GDPR Privacy Rights

Last updated: July 2025

1. Introduction

ChartPlay is committed to protecting your privacy and ensuring that your personal data is handled in a transparent and lawful manner. This page explains your rights under the General Data Protection Regulation (GDPR) and how you can exercise them.

For a complete description of our data practices, including the full categories of data we collect and how we use them, please refer to our Privacy Policy. This page focuses specifically on your GDPR rights and related information.

2. Scope

This page applies to all users of ChartPlay who are located in the European Economic Area (EEA), the United Kingdom, or Switzerland. If you access ChartPlay from these regions, your personal data is processed in accordance with the GDPR and related local laws.

Even if you are located outside these regions, ChartPlay aims to respect applicable privacy regulations and provide a consistent standard of data protection for all users wherever reasonable.

3. Personal Data We Collect

We collect only the personal data necessary to provide and improve the ChartPlay service. Depending on how you use the platform, we may collect:

  • Account information: email address, username, display name, and account preferences.
  • Authentication data: hashed password (if using email sign-up) or Google OAuth identifiers (if using Google sign-in). When you sign in with Google, ChartPlay receives only the information you authorize (such as your email address and name). ChartPlay never receives your Google password.
  • Login activity: timestamps, IP addresses, browser type, and operating system when you access ChartPlay.
  • Challenge history and results: challenges you participate in, your trade decisions, outcomes, and associated performance statistics.
  • XP progression and statistics: experience points, performance metrics, and progress tracking data.
  • Journal entries and screenshots: notes, tags, and images you upload as part of your trading journal.
  • Payment metadata: blockchain network, payment currency, payment amount, transaction hash, and wallet addresses related to cryptocurrency payments.
  • Support communications: messages and files you send through support or contact forms.

We never collect or store private wallet keys, seed phrases, or fiat payment instrument details. We do not collect sensitive data such as racial or ethnic origin, political opinions, religious beliefs, health information, or biometric data.

Paid plans only increase monthly challenge participation limits and do not affect challenge outcomes or trading performance.

4. Why We Process Your Data

We process your personal data for the following purposes:

  • Account management: creating and maintaining your account, managing subscriptions, and processing payments.
  • Authentication and security: verifying your identity, protecting against unauthorized access, and detecting fraudulent or abusive activity.
  • Service delivery: providing market replay, trade simulation, journaling, analytics, and other core features. Challenge history, journals, XP progression, and statistics are retained to provide the educational features of the platform.
  • Customer support: responding to your inquiries, troubleshooting issues, and providing technical assistance.
  • Service improvement: analyzing usage patterns to improve the platform, fix bugs, and develop new features.
  • Notifications: sending account-related communications such as verification emails, password resets, and security alerts. With your separate consent, we may send product updates and marketing communications.
  • Legal obligations: complying with applicable laws, regulations, and lawful requests from authorities.

Under the GDPR, we process your personal data under the following legal bases:

Processing Activity Legal Basis
Account creation, management, and subscription processing Performance of a contract
Service communications (security alerts, support responses) Performance of a contract / legitimate interest
Marketing and promotional emails Consent
Platform analytics and feature improvement Legitimate interest / consent (where cookies apply)
Security monitoring, fraud detection, and abuse prevention Legitimate interest
Compliance with legal obligations and regulatory requests Legal obligation

6. Your GDPR Rights

As a data subject in the EEA, UK, or Switzerland, you have the following rights under the GDPR:

Right of Access (Article 15)

You have the right to obtain confirmation as to whether we process your personal data and, if so, to request a copy of that data along with information about how and why it is processed.

Right to Rectification (Article 16)

You have the right to request correction of inaccurate or incomplete personal data we hold about you. You can update most account information directly through your profile settings.

Right to Erasure — “Right to be Forgotten” (Article 17)

You have the right to request deletion of your personal data. You can delete your account at any time through your account settings. We will process erasure requests within 30 days, subject to legal retention obligations. Note that on-chain cryptocurrency payment records cannot be erased as they are part of an immutable blockchain.

