Privacy policy

1. What we store

• Your account: email address, display name, a scrambled form of your password (never the password itself), whether two-step login is on, which version of the terms you accepted and when, and your settings such as theme, time zone and notification choices.
• Your strategies: the rules the AI wrote from your description, every saved version and the text of your teaching conversations.
• Your use of the tool: the markets you watch, alerts sent to you, backtests you ran, your trading accounts and journal entries, and for each chart picture you upload for a check: which market and strategy it was for (the picture itself is read once and not kept).
• Your plan: which plan you are on, its status and renewal date, and an id from our payment provider. We never store card numbers.
• Support: messages you send through the support page and our replies.
• Safety records: a scrambled count of failed login attempts per address, and a log of actions taken by our staff on accounts.

We do not ask for, and do not want, anything more: no identity documents, no trading account logins, no financial details beyond what the payment provider needs.

2. Why we use it, and the legal basis

Data protection law (the Protection of Personal Information Act of South Africa, and the GDPR in the European Union and the United Kingdom) asks us to say which legal reason covers each use. These are ours:

• To run the service you signed up for (our contract with you): this is the main reason and covers almost everything in section 1.
• To take payment and keep tax and accounting records (a legal obligation).
• To keep accounts safe and the service working (our legitimate interest, which does not override yours): limits on login attempts, the staff action log, and page-view counts that cannot identify you.
• To answer you when you write to us (our contract with you, or our legitimate interest in replying).
• To send you product news by email only if you switched that on (your consent, which you can withdraw at any time in Settings).
• To improve the service, using totals only (our legitimate interest): how many alerts were sent, how often a feature is used. We do not read individual strategies or journals for this.

We do not use your data for advertising, we do not use it to train any AI model, and no decision with a legal or similar effect on you is ever made automatically.

3. Your strategies are private

Your strategies, journal, alerts and backtests belong to your account and the database itself refuses to show them to any other account. Our staff can look at an account, read only, to answer a support question, fix a problem or stop misuse. They cannot change anything in it, and every look is written in a staff action log that nobody can edit. Nothing of yours is ever shown to or used to help another user.

4. Who else handles your data

We use a few trusted companies to run the service. Each one handles only what it needs, only on our instructions, under a written data processing agreement (or that company's own binding terms) and under its own privacy terms. We do not share your data with anyone else, and we never sell it.

• Supabase (database and login), stored in the European Union (Frankfurt). Holds everything in section 1.
• Vercel (the website) and Railway (the market scanner, European Union). They run the code; the scanner reads your rules and watches to produce your alerts. Vercel also counts page views for us: which pages are opened, roughly where from (country and device type), without cookies and without a way to tell who you are.
• Anthropic (the AI). The text of your teaching conversation and a chart picture you upload for a check are sent to Anthropic to turn them into rules and explain them. Once a week, for the weekly review on Home, the numbers the site counted from a trading account's journal and your saved backtests are sent too (results, win rates, strategy and market names; never your notes or your email address). Each request is sent on its own, under Anthropic's commercial terms, which do not allow it to use your data to train its models; Anthropic may keep what was sent for up to 30 days for its safety checks and then deletes it.
• Paddle (payments, as merchant of record). Paddle holds your card details, billing address and tax information under its own privacy policy. We receive only your plan status and a customer id.
• Resend (email delivery) receives your email address and the content of each email we send you (password links, alerts, notices).
• Our market data provider gives us prices. It receives nothing about you.
• TradingView (the free economic calendar in the news panel), only if you click "Show today's calendar". Your browser then loads it from TradingView, which receives your network address and details of your browser and may set its own cookies, under TradingView's privacy policy. We do not tell it which page you are on. "Stop showing it" ends this.

Some of these companies are outside South Africa, the European Union or the United Kingdom. Where data leaves those places it is protected by the provider's contract terms as the law requires (for the GDPR, the standard contractual clauses).

