Privacy notice

Controller

Providing the website

The website runs on a server of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, in Germany. Every page request first passes through Cloudflare (Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA); Cloudflare delivers the pages, protects the website against attacks and hides our server's address. To do so, Cloudflare and our server process your browser's request, including your IP address. Both work for us as processors under a contract under Article 28 GDPR.

Cloudflare may also process data in the USA. Cloudflare is certified under the EU-U.S. Data Privacy Framework; for certified companies, the European Commission has found an adequate level of data protection (Article 45 GDPR).

Our server keeps no general access logs. If you have an account, we keep your sign-ins, visits and changes with IP address, country and browser for one year, for security, support and finding errors; they are deleted with your account. Error reports in our logs may carry your account's ID for up to 14 days. Requests we refuse, for example after too many attempts, are counted by IP address and country for eight days; to judge them, we may look up which network such an address belongs to, in a local copy of DB-IP's network database on our own server. The legal basis is our legitimate interest in providing the website securely and reliably (Article 6(1)(f) GDPR).

Protection against overload

To protect the service against too many requests, our server counts each visitor's requests for a short time. For this it doesn't store your IP address, only a one-way code derived from it with a secret key (a hash), which is deleted automatically after one hour at the latest. The legal basis is our legitimate interest in a working, secure service (Article 6(1)(f) GDPR).

When you are signed in, our server counts your requests per account instead, for one minute, again only as a code derived with a secret key, never as your account's number.

Visitor counts

To see how the website is used, our server counts page views per day: which page was opened (for example /en/markets) and in which language. To count visitors without counting anyone twice on the same day, it forms a code from your IP address, your browser's identification (user agent) and a secret that changes every day and is then deleted. The code is never stored: it only increases a counter from which it can't be recovered. What remains are daily numbers without any personal data.

No cookie is set, no script runs for this and nothing is read from your device; no other company receives this data. The legal basis is our legitimate interest in understanding and improving the use of the service (Article 6(1)(f) GDPR).

Cloudflare Web Analytics

While the website is in development, Cloudflare also measures how its pages are used and how fast they load (Cloudflare Web Analytics). For this, Cloudflare adds a small script to the pages that reads the page's loading times in your browser and sends them, with the page's address, to Cloudflare. According to Cloudflare, it sets no cookies, stores nothing on your device, doesn't track you across websites and builds no profiles.

Cloudflare works for us as a processor (see "Providing the website"). The legal basis is our legitimate interest in a fast, working website (Article 6(1)(f) GDPR).

Your country

Our server uses your IP address to find the country you are visiting from. For this it uses a local copy of DB-IP's country database: the lookup takes place only on our server, and your IP address is not passed on to anyone. To keep pages fast, our website's server remembers the country found for an IP address for up to ten minutes in its working memory, then forgets it; it is never written to disk or into logs.

The result is used for two things: to show you the markets that concern you (for example, the Iranian rial is shown to visitors from Iran, on Persian pages and to accounts whose country is Iran), and for our internal rules on which services are offered where; currently no service is restricted. It never chooses the language of the website: that comes from your own choice in the language menu or from your browser's language setting, otherwise English. The legal basis is our legitimate interest in a calm website that shows each visitor what concerns them, and in following the rules that apply to our services (Article 6(1)(f) GDPR).

Your account

To create an account you give us your e-mail address and a password, or you continue with Google (see below); you also choose your language and your country. We send a code to your address to make sure it is yours. Your address, your password and your logins are kept by our identity service, the open-source software Zitadel, which runs on our own server at Hetzner in Germany: no other company receives them. Your password is stored only as a secure one-way code (hash), never readable; the identity service receives no IP address.

Our own database keeps your account's number, your language, country and time zone, the channels on which you want notifications, and a record of the changes you make to your account and its settings (audit entries), so that every change can be traced. Your e-mail address is not stored there while your account is active: it is read from the identity service when it is needed.

Gifts and invitations: if we or one of our rules give you something extra (for example more AI answers or a plan for a while), we keep it with your account, with its reason and its end. Your account has its own invite link with a random code that reveals nothing about you. If someone signs up through it, we note that their account came through your invitation; you see only how many joined, never who, and our current rules may reward you both. These notes are kept with the accounts and deleted with either of them; the legal basis is the contract for the service (Article 6(1)(b) GDPR).

The legal basis is the contract for the service you sign up for (Article 6(1)(b) GDPR) and, for the audit entries, our legitimate interest in a secure, traceable service (Article 6(1)(f) GDPR). We keep these data as long as your account exists; see "Exporting and deleting your data".

Continue with Google

If you choose "Continue with Google", your browser goes to Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland), where you sign in. Google then tells our identity service your Google account's number, your e-mail address and whether Google has verified it; we ask only for these basic details ("openid", "email", "profile") and keep neither your name nor your picture. We store the link between your Google account and your Onsorex account, so that you can sign in with Google again. Google is contacted only after you click the button.

