Information on the processing of personal data (GDPR)

Last updated: April 2026

1. Data controller

The controller of your personal data is Cogmedia Sp. z o.o., based in Poland (hereinafter: the “Controller”).

For matters related to the protection of personal data, you can contact us at: kontakt@traderaiassistant.com.

2. Legal bases for processing

We process your personal data on the following legal bases, pursuant to Art. 6(1) of the GDPR:

  • Consent (Art. 6(1)(a) GDPR) to the extent you have consented to the processing of your data for specific purposes, e.g. receiving marketing communications or a newsletter. Consent may be withdrawn at any time.
  • Performance of a contract (Art. 6(1)(b) GDPR) processing of data necessary to perform the contract for the provision of electronic services (account management, subscription handling, and delivery of Service features such as the trading journal and AI analysis).
  • Legitimate interest of the controller (Art. 6(1)(f) GDPR) for ensuring the security of the Service, preventing abuse, conducting anonymous analytics to improve the product, and establishing or defending against legal claims.
  • Legal obligation (Art. 6(1)(c) GDPR) to the extent required by applicable law, e.g. tax or accounting regulations relating to billing for paid subscriptions.

3. Data recipients

Your data may be shared with the following categories of recipients, only to the extent necessary to fulfil the purposes of processing:

  • Supabase (AWS) provider of database infrastructure and the authentication system. Stores user account data and transactional data.
  • Vercel provider of hosting and frontend infrastructure. Processes analytics data related to the Service's performance.
  • Resend provider of transactional email services. Processes email addresses to send account-related messages (confirmations, notifications).
  • OpenAI / Anthropic providers of artificial intelligence models. A user's transactional data may be sent to these services to generate AI analyses and feedback. Data is transmitted in anonymized form and is not used to train models.

Each of the above entities processes data under data processing agreements (DPAs) compliant with GDPR requirements.

4. Data transfers outside the EEA

Some of our service providers may process data outside the European Economic Area (EEA), in particular in the United States. In such cases, the data transfer is based on:

  • Standard Contractual Clauses (SCCs) template contractual clauses approved by the European Commission that ensure an adequate level of protection for personal data.
  • EU-U.S. Data Privacy Framework for providers certified under the framework that ensures an adequate level of data protection, as confirmed by the European Commission's adequacy decision.

We make every effort to ensure that data transferred outside the EEA is protected at a level no lower than that required by the GDPR.

5. Rights of the data subject

Under Articles 15–21 of the GDPR, you have the following rights:

  • Right of access (Art. 15) the right to obtain confirmation as to whether your data is being processed, and to obtain a copy of it.
  • Right to rectification (Art. 16) the right to request prompt correction of inaccurate data or completion of incomplete data.
  • Right to erasure (Art. 17) the right to request deletion of your data when it is no longer necessary for the purposes for which it was collected, or when consent has been withdrawn.
  • Right to restriction of processing (Art. 18) the right to request restriction of processing in specific cases, e.g. when you contest the accuracy of the data.
  • Right to data portability (Art. 20) the right to receive your data in a structured, commonly used, machine-readable format, and to transmit it to another controller.
  • Right to object (Art. 21) the right to object to processing based on the controller's legitimate interest, including profiling.

To exercise the rights above, send a message to: kontakt@traderaiassistant.com. We will handle your request without undue delay, and no later than within 30 days.

6. Right to lodge a complaint

If you believe that the processing of your personal data violates the GDPR, you have the right to lodge a complaint with the supervisory authority:

President of the Polish Data Protection Authority (UODO)

ul. Stawki 2, 00-193 Warsaw, Poland

Website: uodo.gov.pl

However, we encourage you to contact us first at kontakt@traderaiassistant.com, so we can clarify any concerns and resolve the issue directly.