Right to Restrict Processing (Article 18)

You have the right to request restriction of processing in certain circumstances, such as when you contest the accuracy of your data or have objected to processing pending our verification.

Right to Object (Article 21)

You have the right to object to processing based on legitimate interests, including profiling for direct marketing. We will cease processing unless we demonstrate compelling legitimate grounds that override your interests.

Right to Data Portability (Article 20)

You have the right to receive your personal data in a structured, commonly used, machine-readable format and to transmit that data to another controller where technically feasible.

Right to Withdraw Consent

Where processing is based on your consent, you have the right to withdraw that consent at any time. Withdrawal does not affect the lawfulness of processing based on consent before its withdrawal. You can manage consent preferences through your account settings.

Right to Lodge a Complaint

If you believe that our processing of your personal data infringes the GDPR, you have the right to lodge a complaint with your local data protection authority. Contact details for EEA data protection authorities are available on the European Data Protection Board website.

To exercise any of these rights, contact us at [email protected]. We will respond to your request within 30 days. We may ask you to verify your identity before processing certain requests.

7. Data Retention

We retain your personal data only as long as necessary to fulfill the purposes described in this page and our Privacy Policy, comply with legal obligations, resolve disputes, and enforce agreements. Challenge history, journals, XP progression, and statistics are retained to provide the educational features of the platform for the duration of your account.

For a detailed breakdown of retention periods by data category, please see our Privacy Policy.

8. Data Security

ChartPlay takes the security of your personal data seriously. We implement appropriate technical and organizational measures to protect data against unauthorized access, alteration, disclosure, or destruction. These measures include:

  • Encryption where applicable: data in transit is protected using TLS; sensitive data at rest is encrypted using industry-standard algorithms.
  • Secure authentication: passwords are hashed using modern industry-standard algorithms (currently bcrypt); Google OAuth uses secure token-based authentication.
  • Access controls: access to personal data is restricted to personnel who need it for their role.
  • Security monitoring: we monitor for suspicious activity and unauthorized access attempts.
  • Security logging: logs are retained for fraud detection, abuse prevention, and platform security.

While we strive to protect your data, no system is completely secure. We encourage you to use strong passwords and enable any additional security features we provide.

9. International Data Transfers

ChartPlay operates globally. Your personal data may be transferred to, stored in, and processed in countries outside your country of residence, including the United States and other jurisdictions where our service providers operate. When we transfer personal data from the EEA, UK, or Switzerland to other jurisdictions, we strive to apply appropriate safeguards to protect your personal data in accordance with applicable law.

By using ChartPlay, you acknowledge that your data may be processed in jurisdictions where data protection laws may differ from those in your country of residence.

10. Third-Party Services

ChartPlay engages trusted third-party service providers to deliver certain aspects of the platform. We ensure that these providers process your data only on our instructions and in compliance with applicable data protection laws:

  • Authentication: Google LLC provides OAuth-based sign-in services. When you sign in with Google, ChartPlay receives only the information you authorize. Google's use of your data is governed by Google's Privacy Policy.
  • Email delivery: a third-party email service provider handles account verification, password resets, and support correspondence.
  • Infrastructure: hosting providers store and process data on our behalf under contractual terms that require data protection.

We do not sell your personal data to third parties.

11. Contact

For privacy-related inquiries, data subject access requests, or questions about this page:

We aim to acknowledge your request within 5 business days and respond fully within 30 days. We may need to verify your identity before processing your request.

12. Policy Updates

We may update this GDPR Privacy Rights page from time to time to reflect changes in our data practices, legal requirements, or the features we offer. When we make material changes, we will update the “Last updated” date at the top of this page and notify users through a notice on the platform or via email.

We encourage you to review this page periodically. Your continued use of ChartPlay after changes take effect signifies your acceptance of the updated terms, where your consent is not otherwise required by law.