Documento legal · Actualizado 2026-08-23

Privacy Policy

This policy describes how DYNC Solutions LLC ("Stravex", "we") collects, uses and protects your personal information. It applies to the Platform hosted at stravex.io and app.stravex.io.

1. Data we collect

1.1 Account data

Name and email address (at signup).
Password (stored as a bcrypt hash with salt — never in plain text).
Optional profile picture.
UI preferences (light/dark theme, language).

1.2 Billing data

Card processing is delegated entirely to Stripe Inc. (PCI DSS Level 1). Stravex never touches your card number — from Stripe we only receive the last four digits, the brand and the expiry date, to display in your account.

1.3 Usage data (trading)

Watchlist tickers and saved comparisons.
Trades you record manually (My Trades).
Journal notes.
Paper trading positions and P&L.
Personal Discipline Rules and any documented overrides.

1.4 Technical data

IP address — rate limiting, aggregate geolocation and abuse prevention: we log the IP address and user agent of every sign-in and every authenticated API call, to detect a single account or API key being shared between several people, which the Terms prohibit. These logs are stored against your account, are not shared with third parties, and are purged along with the rest of our technical logs (90 days).
Signup IP address and user agent — conversion measurement. If you reached STRAVEX from an advertisement, we keep a copy of the IP address and user agent from the exact moment you created your account, stored alongside your attribution record, and we share them with Meta Platforms, Inc. for a single purpose: so that Meta can match your subscription to the ad that produced it, and so we are not billed for advertising that does not work.

Three things worth being precise about:

· Meta does not receive your name or email in the clear — only SHA-256 hashed versions, which cannot be reversed.
· This copy is separate from the technical logs above: it is retained for as long as your attribution record exists, not 90 days.
· If you arrived organically — not from any advertisement — this copy is never created and there is nothing to share.

You can request its deletion at any time by writing to support@stravex.io (§ 8).
Browser user agent (compatibility + account-sharing signal).
Access timestamps (audit trail).
Error logs (no personally identifiable information).

1.5 Advertising attribution data (public site)

Only on the public site stravex.io, and only if you accept the cookie banner: campaign click identifiers (gclid, fbclid, msclkid) and any utm_* parameters present in the URL you arrived with. They tell us which ad or campaign brought you here. Section 6 has the detail.

2. Data we do NOT collect

Stravex does not collect or process your brokerage account credentials, your real balance, orders executed at your broker, or any financial data beyond what you voluntarily record in My Trades. We have no broker API integration — everything is manual input.

3. What we use your data for

Running the service: authentication, authorization, and rendering your portfolio.
Personalization: your dashboard, Trade Finder suggestions, and a contextualized Score 360°.
Communication: email alerts (configurable), billing notifications, and product updates.
Product improvement: aggregated, anonymized analysis of usage patterns (e.g. which features get used most).
Abuse prevention: detecting shared accounts and API keys, leaked credentials and scraping patterns — using IP address, user agent and access frequency.
Advertising measurement: attributing signups to the campaign that produced them, on the public site and only with your consent (section 6).
Legal compliance: auditing, fraud prevention, and responding to legitimate legal requests.

4. Market data (third-party providers)

Stravex aggregates market data from institutional-grade providers under commercial license (options flow, greeks, implied volatility and historical data).

Those providers receive no personal data about Stravex users. The calls are made from our backend workers with our own API keys — the request originates from Stravex, not from an individual user.

5. Sharing with third parties

We share data only with:

Stripe Inc. — payment processing (subject to their privacy policy).
Microsoft Azure — hosting (Azure SQL, Container Apps, and the Microsoft Graph API for email).
Sentry — error tracking (personal data redacted).
Vercel Analytics + Speed Insights — anonymous performance metrics.
Google LLC — Google Analytics 4 and Google Ads, on the public site and only if you accept the cookie banner (section 6).
Meta Platforms, Inc. — Meta Pixel on the public site, only if you accept the cookie banner (section 6); and the conversion measurement described in section 1.4.
Authorities — only under a valid legal request.