We hand over data to anyone else only when the law obliges us to, for example under a valid court order, and then only what the order covers; we tell you unless the law forbids it. If the business were ever sold, your data would go with the service under these same promises, and we would tell you first.

5. Cookies and local storage

SetupSight sets only cookies that the service needs to work, so there is no cookie banner to click:

• Login session: keeps you signed in. Set by our login provider (Supabase) when you log in and removed when you log out.
• Sign-up ticket: while a new account waits for its confirmation email, a signed one-hour ticket lets the sign-up page ask whether that one account is confirmed.
• Bot check: a short-lived token on the log in, sign-up and password reset pages, which says the security check passed.

Your theme and the chart display choices you make (such as which indicators are shown) are kept in your browser's own storage, not in a cookie, and never leave your device. Page views are counted without cookies and without identifying you (section 4). There are no advertising or tracking cookies. The only content from another company is TradingView's news calendar, which loads only after you choose to show it (section 4).

6. Emails and notifications

We send emails about your account (password links, receipts, important notices) and, if you turn them on, alerts. You can switch alert emails and browser notifications on or off in Settings under Notifications.

Product news by email (new features, tips) is off unless you switch it on in Settings under Notifications. Every such email has a link to stop them, and switching the choice off in Settings stops them too. We never send marketing emails to someone who has not opted in, and we never pass your address to anyone else for marketing.

7. How long we keep it

• Everything in your account: for as long as the account exists.
• When you delete your account under Your data in Settings, it goes at once with everything in it; our backups fall away within 30 days. If you ask us in writing instead, we delete it within 30 days of your request.
• Billing records: Paddle keeps them for as long as tax law requires, and so do our accounts.
• Safety records: failed-login counts are removed within a day; the sign-up ticket expires after an hour; the staff action log is kept for two years and older entries are removed by themselves.
• At our providers: Anthropic keeps what was sent to it for up to 30 days (section 4); Resend keeps a log of each email it delivered for a limited time under its own terms.
• Page-view counts are kept only as totals, which contain nothing about you.

8. Your rights

Under the Protection of Personal Information Act of South Africa, and the GDPR if you are in the European Union or the United Kingdom, you can:

• see the data we hold about you, and take a copy of your strategies, journal, alerts and the rest in a readable file (Download my data, under Your data in Settings);
• correct it (most of it you can change yourself in Settings);
• delete it, yourself, under Your data in Settings, or by writing to us;
• object to a use based on our legitimate interest, or ask us to restrict a use while we look into a concern;
• withdraw consent at any time where a use rests on it (product news by email, in Settings), without affecting what was done before;
• complain to the Information Regulator of South Africa or to your own country's data protection authority. We would rather hear from you first, so we can put things right.

Write to us at the address below. We answer within 30 days and never charge for this. We may ask you to confirm it is really you before we act, so that nobody else can get your data.

9. Security

Every connection is encrypted. Passwords are stored only in scrambled form. The database enforces that each account sees only its own data. Secret keys stay on our servers and never reach your browser. Logins have attempt limits. We check the security of each part of the service before it goes live, and the packages the site is built from are checked for known problems with every change.

If a security breach ever affected your data, we would tell the regulator (within 72 hours where the GDPR applies, and as soon as reasonably possible under the Protection of Personal Information Act) and tell you without undue delay, saying what happened, what it means for you and what we are doing about it. If you find a security problem in SetupSight, please write to us at the address below; our security.txt file says the same.

10. Children

SetupSight is for adults. We do not knowingly keep data about anyone under 18.

11. Changes and contact

If this policy changes in a way that matters we will tell you by email or in the app before it applies. The date at the top is the date of the current wording.

Swift and Sure Group (South Africa) is the responsible party (the data controller) for everything on this page. Questions or requests: swiftandsuregroup@gmail.com, or the support page in your account. The terms of service cover the rest of the agreement between us.