Privacy Policy

1. Data controller

Controller: Carlos Darder

Contact email: contact@catallaxis.com

The controller currently operates as a sole trader. These details will be updated with those of the corresponding company once its registration is complete.

2. Data we collect

This site collects four kinds of data:

• Browsing data. Through Google Analytics, and only if you consent. It is aggregate data about how the site is used: pages visited, session length, type of device. No identifying data is collected.
• Contact details. When you book a call through Calendly: name, email and, if you want, phone number. Calendly Inc. handles them under its own terms.
• Newsletter email address. If you subscribe, your email address and the language you are browsing in, handled through Brevo, so we can send you what you asked for.
• Subscriber account. If you create an account: your email, your name if you choose to give one, the language you registered in, the date your access runs until, and the date you last signed in. The password itself is not stored: what is stored is a cryptographic hash of it (bcrypt), from which the original password cannot be recovered. Not even we can read it.

3. Data we do NOT collect

The subscriber area includes a tracker for your own portfolio. Those figures never reach our servers. They are kept in your browser’s local storage and they stay there:

• How much you hold in each block, how many units of each asset, your contributions and your history are kept in your browser, on your device. If you switch browsers or clear their data, those figures are gone and we hold no copy.
• The CSV file you export from Trading 212 is read inside your browser. It is not uploaded anywhere.
• The only thing the server is asked is what an asset is worth, which is the same for everyone and says nothing about you. That question carries none of your figures.

Put plainly: we cannot know how much money you have or what it is in, because that information never leaves your device.

4. Legal basis

• Analytics: explicit consent, article 6.1.a GDPR. You can withdraw it at any time by rejecting it in the banner or clearing your browser cookies.
• Booking a call: performance of a pre-contractual relationship, article 6.1.b.
• Newsletter: explicit consent, article 6.1.a. You can unsubscribe from the link in every email.
• Subscriber account: performance of the contract, article 6.1.b. Without an account there is no way to give you access to what you paid for.
• Security: legitimate interest, article 6.1.f. So that nobody can try passwords one after another against the accounts, we count how many failed attempts come from an IP address or against an email. That count clears itself shortly afterwards.

5. Purpose

Browsing data is used to improve the content and the workings of the site. Contact details are used to arrange and hold the call you asked for. Account data is used to identify you when you sign in and to know whether your subscription is up to date. None of it is used for profiling or for automated decisions about you.

6. Recipients

• Google LLC. Provider of Google Analytics.
• Calendly Inc. Appointment booking platform. Its privacy policy is at calendly.com.
• Brevo. Email platform based in the European Union, which sends the newsletter and the password recovery emails.
• Vercel Inc. Hosting. It serves the pages and runs the server code.
• Neon Inc. The database where your subscriber account lives: the email, the name, the password hash and the date your access runs until. The database is hosted in Frankfurt, Germany.

Your subscriber account data is stored in Frankfurt, Germany, inside the European Union. Some of the other providers may process data outside the European Economic Area. Those transfers rely on the European Commission’s standard contractual clauses or on the relevant adequacy decision in each case.

No data is sold or passed to third parties for commercial purposes.

7. Retention

• Analytics: per the Google Analytics retention setting, 14 months by default.
• Call details: as long as needed to manage the relationship and to meet legal obligations, tax ones included.
• Newsletter: until you unsubscribe.
• Subscriber account: for as long as the account exists. You can ask for it to be deleted whenever you want, and it is deleted.
• Password recovery links: they expire in two hours, work once, and are removed from the database after seven days.
• Sign-in attempt counts: they reset on their own within minutes or hours, depending on the case.

8. Security

Passwords are stored hashed with bcrypt and never in the clear, so nobody, ourselves included, can read them. The session travels in a signed cookie that the browser will not let any script read. The whole site is served over an encrypted connection. And as explained in section 3, your portfolio figures are not on any server of ours, so there is nothing about your wealth that can leak from here.

9. Your rights

You have the right to access your data, rectify it, erase it, restrict its processing, object, and request its portability. To exercise them, write to contact@catallaxis.com with the subject "Data protection". If what you want is your account deleted, asking at that same address is enough.

You can also lodge a complaint with the Spanish Data Protection Agency at www.aepd.es.

10. Cookies and local storage

The site uses these cookies:

• Google Analytics. Measurement cookies, and only if you accept them in the banner. They are the only ones that need your consent.
• praxis_sesion. This is what keeps you signed in to the subscriber area. The service cannot be provided without it, so it is a technical cookie and no consent is asked to set it. It lasts 30 days and disappears when you sign out.
• lang. Remembers which language you prefer, so you are not sent to the wrong one on every visit. It is technical and identifies nobody.

On top of that, two things are kept in your browser’s local storage and never sent anywhere: your answer to the cookie banner, so you are not asked again, and your portfolio figures if you use the tracker, as explained in section 3.

You can withdraw consent for the measurement cookies at any time by rejecting them in the banner or clearing your browser data.