Privacy Policy
mdtrading.techThis is an English reading translation for convenience. Only the German version is legally binding.
Version dated 28 September 2026
1. Controller
Michael Dehenn
Im Gründchen 31
55417 Tiefenbach
Email: dehennmichael@gmail.com
2. Sign-in with email address and code
Data: email address, time of sign-in, a time-limited sign-in code and a session token in the browser. Purpose: to sign you in and to restrict access to authorised persons. Legal basis: Art. 6 (1) (b) GDPR (performance of the usage contract). Storage period: The code expires after a short time; the session ends when you sign out or after the session duration has elapsed. Your email address and your access are deleted as soon as the contractual relationship ends, at the latest 30 days after the last day of the term. If claims are still outstanding at that time, the data required for them is kept until they have been settled.
3. Uploaded portfolio data
Data: The information from the file you uploaded, insofar as it concerns open positions: ticker, number of shares, entry, stop and target price, currency, time of opening. Purpose: to display your positions in the personal area. Legal basis: Art. 6 (1) (b) GDPR.
The uploaded file itself is not kept. Only the result of reading it is stored, under an identifier derived from your email address, outside the publicly accessible directory.
Also stored are stocks that you enter yourself in the personal area (ticker, direction and – if given – number of shares, entry and stop price, time of entry), as well as, for each stock, the rating at the time it was added (traffic light, grade, price, stop suggestion, RSI, ADX) in order to highlight later changes.
Storage period: Uploaded positions are automatically deleted 90 days after upload, even without any action on your part; if you upload again, the period starts anew. So that you can compare two uploads, the previous one is kept when a new upload is made; it too is deleted 90 days after its upload, at the latest with the next upload. Stocks you entered yourself and the associated comparison data remain stored until you delete them or your access ends – for a Pro account, at the end of the contract term. Irrespective of this, all data is deleted twelve months after your last visit to the personal area. You can delete the data there yourself at any time with one click.
This information allows conclusions about your financial situation. Only upload what you wish to provide for this purpose.
4. Market analysis via the Anthropic interface
If you trigger the market analysis, a request is sent to the interface of Anthropic PBC, 548 Market St, San Francisco, CA 94104, USA. Only the ticker and the name of the security are transmitted. Information about your position, your email address and your share counts are not transmitted.
Legal basis: Art. 6 (1) (b) GDPR. Processing on behalf: A data processing agreement under Art. 28 GDPR exists with Anthropic. Transfer to third countries: Processing takes place in the USA. The basis is the Standard Contractual Clauses of the European Commission under Implementing Decision (EU) 2021/914, which form part of this agreement. A level of protection fully equivalent to that of the GDPR cannot be guaranteed in every case for third countries.
4a. Payment and balance
If you buy a Pro account or an analysis balance, you are redirected to Stripe Payments Europe, Limited, 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, D02 H210, Ireland (“Stripe”) for payment. Your email address, the amount and the purpose of the payment are transmitted. You enter your payment data (such as card or account number) directly with Stripe; it is neither collected nor stored on this website. Stripe also processes payment data under its own responsibility, for example for fraud prevention and to comply with legal obligations; Stripe’s privacy policy applies to this. Stripe may also transfer data to the USA; the basis is the Standard Contractual Clauses of the European Commission.
Bank transfer and PayPal: If you choose bank transfer or PayPal, we store your order (account, package, amount, payment method, reference, time) and match it with the incoming payment. In doing so we see the information that your bank or PayPal transmits with the payment (in particular the name and, where applicable, IBAN or PayPal address of the payer). For PayPal, the privacy policy of PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg additionally applies to the payment. Legal basis: Art. 6 (1) (b) GDPR.
Balance transactions: For your account, the balance and every transaction are stored (time, amount, type of transaction; for analyses, ticker and type of analysis; for purchases, the Stripe identifier of the payment). Purpose: to maintain the balance, to rule out duplicate bookings and to show you the transactions. Legal basis: Art. 6 (1) (b) GDPR, for retention Art. 6 (1) (c) GDPR. Storage period: Transactions relating to payments are kept for the duration of the statutory retention periods (Section 147 AO, Section 257 HGB) and then deleted.
5. Server access data
Data: IP address, time, address requested, amount of data transferred, browser identifier. This data arises at our hosting provider. Purpose: operation and security of the server, defence against attacks. Legal basis: Art. 6 (1) (f) GDPR; the legitimate interest is secure operation. Processor: STRATO GmbH, Pascalstraße 10, 10587 Berlin.
6. Cookies
Only one cookie is set: the session token that keeps you signed in. It is strictly necessary for the operation of the service and requires no consent under Section 25 (2) TDDDG. It is deleted when you sign out or close the browser.
No analytics or advertising cookies are set. No audience measurement takes place.
7. Proof of consent to the terms of use
Data: An identifier derived from your email address, the version of the terms and the time of consent. Purpose: proof that the terms were available at the time of conclusion of the contract. Legal basis: Art. 6 (1) (f) GDPR; the legitimate interest is the defence against claims arising from the contractual relationship. Storage period: three years after the end of the contractual relationship. This corresponds to the regular limitation period under Section 195 BGB – after that the proof can no longer serve its purpose and is deleted. Your email address itself is not contained in it, only an identifier derived from it.
8. Comments and messages
Data: The text of your posts and messages, the name under which you are signed in, the time and an identifier derived from this name by which you can recognise and delete your own posts. Purpose: exchange among the users of the service and contact with the operator. Public posts are visible to all signed-in users; private messages only to you and the operator. The operator is notified of new posts by email. Legal basis: Art. 6 (1) (b) GDPR. Storage period: until you delete the post, the operator removes it or, at the latest, twelve months after it was written. Do not write anything in posts that others should not read.
9. No automated decision about you
The ratings calculated in the service relate to financial instruments, not to you. Automated decision-making or profiling within the meaning of Art. 22 GDPR does not take place.
10. Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and objection to processing based on legitimate interests (Art. 21). A message to dehennmichael@gmail.com is sufficient to exercise them.
You also have the right to lodge a complaint with a data protection supervisory authority, in particular with the authority of your place of residence or that of the controller.