Privacy Policy

We collect the minimum data necessary to provide and improve our service:

DepthSignal is a market-data analytics service. We provide visible market context and supporting analytics. We do not handle funds, execute orders, or connect to your exchange accounts. We have no access to your exchange credentials, balances, or order history. Account credentials are stored using one-way cryptographic controls and cannot be recovered in plaintext.

RoxPay is the primary payment-service-provider adapter for supported DepthSignal checkout flows. RoxPay processes hosted payment details, while DepthSignal stores the customer, invoice, payment reference, settlement, refund, subscription, and tax records needed to operate the billing workflow.

DepthSignal's billing and tax authority remains the system of record for payment references, invoice records, refund records, subscription state, settlement tracking, and VAT/GST monitoring. RoxPay is an adapter and does not replace that authority.

Under GDPR Article 6, we process your personal data on the following legal bases:

• Contract performance (Art. 6(1)(b)): Processing your account information and subscription data is necessary to provide the DepthSignal service you subscribed to. (GDPR Article 6(1)(b); contract basis)
• Legitimate interest (Art. 6(1)(f)): Processing API usage logs for abuse prevention, rate limiting, service security, and service improvement. Our legitimate interest is to maintain a secure, reliable API service. This does not override your fundamental rights. (GDPR Article 6(1)(f); legitimate interests)
• Legal obligation (Art. 6(1)(c)): Retaining certain data as required by Estonian and EU tax, accounting, and business regulations.
• Consent (Art. 6(1)(a)): Newsletter subscriptions are based on your explicit, freely given consent via double opt-in. You can withdraw consent at any time by unsubscribing. (GDPR Article 6(1)(a); consent)

We retain personal data only for as long as necessary for the purposes set out in this policy (GDPR Article 5(1)(e); storage limitation).

As a data subject, you have the following rights under the GDPR. Where possible, we provide self-service API endpoints so you can exercise these rights immediately:

• Right of access (Article 15): The account download below covers only selected customer-account data. It is not a full access response; newsletter subscriptions are separate controller-side records, are not included, and may not be linked to an account. Other data must be requested separately.
• Right to rectification (Article 16): You can update your profile information (email, company name) directly via the customer portal profile settings. (Article 16)
• Right to erasure (Article 17): You can delete your account and all associated data by calling DELETE /v1/customer/me. This permanently removes your account, API keys, and usage data. Billing records are retained for 7 years as required by Estonian tax law. EU Article 16(m) consent records (per-transaction audit trail for the 14-day withdrawal-right waiver) are retained 7 years under the legitimate-interest legal basis (Article 6(1)(f)) for the same Estonian Accounting Act + EU consumer-protection enforcement window. These records survive Article 17 erasure of the linked customer account: the customer link is set to NULL, the consent record itself remains so that, if a chargeback or consumer-protection claim is filed, the original consent can still be evidenced. (Article 17)
• Right to data portability (Article 20): You can export selected customer-account data in structured, machine-readable JSON by calling GET /v1/customer/export. The response includes your profile, API-key metadata when present, up to 90 days of usage records (maximum 10,000), up to 10,000 security events, and AI conversations/messages when available (maximum 1,000 conversations); it excludes separately stored newsletter subscriptions. (Article 20)
• Right to restriction (Article 18): You can request that we restrict processing of your data in certain circumstances. (Article 18)
• Right to object (Article 21): You can object to processing based on legitimate interest. We will cease processing unless we demonstrate compelling legitimate grounds. (Article 21)

How to exercise your rights: To request information outside the customer-account download, including separately stored newsletter subscription records, contact us at info@depthsignal.io. The account download and a separate access request are distinct. We will handle requests under applicable data-protection law. If you are unsatisfied with our response, you may lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) or your local supervisory authority (GDPR Article 77).

We split cookies and comparable browser storage into three categories. The consent banner shown on your first visit lets you accept, reject, or customize them. Your choice is stored in the ds_consentcookie (and a localStorage mirror) for one year. You can revisit the banner any time via the Cookie Preferences link in the footer (ePrivacy Directive 2002/58/EC Article 5(3); GDPR Article 7(3)).

