Privacy Policy

Who we are (data controller)

Qovavo is operated from Brescia, Italy, and is the data controller for the personal data described here. For any privacy question, or to exercise any of the rights below, contact team@qovavo.com.

What we collect

• Account: your email address and a securely hashed password.
• Profile & preferences: display name, chosen trading pairs, theme, and your subscription status.
• Your content: trades you log (pairs, prices, P&L, notes, whether you followed your plan) and any screenshots you upload; lesson progress, quiz results, written reflections and chart screenshots you submit for AI review.
• Payment data: processed by Stripe. We never see or store your full card details — only Stripe customer/subscription identifiers and your subscription status.
• Usage & technical data: IP address, device/browser information, and product-analytics events (pages viewed, actions taken) — analytics only with your consent.
• Support: anything you send us via the contact or feedback forms.

Why we use it, and our legal basis

• To provide the service — creating your account, saving your trades and progress, running your subscription (legal basis: performance of our contract with you).
• To take payment via Stripe and keep the tax/accounting records the law requires (contract; legal obligation).
• To keep the service secure — e.g. rate-limiting abuse (legitimate interest).
• To understand and improve the product through analytics (consent — you can decline the cookie banner and this stops).
• To reply to you when you contact us (legitimate interest).

Cookies

We set strictly-necessary cookies to keep you signed in (Supabase session) and remember your theme — these need no consent. We set analytics cookies (PostHog) only if you accept them in the cookie banner; decline and none are set. You can change your mind any time by clearing site data.

Who we share it with (processors)

We do not sell your data. We share it only with the service providers that run Qovavo, each under a data-processing agreement:

• Supabase — database, authentication and file storage.
• Vercel — application hosting.
• Stripe — payment processing.
• Resend — transactional and notification email.
• PostHog (EU) — product analytics (only with consent).
• Sentry — error monitoring, so we find out when something breaks. It is configured not to send personal data: no emails, IP addresses, or request contents — only technical stack traces.
• Google (Gemini) — chart screenshots and prompts you submit for AI lesson review are sent to Google's Gemini API to generate your feedback.

International transfers

Some providers process data outside the EU/EEA (for example in the United States). Where they do, transfers are covered by an adequacy decision or the EU Standard Contractual Clauses. PostHog analytics is hosted in the EU.

How long we keep it

We keep your account and content for as long as your account is open. If you delete your account (email us), we delete your personal data, except limited records we may need to keep for a reasonable period to meet legal, tax, or accounting obligations.

Your rights

Under the GDPR you can request access to, correction, deletion, restriction or portability of your data, and object to certain processing. You can withdraw analytics consent at any time. To exercise any of these, email team@qovavo.com. You also have the right to complain to the Italian data-protection authority, the Garante per la protezione dei dati personali (garanteprivacy.it).

Security & children

We protect your data with encryption in transit, row-level access controls, and private file storage. No system is perfectly secure, but we take reasonable measures. Qovavo is not intended for anyone under 18, and we do not knowingly collect data from minors.

Changes

We'll update this page when our practices change and revise the date above. Material changes will be notified by email or in-app.