Privacy policy
Last updated 19 October 2026. Draft.
Who is responsible
[operator: legal name and address] is the controller of your personal data under the UK GDPR and the Data Protection Act 2018. Contact: [contact email].
What we collect
- Account details: your email address, name, password (stored only as a hash by our authentication provider) and, if you sign in with Google, your Google name and email.
- Trading data you enter or import: prop-firm accounts, what you paid for them, trades (dates, times, instruments, sizes, prices, fees, profit and loss), payouts, firm login numbers you link, strategies, custom rules, and price data you upload.
- Analyst conversations: your questions, the answers, and how many questions you've used this month.
- Technical data: server logs (IP address, browser, pages requested, times) and error reports when something breaks. Page-view statistics are counted without cookies and without identifying you.
We don't collect payment card details. We don't sell your data or use it for advertising.
Why we use it, and our lawful basis
- To run Moizen for you (store your data, work out account state and odds, answer analyst questions): performance of our contract with you.
- To keep Moizen secure and working (logs, error monitoring, abuse prevention) and to improve it (counting page views in aggregate): our legitimate interests in running a reliable service.
- To meet legal obligations where they apply.
Who processes it for us
These providers process personal data on our behalf, under data processing agreements:
- Supabase: database and sign-in. Your data is stored in Supabase's London region (AWS eu-west-2).
- Vercel: hosts the website and runs the server code, and counts page views without cookies.
- Anthropic: provides the Claude AI model behind the analyst. When you ask a question, the question and a summary of your trading data (accounts, trades, strategy and rules) are sent to Anthropic to produce the answer. Under Anthropic's commercial terms this data isn't used to train its models.
- Sentry: error monitoring. Error reports contain technical details of what went wrong; we configure it not to send your name, email or IP address.
If you sign in with Google, Google processes that sign-in under its own privacy policy. Some providers are based in, or use staff in, the United States. Where data leaves the UK we rely on UK adequacy regulations (including the UK–US data bridge) or the UK International Data Transfer Addendum to the EU standard contractual clauses.
How long we keep it
We keep your data while you have an account. When you delete your account it is deleted from our database straight away, and from our providers' backups and logs as they expire (normally within 30 days). Error reports are kept for up to 90 days.
Your rights
You have the right to:
- access your data, and get a copy in a portable format (the export on the account page);
- correct it (edit it in the app, or ask us);
- delete it (delete your account on the account page);
- restrict or object to how we use it.
Email [contact email] for anything you can't do in the app. You can also complain to the Information Commissioner's Office (ico.org.uk), though we'd appreciate the chance to put things right first.
Cookies
We use only the cookies needed to keep you signed in. See the cookie notice.
Changes
We'll tell you about important changes by email or in the app.