No third-party advertising networks or fingerprinting vendors are used. Optional analytics and behavioral analytics only run after consent.

The application can run optional consent-gated analytics only when the relevant project identifiers are configured. In the application, analytics remains off until you grant consent through Cookie Preferences. Umami analytics may run on public pages and core product pages, while auth, billing, account-settings, signup, and similar sensitive routes remain excluded by default. These statements describe application integrations; separately configured CDN or edge request processing depends on the deployment and provider configuration.

• Umami: optional self-hosted, cookieless application analytics. The application checks for analytics consent before the tracker script loads; its endpoint can be configured per deployment. This does not establish whether separately configured CDN or edge request processing is active.
• Legal basis: consent (GDPR Article 6(1)(a)). Analytics stays off by default until you opt in and can be revoked through Cookie Preferences.
• Retention: Umami raw events are kept for up to 90 days before anonymization or deletion.
• Third-party sharing: none: Umami is self-hosted on our own infrastructure, so no analytics data is transferred to a third-party provider.
• Opt-out controls: you can withdraw site consent from Cookie Preferences.

Your rights: under GDPR you can access, rectify, erase, port, or object to this processing at any time. You can also exercise all of these from inside the app:

• Reject or customize cookies from the banner or Cookie Preferences link in the footer.
• Toggle analytics at any time from Account Settings → Privacy.
• Download current customer-account data via GET /v1/customer/export; separately stored newsletter records are not included.
• Delete your account (right to erasure). Account deletion also removes related first-party product analytics profiles where technically linked to your account.

We share personal data with the following third-party processors only, each bound by data processing agreements (GDPR Article 28):

We do not use third-party advertising networks or fingerprinting vendors. The analytics integrations listed above may process personal data when configured and enabled under the application consent and route controls. CDN, hosting, payment, and other service providers are described in their applicable sections and agreements; separate edge request processing depends on deployment configuration.

Core DepthSignal infrastructure is hosted in the European Union. Most account and service operations run on EU-hosted systems.

Some processing involves US-based sub-processors for specialized services (for example, email delivery, AI processing, and issue tracking). Hosted payment processing uses the RoxPay payment-service-provider adapter for supported checkout flows; its provider location, transfer basis, and safeguards follow RoxPay's current processing terms. Where personal data is transferred outside the EEA, we apply GDPR Chapter V safeguards, including Standard Contractual Clauses and additional contractual or technical protections where required.

For UK-restricted transfers, UK transfer addendum mechanisms are applied where legally required. For Switzerland-restricted transfers, Swiss transfer requirements are applied where legally required.

As a small company, we are not required to appoint a Data Protection Officer (DPO) under GDPR Article 37. However, for any data protection inquiries, you may contact us directly:

• Email: info@depthsignal.io
• Subject line: "Data Protection Inquiry"

You also have the right to lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon) (GDPR Article 13(1)(a)-(b)):

• Website: www.aki.ee/en
• Email: info@aki.ee

When you use AI chat features, the following applies to your conversation data:

• Storage. Your messages and AI responses are stored in our database to provide chat history across sessions.
• Third-party processing. Conversations are sent to a third-party AI provider for processing. Current provider: OpenAI.
• No model training. AI providers process conversation data under contractual data processing commitments. Data Processing Agreements (DPAs) are in place with relevant sub-processors, including transfer safeguards where required.
• Your control. You can delete all conversation history at any time from Settings.
• Automatic deletion. Conversations are automatically deleted after 90 days on all plans.

The legal basis for processing AI conversation data is contract performance (Art. 6(1)(b) GDPR): processing is necessary to deliver the AI feature you have requested as part of your subscription.

We may update this Privacy Policy to reflect changes in our practices or legal requirements. When we make material changes, we will notify you via the email address associated with your account at least 14 days before the changes take effect.

The current version of this Privacy Policy is always available at this page. Minor clarifications or formatting changes may be made without notice.