Google processes your sign-in under its own responsibility and privacy policy. The legal basis is the sign-in you ask for (Article 6(1)(b) GDPR).

policies.google.com/privacy

E-mails from us

We send you e-mails only for your account and for the alerts you asked to receive by e-mail: the codes for signing up and for resetting your password, and your alerts. Product news (an e-mail when we release something new) we send only if you turn it on yourself in your notification settings. The e-mails are sent by e-mail services that work for us as processors under a contract under Article 28 GDPR: Resend (Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA) and, only when Resend can't send, Scaleway (Scaleway SAS, 8 rue de la Ville l'Evêque, 75008 Paris, France) or Mailjet (Mailjet SAS, 43 rue de Dunkerque, 75010 Paris, France). Each e-mail is sent by one of them, which receives your address and the e-mail's content.

Resend sends our e-mails from the data centre of its sub-processor Amazon Web Services in Ireland. Resend is certified under the EU-U.S. Data Privacy Framework (Article 45 GDPR) and has also agreed to the EU's standard contractual clauses with us (Article 46 GDPR). We count how many e-mails each service sends per day, without addresses. The legal basis is the use of the service you ask for (Article 6(1)(b) GDPR).

Product news by e-mail: the legal basis is your consent (Article 6(1)(a) GDPR; Section 7(2) No. 2 UWG). It is off until you turn it on, and you can withdraw it at any time, in your notification settings or with one click on the link at the end of every such e-mail, without signing in. We keep each decision with its date and the wording you agreed to, as proof (Article 7(1) GDPR); the e-mail goes to the address you sign in with, in your language.

Lists, alert rules and notifications

We keep the lists you make and the alert rules you create (the assets, the conditions or the times, and the channels you choose), and each alert: the moment a rule became true, with the prices it saw. If you delete a list or a rule, it is hidden, no longer used and no longer counted; it stays stored with your account (see "Exporting and deleting your data"). While you create a rule, what you typed is kept for ten minutes in a cookie, so that nothing is lost if a value has to be corrected, and a short record of the new rule is kept for 24 hours so that a repeated click doesn't create it twice.

Alerts reach you on the channels you choose: on this website, by e-mail (see "E-mails from us"; your address is read from the identity service each time, never stored with the alert) or on Telegram (see "Our Telegram bot"). Your notifications on the website and our delivery log are kept for 90 days: which alert went out on which channel and when, never your address or the message's text. The legal basis is the service you ask for (Article 6(1)(b) GDPR).

Our Telegram bot

If you write to our bot on Telegram, Telegram delivers your messages to us. Telegram is an independent service with its own privacy policy; using it is your choice. We receive your chat's number, the language of your Telegram app and what you send or tap. We use them only to answer you, in the language you write in: prices, conversions, explanations and, once you connect the bot to an Onsorex account, your alert rules. The text of your messages is not stored, except as the anonymised copy described in the next paragraph; while an answer is being prepared it is kept for a few minutes at most. To keep the bot fast for everyone, we count messages per chat for one minute.

Learning from AI answers: when the bot's AI answers one of your questions, we keep a copy of the question and the answer so that we can answer it ourselves next time, without the AI. The copy has no link to you: not your chat's number, not your account. A message that contains an e-mail address, a web address, a user name with an at sign, a bank account or a long number such as a phone number is not kept at all; please don't write personal data into your questions anyway. The copies are deleted after 180 days. A question we then answer ourselves stays in our question bank, as anonymised text, until we remove it. The legal basis is our legitimate interest in answering more questions ourselves, at lower cost and without depending on outside AI providers (Article 6(1)(f) GDPR).

If you open the bot through a link of a group, a channel or a campaign, we count that start under the campaign's name, without anything about you. If you connect the bot to your Onsorex account, we store your chat's number with your account so that your alerts reach you; send /stop to disconnect, and it is removed. In groups the bot answers only its own commands, with public market information, and never shows anything personal.

The legal basis is the use of the service you ask for (Article 6(1)(b) GDPR) and our legitimate interest in a reliable, fairly shared service (Article 6(1)(f) GDPR).

telegram.org/privacy

Answers written by AI

Some of our services write their text with an AI model: the plain-language explanation beside a chart, an alert rule you type as a sentence, the bot's AI chat once it is offered to you, and the questions on our AI page. For that we send the AI provider what the answer needs: our market data and, where you wrote something, your text. We never send your name, your e-mail address or your account number. Please don't write personal data into these texts.

The provider depends on your plan. Mistral AI SAS (Paris, France) answers for every plan, inside the EU. For the premium plan we use Anthropic, PBC (San Francisco, USA) and, once we switch to it, Amazon Web Services EMEA SARL (Luxembourg) through Amazon Bedrock, which processes inside the EU. Each works for us as a processor under its data processing terms; for the transfer to the USA, on the safeguards those terms provide (Article 46 GDPR). None of them may use your text to train its models.

