Privacy Policy — FinCast | ILTERRA

1. Who we are

ILTERRA.COM, a business registered in Poland at Poznań, Poland (“Fincast”, “we”, “us”), operates fincast.info, the Fincast web application and mobile applications (together, the “Service”). For the purposes of data protection law we are the controller of the personal data described below.

Questions about this policy, or any request concerning your data, may be sent to info@ilterra.com.

2. What this policy covers

This policy explains what personal data the Service collects, why it is collected, how long it is kept and what you can ask us to do with it. It applies to every part of the Service, however you reach it.

The Service displays market data and statistical forecasts. The terms on which it is provided, including the risks you accept by relying on anything it shows, are set out in the Terms of Use, which you should read together with this policy.

3. The data we collect

3.1 Data you give us

Account data. Your email address, an optional display name, your chosen interface language, and a cryptographic hash of your password. We never store your password itself.
Two-factor authentication. If you enable it, a secret used to verify the one-time codes your authenticator application generates.
Portfolio and watchlist data. The instruments, quantities, prices and dates you enter, and any notes or alert settings attached to them. This data exists so the Service can show you your own positions; we do not use it to profile you.
Preferences. Which markets you follow, how your dashboard is arranged, and your notification settings.
Messages you send us. Anything you write to support, including the address you write from.

3.2 Data created by your use of the Service

Session data. A session identifier so that you stay signed in, and the approximate time of your last activity.
Technical logs. IP address, request time, requested address, browser and operating system identifiers, and error diagnostics. These are produced automatically by the servers and are used to keep the Service running and secure.
Subscription records. Where you buy a subscription, the identifier the payment provider gives that subscription, the product purchased, its status and its expiry date.

3.3 Data from third parties

Apple. When you buy a subscription through the App Store, Apple confirms to us that the purchase is genuine and tells us which product was bought, when it expires and whether it has been refunded or revoked. Apple does not give us your name, your payment details or your Apple Account email.
Telegram. If you choose to connect a Telegram account to receive notifications, we receive the numeric identifier of that account so that messages can be delivered to it.

3.4 Advertising

Where the Service shows advertising, the advertising provider may set identifiers on your device and process them to select and measure advertisements. Where the law requires your consent for this, we ask for it before any such identifier is set, and you may withdraw that consent at any time through the settings offered at the point of asking or in your device. If you hold a paid subscription that removes advertising, no such identifiers are set by us.

3.5 What we do not do

We do not sell personal data. We do not track you across websites that are not ours. We do not buy data about you from data brokers. We do not use your portfolio, watchlist or forecast activity to build a profile of you for any purpose other than operating the features you are using, and we do not take decisions about you by automated means that produce legal effects or similarly significant effects.

4. Why we process it, and on what basis

Purpose	Data used	Legal basis
Creating and operating your account; keeping you signed in	Account data, session data	Performance of our contract with you
Showing your portfolio, watchlists, alerts and preferences	Portfolio and preference data	Performance of our contract with you
Selling and honouring subscriptions; granting and withdrawing paid access	Account data, subscription records	Performance of our contract with you
Sending notifications you have asked for	Account data, Telegram identifier	Performance of our contract with you
Keeping the Service available, diagnosing faults, preventing abuse and fraud	Technical logs, session data	Our legitimate interest in a working and secure service
Advertising and measuring it	Advertising identifiers	Your consent, where the law requires it
Answering your messages	Correspondence	Our legitimate interest in supporting users
Complying with accounting, tax and other legal obligations	Subscription records	Compliance with a legal obligation

We share personal data only with the parties below and only to the extent needed for the stated purpose. Service providers that process data for us are bound by appropriate data-protection terms. Disclosures to public authorities may be made where required by law.

Hosting and infrastructure providers, who store and transmit the data that makes up the Service.
Apple, in relation to purchases made through the App Store. We send Apple a transaction identifier in order to verify a purchase; we do not send Apple your Fincast account data.
Telegram, where you have connected an account, in order to deliver the notifications you asked for.
Advertising providers, where advertising is shown and where you have consented.
Professional advisers and authorities, where we are required by law to disclose data or need advice on a legal claim.

The providers whose market data the Service displays receive nothing about you. We request prices from them; we do not tell them who asked.

6. International transfers

Our providers may process data outside the country where you live, including outside the European Economic Area. Where that happens we rely on transfer mechanisms recognised by applicable law, such as the European Commission’s standard contractual clauses or an adequacy decision covering the destination country. You may ask us for details of the mechanism relied on for a particular transfer.

7. How long we keep it

Account, portfolio and preference data — for as long as your account is open, and for 30 days after you close it, after which it is deleted or irreversibly anonymised.
Subscription records — for as long as required by accounting and tax law, which is typically between five and ten years depending on the jurisdiction, and regardless of whether your account remains open.
Technical logs — up to 12 months, unless a longer period is needed to investigate a specific security incident.
Correspondence — up to 24 months after the matter is closed.

8. Your rights

Subject to the conditions and exceptions in applicable law, you may ask us to:

confirm whether we hold data about you, and give you a copy of it;
correct data that is inaccurate or incomplete;
delete data we no longer have a lawful reason to keep;
restrict how we use data while a dispute about it is resolved;
give you, or another provider, the data you supplied to us in a structured, machine-readable form;
stop processing carried out on the basis of our legitimate interests, where your situation gives you grounds to object.

Where processing is based on your consent, you may withdraw that consent at any time; doing so does not affect the lawfulness of what was done before.

Requests go to info@ilterra.com and are answered within one month. If we need longer because a request is complex we will tell you, with reasons, within that month.

If you believe we have handled your data unlawfully, you may lodge a complaint with a competent data-protection supervisory authority, including one in the EU Member State where you live, work or believe an infringement occurred. You may contact us first so we can try to resolve the matter, but you do not have to do so before making a complaint.

9. Closing your account

You may close your account at any time from your account settings. Closing it ends your access, stops further processing for the purposes in section 4 other than those we are legally required to continue, and begins the retention periods in section 7.

Closing your account does not cancel a subscription bought through the App Store. Auto-renewal is managed by Apple and must be turned off in your Apple Account settings; see the Terms of Use.

10. Security

Passwords are stored only as hashes. Traffic between you and the Service is encrypted in transit. Access to production systems is limited to the people who need it and is logged. These measures reduce risk; they do not eliminate it, and no service can promise that a determined attack will never succeed. If a breach occurs that is likely to result in a high risk to your rights, we will tell you without undue delay.

11. Cookies and similar technologies

The Service uses a small number of cookies and equivalent browser storage. Those that keep you signed in, remember your language and protect forms against cross-site request forgery are strictly necessary and are set without consent because the Service cannot work without them. Any cookie used for advertising or measurement is set only with your consent, as described in section 3.4.

12. Children

The Service is not directed at children and may not be used by anyone under 16. We do not knowingly collect data from children. If you believe a child has given us data, write to us and we will delete it.

13. Changes to this policy

The current policy is published at policies.ilterra.com/fincast/privacy/. Its public GitHub history records changes to the text. Changes apply when the revised policy becomes publicly available on the policy portal, except where applicable law requires advance notice or consent. We will bring material changes to your attention and obtain consent where required by law.

14. Contact

ILTERRA (YAUHEN PANIMATCHANKA), Brzask 10C/94, 60-369 Poznań, Poland. Email: info@ilterra.com. Website: fincast.info.