ANALESS TECHNOLOGIES operates Analess and is based in Victoria, Australia; our business details are in the Terms. We are responsible for the personal information described in this policy.
This policy explains what information we collect when you use our website and application, why we use it, who we share it with and how you can exercise your privacy rights.
Information the website and app handle
| Information | How we use it |
|---|---|
| Email signup details | Your email, name and signup page. We first email you a link to confirm the address; a signup that is not confirmed is deleted after about a week. With your permission we may also send you other emails, such as product updates, news and promotions. They are optional and off by default: we send them only if you opt in, either when you confirm your address or later. You can change your email preferences at any time in the Analess app or through the link in the footer of any of our emails. We keep a minimal record of when and where you signed up, confirmed or withdrew. Each subscription is separate. Our emails identify us and include an unsubscribe link; we honour withdrawals within applicable deadlines and keep only the opt-out record needed to prevent unwanted contact. |
| Contact and support information | Your name, email, message, relevant page and submission time, to respond to and resolve enquiries. |
| Account and access information | Account, device and session identifiers, email, profile and licence records, to authenticate you and manage access. Supabase handles authentication and account records (privacy policy). Google, Microsoft or Apple sign-in shares your name, email and account identifier with us; that provider’s privacy policy applies to its own processing. |
| Age eligibility declaration | Your confirmation that you are 18 or older and when you gave it, stored only on the device where you gave it to apply the eligibility requirement. It is not sent to us and is not included in cloud sync, backups or crash reports. We do not ask for your birth date or identity documents. |
| Technical and security information | IP addresses, browser/device signals and security events, to deliver the service, prevent abuse and investigate problems. Security checks may flag or restrict suspicious account activity. We use your IP address when you activate a device but do not keep it in device activation records. |
| Optional diagnostics | Error messages, stack traces, technical events, app/device versions, performance traces and installation/session identifiers, sent to our diagnostic service, Sentry (privacy policy), when enabled, to diagnose faults and improve reliability. |
| Advertising information | The device, app, location and ad-interaction information described under Advertising, to deliver ads in the ad-supported app and, with your consent, personalise them. |
| AI and other integrations | Prompts, code or other content you submit, plus workspace context attached to the request, such as code or chart information, to perform the requested function. It goes directly from your device to the chosen provider, not through Analess servers. |
| Market-data connections | Your chosen provider receives your IP address, requested instruments or data, and any credentials needed for authenticated requests, directly from your device, not through Analess servers. |
| Cloud sync, when you enable it | With your explicit consent, selected workspace content and device/sync metadata go to your chosen cloud provider, not Analess servers. Content is designed to be encrypted on your device using a key only you hold. |
| Purchases and subscriptions | Stripe holds payment card and billing details directly (privacy policy); we never receive your full card number. We receive plan, subscription, transaction, renewal and refund records, and tax billing details, to manage subscriptions and meet accounting and tax duties. |
We minimise incidental personal information in support messages and diagnostics. Linkable installation and session identifiers are personal information, even without an account link.
Connected services are identified, with the data sent, at the connection or submission point. Their privacy policies govern their own handling; Analess is responsible for what the app sends. Review the provider’s terms and privacy notice before connecting, and only share material you are authorised to provide. See Your content for workspace information.
Our Security page explains safeguards, platform limits and how to report a security issue.
Why we process information
Where EU or UK data protection law applies, we use these legal bases for the purposes described above:
- Contract or steps you request before a contract for the account, subscription or other function you request, where the processing is necessary to provide it.
- Legitimate interests in security, fraud prevention, enquiries and lawful non-personalised ad delivery, subject to an assessment that your rights do not override those interests. This does not replace required advertising consent. Australian-law recordkeeping for EU or UK users relies on this basis only where a documented assessment supports it.
- Legal obligations for records or disclosures required by applicable EU or UK law.
- Consent for marketing emails you ask to receive, optional diagnostics, personalised advertising and non-essential tracking, including advertising cookies or device access where required.
Optional information is not required. We need your email for requested emails and account details for an account; without them we cannot provide that function.
You can withdraw consent through the privacy controls in the app and on the website, or through the unsubscribe link in any email. Withdrawal does not affect the lawfulness of earlier processing. Declining optional processing does not itself prevent access to the core service.
Cookies and browser storage
The website uses local storage on your device to remember your theme, dismissed translation notices and privacy choice, including its version and date. Theme and notice preferences remain until changed, the notice changes or you clear browser storage. The privacy record remains until replaced or cleared; optional permission expires within 12 months, while a refusal stays refused. Sign-in may also use short-lived security storage when you use that function.
