Privacy Policy
This policy describes how Zentralog collects, uses, retains and protects your personal data when you use our trading-journal application. It is written to comply with the EU General Data Protection Regulation (GDPR, Regulation 2016/679) and the Spanish Organic Law on Data Protection and Guarantee of Digital Rights (LOPDGDD, LO 3/2018).
Last updated: 2026-10-12 · Version: v1.2
1. Introduction
Zentralog is a web-based trading-journal and analytics platform. We help individual traders import, review and analyse their own trading activity from supported brokers. We only process the personal data needed to provide the service, and we do not sell your data to third parties.
By creating an account or otherwise using Zentralog you confirm that you have read this policy. If you do not agree with it, please do not use the service.
2. Who we are
The controller of your personal data is the owner of Zentralog identified in our Legal Notice (app.zentralog.com/legal/notice), who operates the service under the Zentralog name while the company is being set up. Contact for any privacy matter: info@zentralog.com. We have not appointed a Data Protection Officer because we are not required to under Article 37 GDPR.
3. What personal data we process
We process the minimum personal data needed to operate the service. We do not process special categories of data within the meaning of Article 9 of the GDPR.
3.1 Account data
Email address, hashed password, display name (optional), language and theme preferences, account creation date and last sign-in metadata. We collect this directly from you when you register. Signing in with Google is optional. If you choose it, Google sends us your name, email address, profile picture and Google account identifier. We use your email and name to create your account and sign you in; the picture and the identifier stay with your sign-in record at our authentication provider, and we do not use them for anything else.
3.2 Broker credentials
When you connect a broker, we receive credentials or OAuth tokens for the brokers and platforms you choose to connect (the current list is shown in the app when you add an account), sufficient to retrieve your trading activity on a read-only basis. Section 5 below describes how these credentials are handled in detail.
3.3 Trading data
Account information, orders, fills, executions, closed trades, profit and loss, instruments traded, timestamps and any notes you add. We synchronise this from your connected brokers, and we may also accept manual imports (CSV) or in-app entries.
3.4 Technical and usage data
IP address, user-agent string, timezone, session identifiers, application logs and error reports. When you have given consent we may also process aggregated analytics data through Vercel Analytics (see section 12). When it is switched on, the sign-in, sign-up and password-reset forms use Cloudflare Turnstile to tell people from bots: Cloudflare checks signals from your browser and your IP address, and we only use the result to accept or block the form.
3.5 Communications
Any message you send us by email or through support channels, including the email address you write from and the content of the conversation.
3.6 Website
On www.zentralog.com we process: the data you send through the contact form (name, email and message); your language preference; and, only if you accept analytics cookies, usage data collected by Microsoft Clarity (pages visited, clicks, scrolls and mouse movements, device and browser data, and an approximate location derived from your IP). Form fields are masked and are not recorded by Clarity.
3.7 Data stored on your device
To make the app faster, some of your own data (for example the names of your strategies and sessions) is kept in your browser’s local storage. It stays on your device and is not shared. See the Cookie Policy for details.
3.8 Mentorship
If a mentor invites you and you accept, the mentor can see, read-only, your name and your email address (the mentor already has it: it is the one they invited you with) and all your trading accounts (current ones, archived ones and any you connect later): their dashboard, their trades and the note of each trade, as described on the invitation screen. Your stats also count towards the mentor’s group stats, which only the mentor sees. The mentor does not see your notebook, My Day or logbook, nor your settings, connections, passwords or payment details.
To invite you, the mentor gives us your email address. We use it only to send you the invitation, by email through Resend, and the email tells you who invited you. Your acceptance is recorded with its date and the version of the conditions you accepted, and we keep a record of each time your mentor opens your data (who opened what, and when).
You can leave the mentorship at any time from “My mentor”: the mentor loses access to your trading data immediately (they keep only your name and email in their list of former students) and you keep all your trading data. When a mentorship ends (you leave, the mentor removes you or the community closes), its own records (your acceptance and the feedback, with its images, reviews and messages exchanged in it) are kept for 12 months and then deleted. If you are a mentor, your students see your name, your community’s name and what you post for them. If you share one of your accounts, they see it read-only while you share it: its dashboard, its trades and all the notes on those trades, text and images included. If you share one of your strategies, they see it read-only with its Notes tab while you share it, and each student keeps a copy of the strategy, without its notes, even if you stop sharing it.