We never sell your data. There are no affiliate programs involving data sharing. The advertising measurement tools in section 6 live exclusively on the public marketing site: no advertising pixel or tag runs inside the Platform (app.stravex.io), and your watchlists, trades, notes and account data never travel to Google or Meta.

6. Cookies, analytics and advertising attribution

6.1 Essential cookies

Session, authentication and UI preferences. They are required for the Platform to work and do not require consent.

6.2 Analytics and advertising cookies

On the public site we use, only after your explicit acceptance:

Google Tag Manager — collects no data by itself: it is the container that loads the measurement tools listed below. It writes no cookies of its own and adds no providers beyond the ones we declare here.
Google Analytics 4 — aggregate audience and behaviour metrics (_ga, _ga_* cookies).
Google Ads — campaign conversion measurement (_gcl_au, _gcl_aw cookies).
Meta Pixel — conversion measurement for Facebook and Instagram campaigns (_fbp cookie).

Denied by default. We implement Google's Consent Mode v2: when the page loads, analytics_storage, ad_storage, ad_user_data and ad_personalization are all set to denied before the tag container loads, and the tools it loads only activate when you press Accept. If you press Reject, no advertising or analytics cookie is written at all.

6.3 First-party attribution cookies

We write two first-party cookies on the .stravex.io domain — shared by stravex.io and app.stravex.io, so we do not have to ask you again when you move from one to the other:

stravex_consent — your decision (granted / denied). Valid for 1 year.
stravex_attr — only if you accept. Stores the campaign click identifier (gclid, fbclid, msclkid), the utm_* parameters from the URL you arrived with, the landing path, the host that referred you, and the date. It always keeps the first touch and is never overwritten. Valid for 90 days. It contains no personal data: no name, no email, no IP address, no device identifiers.

When you click a signup or free-trial button, those same parameters also travel in the URL to app.stravex.io, so the signup can be attributed to the right campaign even if your browser restricts cookies.

6.4 How to change or withdraw your decision

Withdrawing consent is as easy as giving it. You can reopen the banner at any time and choose again; when you do, we delete stravex_attr and your previous decision. You can also delete or block cookies from your browser settings: the site works the same without them.

7. Data retention

Active account: retained for as long as your subscription is active.
After cancellation: 90 days of grace for reactivation, then permanent deletion (except billing records required by tax law, approximately 10 years).
Technical logs: 90 days.
Attribution records: retained for as long as your account exists, including the signup IP address and user agent described in section 1.4. You can request their deletion at any time.
Backups: rolling 30 days on geo-redundant Azure SQL.

8. Your rights (GDPR + CCPA)

Whatever your jurisdiction, we guarantee the following rights:

Access: export all of your data as JSON from your account panel.
Rectification: edit any personal data in your profile.
Erasure: the right to be forgotten — request full deletion at privacy@stravex.io and we execute it within 30 days.
Portability: your data is exportable in standard formats (JSON / CSV).
Objection: you can opt out of marketing email while keeping transactional email.
No discrimination (CCPA): exercising these rights does not affect your price or the quality of the service.

9. Security

TLS 1.3 on every connection.
bcrypt password hashing (cost factor 12+).
Short-lived JWTs with refresh rotation.
SQL prepared statements (no SQL injection).
Internal RBAC (SuperAdmin / Admin / User roles).
Audit trail on access to sensitive data.

In the event of a breach: affected users are notified within 72 hours (GDPR compliant).

10. Minors

Stravex is for people aged 18 and over. We do not knowingly collect data from minors. If you discover that a minor has registered an account, contact us and we will delete it.

11. Changes to this policy

We give 30 days' notice of material changes. Minor changes (typos, clarity) are made without notice. The "last updated" date is always visible at the top of the document.

12. Contact

Data Protection Officer: privacy@stravex.io
DYNC Solutions LLC — 990 Biscayne Blvd, Ste 501-16, Miami, FL 33132, USA