Configured forms use Cloudflare Turnstile, which receives browser, device and network signals before submission for bot detection and its own bot-detection improvement. See Cloudflare’s notice.
We send email, including signup confirmations and our team’s notifications of new contact messages, through Cloudflare Email Service, which receives the recipient address and the message content to deliver it (privacy policy).
Any non-exempt storage or device access requires prior consent; its provider, purpose, information and duration are disclosed before you choose. Optional choices are off by default. Use Cookie choices in the footer to accept, refuse or withdraw them as easily. Withdrawal stops future optional processing and triggers deletion where applicable. We renew optional permission within 12 months and sooner if purposes or providers materially change.
We honour applicable opt-out signals such as Global Privacy Control. A signal is not consent, and earlier optional consent does not override a legally effective opt-out.
You can also clear or block browser storage; this may reset preferences or affect sign-in. App advertising and its consent requirements are described below.
Advertising
The ad-supported app shows non-personalised ads by default. Personalised ads use information about your activity and interests to select ads and are off unless you opt in. Declining personalisation does not remove ads.
Our ad server and advertising providers may receive your IP address, approximate location, device and app details, and ad-interaction information to deliver and measure ads and prevent fraud. Providers and their privacy notices are identified in the app.
Non-personalised ads can still use cookies or device identifiers that require consent. Where consent is required, we ask before using those technologies; without it, we only show ads that can lawfully be delivered without them.
Change or withdraw consent in Settings → Privacy & Data → Advertising. Withdrawal stops the relevant future processing and is passed to providers where required. We honour applicable opt-out signals, including Global Privacy Control, for sale, sharing or targeted advertising.
Your content
Your charts, indicators, code, strategies, journals and other workspace content remain your property. By default, they are not processed or stored on Analess servers. They reach a provider only through an integration you choose, or if included in support or optional diagnostics, as described above. We do not use your trading activity or content for advertising.
Sharing and international processing
Besides the recipients described above, hosting, storage, security and support providers receive information needed to operate those services, subject to applicable contractual and legal restrictions. We may disclose limited information where lawfully necessary for legal duties, security investigations or legal claims.
We operate in Australia. Our providers are likely to process information in other countries, including the United States, and Cloudflare processes it across its global network, including near your location. Providers you connect yourself, such as AI, market-data or cloud-storage providers, process information where they operate, as described in their privacy notices. Where required, transfers are supported by an applicable adequacy decision or contractual safeguards and any necessary supplementary measures.
Data breaches
If a data breach involving your personal information is likely to cause you serious harm, we will notify you and the relevant regulators as required by law, including Australia’s Notifiable Data Breaches scheme and EU or UK data protection law. We will tell you what happened, what information was involved and what steps you can take to protect yourself.
Retention and deletion
We keep information only for as long as needed for its purpose or an applicable legal requirement. Our Data Retention and Deletion Policy sets out the periods, exceptions, backup treatment and deletion procedure.
You can delete your account from the account section of the app’s settings. When you delete your account, the app asks whether to also delete the Analess data held in your connected cloud storage. Deleting an account does not erase files stored solely on your device or copies held independently by a provider.
Optional diagnostics are linked to an app installation, not to your account, so deleting your account does not automatically find them. To access or delete diagnostics already sent, or to object to their use, email privacy@analess.com. The app shows this installation’s diagnostics ID under Settings > Privacy & Data; including it helps us locate your installation’s records. We will explain what other information can help, and act on a valid request without waiting for the records to expire.
Your rights
You can request access, correction, deletion or restriction, portability where applicable, object to processing, withdraw consent, and opt out of any applicable sale, sharing or targeted advertising. You may request review of refused privacy requests or account restrictions. We do not discriminate against you for exercising privacy rights and accept authorised agents where applicable.
Use the app’s consent and account-deletion controls, or email privacy@analess.com for requests and complaints; no particular form is required. We verify identity only as necessary to protect your information. Our response target is 28 days, subject to earlier legal deadlines. EU and UK requests normally have a one-month deadline; any extension or clarification follows applicable law, with permitted extensions explained within the initial period.
We explain refusals and routes for review, regulatory complaints or judicial remedies. Complaints receive a reasoned outcome and next steps, normally within 28 days.
EU and UK users can complain to a data protection supervisory authority, particularly where they live or work or where an alleged infringement occurred.
Children
The Service is for adults aged 18 or over. Before app use, including without an account, we require an age declaration but do not verify age. The declaration is not advertising consent.
Changes to this policy
We publish every change on this page with an updated date. Before a material change takes effect, we notify you in the app or by email. We obtain fresh consent when required.