LEGAL
Privacy Policy
This policy explains what personal data Auroli processes, why we process it and how you can exercise your privacy rights.
Draft dated 3 October 2026
Last updated: [publication date]
[Full legal name], trading as Auroli, is the controller responsible for the processing described in this policy.
Address: [registered address and country]
Privacy contact: [email address]
Data Protection Officer: [contact details, if applicable]
This policy covers our public website and the Auroli services identified below.
Depending on the features you use, we process the following information:
Account information: [confirm email address, profile information, authentication data and settings].
Trading information: [confirm account identifiers, instruments, trade times, volumes, prices, fees, balances and trading results].
Journal content: notes, screenshots and other information you choose to record.
Learning activity: [confirm lesson progress, answers, achievements and activity history].
Contact information: your email address, optional name and messages you send us.
Technical information: [confirm IP addresses, device information, access logs and error reports].
Payment information, if paid plans are offered: [confirm billing details and payment records].
[Remove categories that are not collected and specify the actual fields before publication.]
Required fields are identified when we ask for information. Without information necessary to create an account or provide a requested feature, we may be unable to provide that account or feature. Optional fields can be left blank.
Please avoid including unnecessary information about other people or sensitive information, such as health details, in journal entries or support messages.
We use personal data for specific purposes and identify a legal basis for each activity.
| Purpose | Data used | Proposed legal basis — confirm before publication |
|---|---|---|
| Create and operate your account | Required account and authentication data | Performance of our agreement |
| Provide your journal and requested analysis | Journal content and trading records | Performance of our agreement, where necessary |
| Retrieve records through a connection you request | Connection identifiers and supported trading records | Performance of our agreement, where necessary |
| Provide lessons and track progress | Learning activity | Performance of our agreement, where necessary |
| Answer enquiries | Contact details and message | Steps requested before an agreement, performance of an agreement, or a specifically assessed legitimate interest, depending on the enquiry |
| Protect accounts and investigate technical faults | Relevant security and technical logs | Legitimate interests in securing and maintaining the service, subject to an assessment |
| Meet applicable accounting requirements | Required billing and transaction records | Legal obligation |
| Send optional newsletters | Email address and subscription preferences | Consent |
[Confirm this mapping against the actual processing. Document any legitimate-interest assessment and describe any additional purpose separately.]
Accepting our Terms & Conditions is not consent to optional marketing. Where we rely on consent, you may withdraw it without affecting the lawfulness of earlier processing.
We receive information directly from you when you register, record journal content or contact us.
If you connect a trading account, we also receive supported trading records from [platform, broker and integration provider], through the connection you request.
Before connecting, you will be informed about the provider, the information retrieved and the permissions required.
[Specify the actual data sources, access credentials or tokens processed, connection frequency and disconnection procedure.]
Disconnecting stops future retrieval according to the connection’s operation. It does not automatically erase records already stored in your journal; see the retention information and your deletion rights below.
The providers used to deliver Auroli are:
[Insert the actual providers or sufficiently specific recipient categories, their purposes, the data disclosed and whether they act as processors or independent controllers.]
This may include hosting, authentication, account integrations, email delivery, support, payment processing or AI services, but only where actually used.
Where a supplier processes data on our behalf, we put the required processing agreement in place. Independent controllers are responsible for their own processing and privacy information.
We may disclose information where required by law or where necessary and lawful to establish, exercise or defend legal claims.
[Confirm whether community sharing, advertising, data sales or other disclosures occur. Do not publish an unsupported “we never share your data” statement.]
[Identify whether data can be accessed or processed outside the European Economic Area, including through suppliers, support teams and subprocessors.]
For each applicable transfer, specify the destination and the safeguard used, such as an applicable European Commission adequacy decision or Standard Contractual Clauses with any necessary additional measures.
You can request information about the applicable safeguards, including a copy where appropriate, through [privacy contact].
[If no international transfers occur, replace this section with a verified statement to that effect.]
We retain personal data only for as long as necessary for its stated purpose, including applicable legal requirements.
Our retention schedule is:
Account and journal data: [period or specific retention criteria, including after closure].
Connection credentials or tokens: [period and revocation/deletion procedure].
Support enquiries: [period or criteria].
Security and technical logs: [period or criteria].
Learning activity: [period or criteria].
Billing records: [applicable statutory period and categories].
Backups: [maximum retention cycle and deletion handling].
Newsletter records: [period after withdrawal and any limited suppression record].
Where information must be retained for a legal obligation or a specific legal claim, we limit its use to that purpose.
Our Cookie Policy identifies the cookies and similar technologies actually used, their purposes, providers and durations.
[Confirm the consent controls and distinguish necessary technologies from technologies requiring consent.]
Account notices and messages needed to provide the service are separate from optional marketing.
If you subscribe to an optional newsletter, you can unsubscribe through [unsubscribe method]. Your marketing choice does not affect access to unrelated core features.
[Confirm whether AI features or profiling are available. If they are, identify the data used, purpose, legal basis, provider, retention, transfers and whether data is used for model training.]
Personalised analysis or lesson recommendations may involve profiling where personal data is used to evaluate aspects of your behaviour or performance. Describe the actual operation and available controls here.
[Confirm whether Auroli makes decisions based solely on automated processing that produce legal or similarly significant effects. If so, explain the relevant logic, consequences, legal conditions and safeguards. If not, state this only after verification.]
Do not treat optional AI processing as automatically necessary for providing a basic trading journal.
We are required to implement technical and organisational measures appropriate to the risks of processing.
[Describe verified measures in plain language, such as restricted access, secure transmission, authentication controls and incident handling. Do not claim certifications or protections that have not been implemented.]
If a personal data breach occurs, we assess and fulfil applicable notification obligations.
Subject to the conditions in applicable law, you may request access, correction, deletion, restriction of processing or portability of your personal data.
You may object to processing based on legitimate interests. You may object to direct marketing at any time.
Where processing relies on consent, you may withdraw it at any time.
Send requests to [privacy email]. We may request information reasonably necessary to verify your identity.
We respond without undue delay and normally within one month. Where legally permitted because of the complexity or number of requests, we may extend this by up to two additional months and explain the extension within the first month.
Requests are normally free. Any legally permitted charge or refusal will be explained.
You may complain to the Dutch Autoriteit Persoonsgegevens at https://www.autoriteitpersoonsgegevens.nl, or to another competent supervisory authority. You do not have to contact us first.
Auroli’s minimum account age is [confirmed age].
[Explain whether minors may use the service, any parental-authorisation process and applicable safeguards.]
Where processing relies on a child’s consent for an online service, applicable parental-consent requirements must be met. Account eligibility and consent to processing are separate requirements.
We update this policy when our processing changes. The publication date identifies the current version.
Where appropriate or legally required, we will notify you of material changes before new processing begins and obtain any consent required.
For questions about this policy or your personal data, contact [privacy email] or use our contact page.
See our Cookie Policy for information about cookies and similar technologies.