Privacy Policy

Who we are

EdgeFound is operated by Clément Pouille ("EdgeFound", "we", "us", "our"), a sole trader. EdgeFound is the data controller for personal data you provide through the Service under the EU General Data Protection Regulation (GDPR).

For any privacy-related question or to exercise your rights, contact us at support@theedgefound.com.

EU Representative

EdgeFound is currently operated as a sole trader outside the European Union. Under Article 27 GDPR, non-EU controllers offering services to EU residents are generally required to appoint an EU Representative as a local point of contact for data subjects and supervisory authorities.

We have not yet appointed a formal EU Representative. We are in the process of establishing an EU presence (Estonia), which will satisfy this requirement. In the meantime, EU data subjects may contact us directly at support@theedgefound.com, and we will respond to all privacy requests within the GDPR timeframes.

Data Protection Officer

EdgeFound does not currently meet the threshold for a mandatory Data Protection Officer under Article 37 GDPR. For all privacy matters, please use the contact details above.

Personal data we collect

We collect the following categories of personal data :

• Identity and account data — your email address, display name, password (stored hashed), authentication tokens, and account preferences such as timezone and time format.
• Billing data — handled by Paddle as Merchant of Record (see section 6). We receive only limited non-sensitive metadata from Paddle, such as your subscription plan, status, and renewal date.
• Trading data — trades you import or log (entry, exit, instrument, size, P&L, notes), daily flow entries, pre-trade checklists, reflections, charts you upload, and the broker accounts you connect.
• Portfolio data — connected brokerage snapshots (Wise, Revolut, IBKR, MT5 via MetaAPI), position history, and balance snapshots.
• MT5 credentials — if you connect an MT5 account, your MT5 investor password is transmitted to and stored by MetaAPI, not by EdgeFound. Investor passwords are read-only.
• Technical data — IP address, browser user-agent, request timestamps, and audit logs necessary to operate and secure the Service.

How we use your data and lawful bases

We process your personal data only where we have a lawful basis to do so under Article 6 GDPR :

We do not currently run analytics cookies, advertising cookies, or any third-party tracking. If we add any in the future, we will update this Policy and obtain your consent where required.

Third parties we share data with

EdgeFound relies on a small number of trusted providers. Each is bound by its own privacy policy ; links are provided below.

We do not sell your personal data. We do not share your trading data with anyone beyond the providers listed above.

International data transfers

EdgeFound is operated from Thailand. Your data is primarily stored on servers in the European Union (Hetzner, Falkenstein, Germany). Some processing takes place outside the EEA :

• Thailand — operational access by the sole trader. Thailand does not have an EU adequacy decision ; we rely on appropriate safeguards and strict access controls.
• United Kingdom — Paddle and MetaAPI UK infrastructure. The UK benefits from a valid EU adequacy decision.
• United States — Resend (transactional email) and parts of MetaAPI's infrastructure. Transfers are covered by the EU-US Data Privacy Framework where applicable, or by Standard Contractual Clauses.

How long we keep your data

Your rights

Under the GDPR, you have the following rights in respect of your personal data :

• Access — obtain a copy of the personal data we hold about you (Article 15).
• Rectification — correct inaccurate or incomplete data (Article 16).
• Erasure — request deletion of your data, subject to retention obligations (Article 17).
• Restriction — ask us to limit processing in certain circumstances (Article 18).
• Portability — receive your data in a structured, machine-readable format (Article 20).
• Objection — object to processing based on our legitimate interest (Article 21).
• Automated decisions — not be subject to automated decisions with legal effects (Article 22). We do not make such decisions.
• Withdraw consent — where processing is based on consent, at any time (Article 7(3)).

EdgeFound supports self-serve export and deletion from your account settings under "Your Data". For any other request, email support@theedgefound.com. We respond within 30 days, extendable by 2 months for complex requests.

Right to lodge a complaint

If you believe we have not handled your data in accordance with the GDPR, you have the right to lodge a complaint with your national data protection supervisory authority. A list of EU supervisory authorities is available on the European Data Protection Board website.

If you do not provide your data

Some data is required to provide the Service. If you do not provide your email, you cannot create an account. If you do not provide billing information to Paddle, you cannot subscribe to a paid plan. Optional data (display name, trade notes, etc.) can be omitted without preventing basic use of the Service.

Automated decision-making and profiling

EdgeFound does not make any automated decisions with legal or similarly significant effects concerning you. Analytics, dashboards, and regime indicators are informational outputs ; no decisions are taken automatically about you or your account.

Security

We implement technical and organisational measures appropriate to the risks of processing, including : HTTPS/TLS encryption in transit, password hashing, HTTP-only JWT session cookies, rate limiting, audit logging, encrypted backups, principle of least privilege, and encrypted storage of third-party credentials where applicable.

No security measure is absolute. If we become aware of a personal data breach that poses a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours and inform affected users without undue delay, as required by Articles 33 and 34 GDPR.

Cookies and local storage

EdgeFound uses only strictly necessary cookies and local storage items required to operate the Service. We do not use analytics, advertising, or third-party tracking cookies. Because all stored items are strictly necessary, no consent banner is required under the ePrivacy Directive.

Children

The Service is not intended for users under the age of 16. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact support@theedgefound.com and we will delete it.

Changes to this Policy

We may update this Privacy Policy from time to time. Material changes will be notified by email or by a prominent notice within the Service. The "Last updated" date at the top of this page indicates the current version. Previous versions are available on request.

Contact

Questions, concerns, or requests related to your personal data? Email us at support@theedgefound.com. We aim to respond within 30 days.