Privacy Policy

1. Controller

Alejandro del Castillo Martín, Spanish tax ID 09148369G, address at C/ del Retamar 3, 28816 Camarma de Esteruelas (Madrid), Spain. Privacy contact: soporte@grandalpha.app.

2. What data we process

Account (email, encrypted password, name, @, declared level) · Public analyst profile (full name, bio, socials, photo, track record and metrics) · Content (predictions, watchlist, follows, activity) · Push (technical subscription identifier) · Technical (IP in security logs; aggregated, anonymous analytics without cookies) · Chat (the text of your queries). We do not process banking data. No advertising cookies or trackers; local storage is purely technical.

3. Purpose and legal basis

Providing the Service and publishing analysts' verifiable track records (contract and legitimate interest in the integrity of the record) · transactional emails (contract) · push (consent, revocable in Settings) · security and anti-abuse (legitimate interest and legal obligation) · aggregated analytics (legitimate interest).

4. Public analyst profiles

If you are an analyst, your full name, your @ and your public track record are visible to anyone. It is the essence of the Service and you are informed before publishing. Sealed predictions cannot be edited or deleted individually; when you delete your account they are deleted in full.

5. Processors and recipients

We do not sell your data. Processing it on our behalf: Supabase (database and authentication), Vercel (hosting, logs and aggregated analytics), Resend (emails), Anthropic (chat) and Upstash (technical cache, no personal data). Competent authorities where the law requires it.

6. International transfers

Providers in the U.S. covered by the EU-U.S. Data Privacy Framework or by Standard Contractual Clauses.

7. Retention

Account and content: while the account exists (on deletion they are erased without delay; backups rotate on technical timescales). Security logs: maximum 12 months.

8. Your rights

Access, rectification, erasure, objection, restriction and portability. Self-service: in Settings you can download your data (JSON) and delete your account permanently. Also by email to soporte@grandalpha.app. Complaints: the Spanish Data Protection Agency (aepd.es).

9. Security

HTTPS/TLS, row-level access control (RLS), keys only on the server, a content policy without third-party scripts, double email verification for password changes and per-IP abuse limiting.

10. Minors

Service for those over 18. Accounts of minors that are detected are deleted.

11. Changes

We will publish updates here and give notice of substantial ones in the app or by email.