The providers may keep a request for a short time to detect misuse, as their terms say. We don't keep the AI's answer with your account; what we keep, anonymised, to answer a question ourselves next time is described under "Our Telegram bot". The legal basis is the use of the service you ask for (Article 6(1)(b) GDPR).

Exporting and deleting your data

In your settings you can download everything we hold about your account at any time, as a file (Articles 15 and 20 GDPR). There you can also delete your account: you are signed out, your login is switched off and your e-mail address in the identity service is replaced, so it is free for a new account. Your account's data are then no longer shown or used.

As a record, we keep the deactivated account and login, with the e-mail address they last had, for at most three years, in case they are needed to establish, exercise or defend legal claims (Article 17(3)(e) GDPR; the general limitation period, Section 195 BGB). During that time they are only stored, never shown, used or analysed (Article 18 GDPR); only we, as the administrator, can delete them, at the latest when the three years are over.

Cookies

We set only cookies that are strictly necessary for a function you use, so they need no consent (Section 25(2) No. 2 TDDDG): "locale" keeps the language you chose, and "onsorex_theme" the light or dark appearance you chose, each for one year. If you open someone's invite link, "onsorex_invite" keeps its code until you sign up, at most 30 days, and is deleted after your first sign-in.

When you sign in: "onsorex_session" keeps your login, encrypted, for as long as it lasts (at most 12 hours); "onsorex_in" says only that you are signed in, and "onsorex_initial" holds the first letter of your address for the menu, for the same time. During a sign-up, a login or a password reset, "onsorex_login", "onsorex_auth", "onsorex_google" and "connect_intent" keep the progress for ten minutes. "onsorex_sidebar" remembers whether the side menu is open, and "onsorex_tz" that your time zone has been checked, each for one year; "onsorex_rule_draft" keeps a rule you are writing for ten minutes.

We use no cookies for analytics, advertising or tracking. To protect the website, Cloudflare may set strictly necessary security cookies.

Error reports

If an error occurs on our server, it sends a technical error report to Sentry (Functional Software, Inc., 45 Fremont Street, 8th Floor, San Francisco, CA 94105, USA); the reports are stored in Sentry's EU data centre. They contain the time, the kind of error and the path of the page (for example /en/markets/BTC), but no IP addresses, cookies, request contents or other information about you. Sentry also checks from outside every minute whether the website is reachable.

Sentry works for us as a processor, is certified under the EU-U.S. Data Privacy Framework and keeps the reports for 90 days at most. The legal basis is our legitimate interest in finding and fixing errors (Article 6(1)(f) GDPR).

Feedback form

If you send us feedback through the form, we store only your message and the page you send it from: no name, no e-mail address, no IP address and no cookies. Please don't write personal information in the message. We delete messages automatically after 12 months. The legal basis is our legitimate interest in improving the service (Article 6(1)(f) GDPR).

Contact by e-mail

If you write to the e-mail address above, Cloudflare forwards your message to our mailbox at Google (Gmail; Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). We use your address and your message only to answer you, and delete them when the conversation is over, unless the law requires us to keep them. The legal basis is handling your request (Article 6(1)(b) GDPR) and our legitimate interest in answering enquiries (Article 6(1)(f) GDPR).

Fonts, charts and prices

Fonts, the chart library and all other parts of the website are delivered by our own server. While you use it, your browser contacts no other company except Cloudflare (see above) and, only if you choose "Continue with Google", Google. Our server fetches the prices shown from our data sources (see "Sources and licences") without passing on any information about you.

Your rights

You have the right of access (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18) and data portability (Article 20). Where we process data on the basis of our legitimate interest, you may object at any time on grounds relating to your particular situation (Article 21 GDPR). To do so, write to the e-mail address above.

You can see, download and delete your account's data yourself in your settings (see "Exporting and deleting your data").

You also have the right to lodge a complaint with a data protection supervisory authority (Article 77 GDPR), for example the one responsible for us: Der Hessische Beauftragte für Datenschutz und Informationsfreiheit (the Hessian Commissioner for Data Protection and Freedom of Information), Gustav-Stresemann-Ring 1, 65189 Wiesbaden, Germany.

datenschutz.hessen.de

No obligation, no automated decisions

You don't have to give us any personal data beyond what is technically necessary; the markets, charts and explanations work without an account, the language cookie, the feedback form and e-mails. An account, with an e-mail address, is needed only for personal features. We make no decisions based solely on automated processing that have legal effects on you or similarly significantly affect you (Article 22 GDPR).

Changes

We update this notice when the service changes, for example before features that use AI for personal requests are switched on.