Legal

Privacy Policy

Last updated: September 2026

This Privacy Policy explains how MarketTherm ("we", "us") collects, uses, and protects personal data of visitors to markettherm.com ("the Site"), in compliance with the EU General Data Protection Regulation (GDPR) and Spain's LOPDGDD (Organic Law 3/2018).

1. Data controller

The Site is operated under the trade name MarketTherm as a personal, non-commercial project — see the Legal Notice for details.

Data Protection Officer (DPO): not appointed — not required at the Site's current scale.

2. What data we collect

The Site does not require user accounts or registration to view market data. We currently collect:

—Standard web server/CDN logs from our hosting provider (Cloudflare) — IP address, browser type, requested page, and timestamp — used only for security and reliability, not for tracking individuals.
—Contact data: if you email us, we collect your email address and the content of your message.

We do not currently use any analytics, advertising, or tracking tool, and we do not currently collect financial account information, payment data, or government ID numbers.

The Site's watchlist feature (starring assets) is stored only in your browser's local storage — it is never sent to our servers and we have no visibility into it. Clearing your browser data removes it. See the Cookie Policy for details.

3. Purposes and legal basis for processing

Purpose	Legal basis
Operating and maintaining the Site	Legitimate interest (Art. 6.1.f GDPR)
Security and abuse prevention (server/CDN logs)	Legitimate interest (Art. 6.1.f GDPR)
Responding to contact inquiries	Legitimate interest / performance of a request you initiated
Future: analytics or newsletter, if introduced	Consent (Art. 6.1.a GDPR) — this policy will be updated first

4. Data retention

—CDN/security logs are retained per Cloudflare's standard retention period for its free/pro tier.
—Contact/email correspondence is retained for as long as necessary to handle the inquiry and for a reasonable period afterward for record-keeping.

5. Who we share data with

—Cloudflare, Inc. — static site hosting and CDN (serves every page you view).
—Supabase (hosted on AWS, eu-west-1 / Ireland) — database backend for market data and daily scores. This database holds no personal data about Site visitors, only market data.
—We do not sell personal data to third parties.

6. International data transfers

Our database backend (Supabase) is hosted in the EU (Ireland), within the European Economic Area. Cloudflare is a US-based company; where it processes any personal data covered by this policy (CDN logs), transfers are carried out under an applicable safeguard mechanism such as Standard Contractual Clauses, as required by GDPR Chapter V.

7. Your rights

Under GDPR, you have the right to:

—Access the personal data we hold about you.
—Rectify inaccurate data.
—Erase your data ("right to be forgotten").
—Restrict or object to certain processing.
—Data portability, where applicable.
—Withdraw consent at any time, where processing is based on consent, without affecting the lawfulness of processing before withdrawal.
—Lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, AEPD) — www.aepd.es — if you believe your rights have been violated.

To exercise these rights, contact us via the contact details published in the Legal Notice.

8. Security

We apply reasonable technical and organizational measures to protect personal data against unauthorized access, loss, or alteration. No system is completely secure, and we cannot guarantee absolute security.

9. Children's privacy

The Site is not directed at individuals under 18, and we do not knowingly collect personal data from minors.

10. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be reflected with an updated "Last updated" date at the top of this page.