4. Why we process your data
We process the data described above for the purposes set out in the table below, each relying on a specific legal basis under Article 6 of the GDPR.
| Purpose | Data used | Legal basis |
|---|---|---|
| Provide the journaling and analytics service | Account, broker credentials, trading, technical | Performance of contract (Art. 6.1.b) |
| Authenticate users and protect accounts | Account, technical | Performance of contract (Art. 6.1.b) |
| Synchronise broker activity into your journal | Broker credentials, trading | Performance of contract (Art. 6.1.b) |
| Improve the product through aggregated analytics | Technical, usage | Consent (Art. 6.1.a) |
| Prevent fraud, abuse and security incidents | Account, technical, logs | Legitimate interest (Art. 6.1.f) |
| Comply with legal and tax obligations | Account, billing (if applicable) | Legal obligation (Art. 6.1.c) |
| Answer your support and privacy requests | Communications, account | Legitimate interest (Art. 6.1.f) |
| Answering your contact form or emails | Your name, email and message | Legitimate interest (Art. 6.1.f) and, where you ask about using Zentralog, steps prior to a contract (Art. 6.1.b) |
| Website analytics with Microsoft Clarity | Website usage data (see 3.6) | Consent (Art. 6.1.a), which you can withdraw at any time from “Cookie settings” on the website |
| Sign-in with Google | See 3.1 | Contract (Art. 6.1.b), only if you choose it |
| Protecting sign-in, sign-up and password reset against bots (Cloudflare Turnstile, when switched on) | Technical (IP address, browser signals) | Legitimate interest (Art. 6.1.f) |
| Letting your mentor see your trading data (mentorship), only if you accept an invitation | Account (name, email), trading | Consent (Art. 6.1.a), which you withdraw by leaving the mentorship |
| Sending a mentorship invitation to the email address a mentor gives us | The invited email address; the mentor’s and the community’s names | Legitimate interest (Art. 6.1.f) |
| Keeping a record of your mentor’s access to your data | Access record (mentor, data opened, time) | Legitimate interest (Art. 6.1.f): accountability, and answering you if you ask who saw your data |
Where processing relies on your consent (analytics), you can withdraw it at any time from the cookie preferences panel without affecting the lawfulness of any processing carried out before withdrawal.
5. How we handle broker credentials
Broker credentials are the most sensitive data we handle. We take the following measures:
- Encrypted at rest. Credentials and OAuth tokens are stored encrypted in our database using industry-standard symmetric encryption. The encryption keys are held separately from the encrypted data.
- Minimum-necessary access. Only the synchronisation service that runs on your behalf can decrypt credentials, and only at the moment of an active sync operation. The credentials are not displayed back to you or to our staff after they are stored.
- Read-only use. We use credentials exclusively to retrieve account, order, execution and closed-trade information. We never place, modify or cancel orders on your behalf.
- Where your credentials go. Only our sync service uses them. For MetaTrader 5 accounts, the sync runs on a dedicated server we operate, hosted by Contabo GmbH in Germany: your MT5 login, server and investor (read-only) password are sent there, encrypted in transit, only to fetch your trades. Apart from that, your credentials are only sent to the broker or platform they belong to.
- Revocation. You can disconnect any broker at any time from your account settings. On disconnection we delete the stored credentials within 30 days, unless we are required to retain them longer to comply with a legal obligation.
6. Who we share data with
We share data only with the providers we need to run Zentralog. Each acts on our instructions under a data processing agreement (Art. 28 GDPR), except where noted:
| Provider | What for | Data | Location |
|---|---|---|---|
| Supabase | Database, sign-in, file storage | All account and trading data | EU (Ireland) |
| Vercel Inc. | Hosting of the app and the website; logs; Vercel Analytics and Speed Insights (app, only with consent) | Technical data (IP, browser, pages), app logs with your user ID | Servers in the EU (Dublin); US company |
| Inngest Inc. | Background jobs (syncs, imports) | User and account identifiers, job results | US company (hosted on AWS) |
| Zoho Corporation | Mailbox of info@zentralog.com: the emails you send us, including website contact-form messages, and our replies | Your email address, your name if you give it, and the content of the messages | EU |
| Contabo GmbH | Server for MetaTrader 5 syncs | MT5 login, server and investor password, your MT5 trades | Germany |
| Resend Inc. | Delivery of account emails (sign-up verification, password reset) and mentorship invitations from no-reply@zentralog.com, and of website contact-form messages to us | Your email address, your name if you give it, and the content of the message | EU (sending region); US company |
| Cloudflare, Inc. | Bot protection on sign-in, sign-up and password reset (Turnstile), when switched on | IP address and browser signals | Global network; US company |
| Microsoft Corporation (Clarity) | Website analytics, only with consent | Website usage data (see 3.6) | US |
| Your mentor, only if you accept their invitation | Sees your data as described in 3.8, to give you feedback. Mentors are bound by the mentor terms to use it only for the mentorship | See 3.8 | — |
| Sign-in with Google, only if you choose it. Google acts as an independent controller under its own privacy policy | See 3.1 | — | |
| Your brokers and platforms | They receive your credentials to authenticate you and return your trading data. They act as independent controllers | Credentials, trading data | — |
Market data providers (prices and charts) receive no personal data.
