow them in the cookie bar — without consent they never load at all.
Cookies
Cookies fall into three categories. Necessary ones always run — without them you cannot sign in and the site forgets your language:
| Cookie | Purpose | Lifetime |
|---|---|---|
| session | keeps you signed in | 30 days |
| locale | remembers your choice of Czech or English | 1 year |
| referral | remembers the affiliate code you arrived through | 30 days |
| terms consent | remembers that you accepted the terms and the risk warning | 1 year |
| cookie choice | remembers which categories you allowed in the cookie bar | 1 year |
Analytics cookies (Google Analytics, Hotjar — anonymous measurement of how the laboratory is used) and marketing cookies (Google Ads — campaign measurement) load only after your consent in the cookie bar. Rejecting is as easy as accepting, the choice can be changed at any time in the site footer, and without consent nothing is sent to those servers at all (Google Consent Mode v2, default state “denied”).
Who receives data
We have a data-processing agreement with each processor.
| Processor | Purpose | Where it processes |
|---|---|---|
| Stripe Payments Europe, Ltd. | payments, receipts, monthly support | EU (Ireland), with transfers to the USA under standard contractual clauses |
| Resend (Plus Five Five, Inc.) | sending transactional e-mail | USA — see the note below |
| Twelve Data | equity market data | EU / USA |
| Marketaux | news headlines | outside the EU |
| Anthropic PBC | language model for the Story of the Day, sentiment scoring and the Data chatbot | USA, standard contractual clauses |
| Railway Corp. | application and database hosting | EU (Amsterdam region) |
| Cloudflare, Inc. | CDN and attack protection | global network, EU as the primary region |
Market-data and language-model providers receive technical data only — symbols, headlines, question text — never your e-mail address or account identifier. Text sent to the Data chatbot is masked for obvious personal data before it leaves us. Chatbot data is not used to train the provider's models [to be confirmed contractually].
Beyond these processors we disclose data only where the law requires it — for example to law-enforcement or tax authorities.
Note on Resend. Our e-mail sender stores data in the United States. The transfer relies on the European Commission's standard contractual clauses. In practice this means your e-mail address and the content of a message we send — a sign-in code, a receipt, a security alert — are stored on US servers for as long as the provider retains them. If that is unacceptable to you, the service unfortunately cannot be used: we have no way to sign you in without e-mail.
Transfers outside the EU
Where a transfer outside the European Economic Area happens — Resend, Anthropic, partly Stripe and Marketaux — it relies on standard contractual clauses adopted by the European Commission, or on an adequacy decision where one exists for that country. We will make a copy of the clauses available on request.
Your rights
You have the right of access, rectification, erasure, restriction of processing, data portability, and the right to object to processing based on legitimate interest. Exercising these rights is free and we handle requests within one month.
In practice:
- Export — in Settings → Purchases you download an archive with trades and journal as CSV and the DNA of every kverk as JSON. Neural-network weights are not included: they are learned model parameters tied to specific sense and simulator versions, not your personal data, and they cannot be used outside the service.
- Erasure — in Settings you close the account. After you confirm, 14 days run during which the deletion can be undone by simply signing in; on day 12 we send a reminder. Once the period passes, the account and its kverks are gone irreversibly. Only the accounting records we must keep for 10 years remain, plus anonymous aggregates with no link to a person.
- Objection and complaint — write to us through Contact. If you are not satisfied with how we handled it, you can complain to the Czech Data Protection Authority, Pplk. Sochora 27, Prague 7 (uoou.cz).
Security
Traffic is always encrypted (TLS). Sign-in codes are stored only as a hash. Only the operator has access to the production database. Backups are encrypted and the key is kept outside the hosting platform. Administrative actions are written to an append-only audit log; signing in as a user (“impersonation”) is always read-only and never reveals a sign-in code or payment details. If a breach poses a risk to your rights we will inform you without undue delay and report it to the supervisory authority.
Children
The service is for people over 18. We do not knowingly process children's data. If we learn that an account was opened by someone under 18, we close it and delete the data.
Changes
We may revise this document. Material changes are announced by e-mail or in the application.
Document version
Last updated: 26 August 2026.