01 Parties
This DPA applies between you ("User" or "Data Subject") and Backcandle ("Data Controller").
Backcandle acts as the controller of personal data you provide when creating an account and
using the service. Third-party sub-processors are listed in Section 06.
02 Categories of data processed
- Identity data — your name and email address, obtained via Google OAuth at sign-in
- Session data — replay sessions you create, including instrument, timeframe, duration, and configuration
- Trade data — orders, fills, positions, and P&L records generated during replay sessions
- Journal data — notes you write on trades and sessions
- Subscription records — if you buy a plan: the plan, billing cycle, amount, currency, the payment provider's reference, and the subscription's dates. Card and bank details are collected by the payment provider, never by us.
- Usage data — page visits, feature interactions, and error logs (no third-party analytics trackers)
03 Purposes and legal basis
- Service delivery — processing your trade and session data to run the simulator (contractual necessity)
- Account management — storing your identity data to authenticate you and persist your settings (contractual necessity)
- Analytics & improvement — aggregated usage metrics to improve the product (legitimate interest)
- Legal compliance — retaining records as required by applicable law (legal obligation)
04 Retention
Personal data is retained for as long as your account is active. If you delete your account,
personal data is removed within 30 days, except where retention is required by law.
Aggregated, anonymized performance data may be retained indefinitely as it cannot be linked
back to you.
05 Your rights
Under GDPR and equivalent legislation you have the right to:
- Access — request a copy of the personal data we hold about you
- Rectification — request correction of inaccurate data
- Erasure — request deletion of your account and associated personal data
- Portability — receive your trade and session data in a structured machine-readable format
- Restriction — request that we limit processing of your data in certain circumstances
- Objection — object to processing based on legitimate interest
To exercise any of these rights, email support@backcandle.com. We will respond within 30 days.
06 Sub-processors
- Google LLC — OAuth authentication (Google Sign-In)
- Paddle — payment processing as merchant of record, when you buy a plan
- Error-monitoring service — reports of application errors, configured to exclude personal data such as your email and IP address
- Hosting provider — infrastructure and database hosting in the EU
We do not sell or share personal data with third parties for advertising purposes.
We do not use third-party behavioral analytics trackers.