We may also disclose data to lawyers, accountants or public authorities when the law requires it.
7. International transfers
Some providers are US companies or may process data outside the European Economic Area. In those cases we rely on the EU–US Data Privacy Framework when the provider is certified under it, or on the European Commission’s Standard Contractual Clauses, with additional measures where needed. You can ask us for a copy of the safeguards at info@zentralog.com.
8. How long we keep your data
We retain personal data only as long as needed for the purposes for which it was collected, or as required by law.
| Data category | Retention period |
|---|---|
| Account data | For as long as your account is active, plus 30 days after deletion in backups |
| Broker credentials | Until you disconnect the broker, then deleted within 30 days |
| Trading data (journal) | For as long as your account is active, then deleted within 30 days |
| Application logs | Up to 90 days |
| Contact-form messages, emails and support or privacy requests | Up to 3 years from our last exchange, to handle follow-ups and to defend potential claims |
| Microsoft Clarity (website) | Session recordings 30 days; aggregated heatmap and click data up to 9 months |
| Mentorship invitations not accepted (expired, declined or cancelled) | 30 days after they expire or are answered, whichever comes first |
| Accepted mentorship invitations | 30 days after acceptance (your acceptance stays recorded with the mentorship) |
| Record of your mentor’s access to your data | 12 months from each access |
| Ended mentorships (you left, the mentor removed you or the community closed): your acceptance and the feedback with its images, reviews and messages | 12 months after the mentorship ends, then deleted |
| Accounting and tax records (if applicable) | As required by Spanish law (typically 6 years) |
9. Your rights
Under the GDPR and the LOPDGDD you have the following rights regarding your personal data:
- Access. Obtain confirmation of whether we process your data and receive a copy of it.
- Rectification. Have inaccurate or incomplete data corrected.
- Erasure. Have your data deleted when it is no longer needed, you withdraw consent, or you object to processing without overriding legitimate grounds.
- Restriction. Have processing temporarily suspended while a dispute or request is being resolved.
- Portability. Receive your data in a structured, commonly used, machine-readable format and have it transmitted to another controller where technically feasible.
- Objection. Object to processing based on legitimate interest, in particular for direct marketing.
- Withdrawal of consent. Withdraw any consent you have given, at any time, without affecting the lawfulness of prior processing.
- Not to be subject to fully automated decisions that produce legal effects or significantly affect you. We do not currently make such decisions (see section 13).
10. How to exercise your rights
You can exercise any of the rights above by emailing info@zentralog.com from the email address associated with your account. We may ask for additional information to verify your identity if there is a reasonable doubt about who is making the request.
We will respond within one month of receipt. The deadline may be extended by two further months for complex or numerous requests; we will inform you within the first month if that is the case.
To delete your account, write to info@zentralog.com from the email address of your account. We will delete your account and its data within one month, except what we must keep by law. You can also delete your journal, notebook or all your data at any time from Settings → Data & privacy.
11. Security
We apply technical and organisational measures appropriate to the risk: encryption in transit (TLS) and at rest for sensitive fields, role-based access controls, audit logging, isolated infrastructure, periodic dependency updates and the principle of least privilege. No method of transmission or storage is perfectly secure; in the event of a personal data breach affecting your rights and freedoms we will notify you and the Spanish Data Protection Authority within 72 hours as required by Articles 33 and 34 of the GDPR.
13. Automated decisions and profiling
Zentralog does not make decisions about you that are based solely on automated processing and that produce legal effects or significantly affect you in similar ways. The analytics and journal insights we present are informational; they do not block, approve or deny any service or transaction automatically.
14. Children’s data
Zentralog is intended for adults who trade financial instruments. The service is not directed to children and we do not knowingly collect personal data from anyone under 18. If you believe a minor has provided us with personal data, please contact us and we will delete the data without undue delay.
15. Changes to this policy
We may update this policy. The version and date are shown at the top. If a change materially reduces your rights or changes how we use your data, we will tell you in the app or by email before it applies. Other changes (clarifications, new providers we need to run the service, legal updates) apply from the date they are published.
16. Complaints and contact
For any privacy question or complaint, please contact us first at info@zentralog.com. If you are not satisfied with our response, you have the right to file a complaint with the Spanish Data Protection Authority (Agencia Española de Protección de Datos, AEPD) at www.aepd.es or, if you reside in another EU country, with your local supervisory authority.