Who we are and how to contact us
eMidas provides experimental market-research, charting, strategy, backtesting, optimisation and alerting tools. The operator of eMidas (“we”, “us”) is the controller of the personal information described in this policy, which forms part of our Terms of Use.
For privacy questions or to exercise your rights, email emidas.noreply@gmail.com. If you are in the UK you may complain to the Information Commissioner's Office at ico.org.uk; elsewhere, you may contact your local data protection authority. We would appreciate the chance to address your concern first.
Information we collect
- Account data: your name, email address, a one-way hash of your password (never the password itself), verification status, and, if you use Google sign-in, the name and email Google shares with us.
- Consent and acceptance records: the versions of the Terms of Use and Privacy Policy you accepted, when you accepted them, and your optional marketing choice.
- Security records: one-time codes, verification links, and records of failed sign-in and code attempts used to block brute-force attacks.
- Research content: watchlists, chart layouts, strategies, alerts, backtest settings and results, and optimisation experiments, including any research notes you enter.
- Technical data: request timings, routes and error summaries used to keep the Service reliable. Your IP address is processed by our hosting provider. To apply rate limits we store only a keyed, one-way hash of it, which cannot be turned back into the address, and delete it within about a day.
- Communications: messages you send us, and delivery status for emails we send you.
We do not ask for, and you must not enter, payment card details, government identifiers, brokerage or exchange credentials or API keys, or special-category data such as health information.
How we use information and our legal bases
- To provide the Service (performance of our contract with you): creating and securing your account, saving your work, fetching market data, running backtests and optimisations, and sending alerts and service emails.
- To keep the Service safe and working (our legitimate interests): preventing fraud and abuse, rate limiting, detecting and fixing errors, and improving the beta.
- To comply with the law (legal obligation) and to establish, exercise or defend legal claims, including keeping records of your acceptance of our Terms.
- To send product updates (your consent), only if you opted in. You can withdraw consent at any time without affecting service messages or earlier processing.
We do not sell your personal information, do not share it for cross-context behavioural advertising, and do not make decisions that produce legal or similarly significant effects about you solely by automated means.
Service providers and AI
We share personal information only with providers that help us run the Service, and only to the extent they need it:
- Hosting and database (such as Vercel and Neon), which store and process all Service data on our behalf;
- Email delivery (Resend), which receives your email address and the content of emails we send you;
- Google, if you choose to sign in with Google;
- Market-data providers (Yahoo Finance, Twelve Data and Binance), which receive instrument symbols and date ranges but not your identity; and
- OpenAI, only if you choose GPT-assisted optimisation. It receives the relevant strategy rules, parameters, backtest metrics and any research brief you write, but not your name, email address or password. Do not include personal information in research briefs.
We may also disclose information to professional advisers, to authorities where required by law or to protect rights and safety, or to a successor if the Service is transferred.
International transfers
Our providers may process data outside the UK and the European Economic Area, including in the United States. Where the law requires, we rely on adequacy regulations, the UK International Data Transfer Agreement or Addendum, Standard Contractual Clauses, or another lawful transfer mechanism.
How long we keep information
- Account data and research content: while your account is active. When you delete your account, it is deleted from our live database immediately and from provider backups as those backups expire.
- One-time codes and verification links: until they expire or are used, typically between 10 minutes and 24 hours.
- Request and error metrics: about 30 days.
- Hashed rate-limit records: about one day. Failed sign-in records: until your next successful sign-in or password reset.
- Records of your acceptance of our Terms and policies: for as long as we need them to show compliance or defend legal claims.
Security
We use encrypted connections, hashed passwords, signed session tokens, per-account access controls, rate limits, and lockouts after repeated failed attempts. No online service is completely secure, and the Service is an untested beta, so we cannot guarantee the security of your information. Use a unique password and sign out on shared devices. If we become aware of a breach that affects you, we will notify you and the authorities where the law requires.
Beta data notice
Because eMidas is an experimental proof of concept, data may be lost, corrupted, reset or deleted, and the Service may be shut down. Keep your own copies of anything important, and do not use the Service to store confidential, sensitive or commercially valuable information.
Your rights
Depending on where you live, you may have the right to access, correct, delete, restrict or object to our processing of your personal information, to receive a portable copy of it, and to withdraw consent. You can update your profile and delete your account yourself in Settings, or email us. We may need to verify your identity, and we will respond within the time the law requires (normally one month). We will not discriminate against you for exercising your rights.
Cookies and browser storage
eMidas uses only strictly necessary browser storage: a sign-in token and your display preferences in local storage, and short-lived security cookies during Google sign-in. We do not use advertising or third-party analytics cookies. If that changes, we will ask for any consent the law requires first.
Children
The Service is only for adults aged 18 or over. We do not knowingly collect information from children. If you believe a child has given us personal information, contact us and we will delete it.
Changes to this policy
We may update this policy as the Service or the law changes. We will post the new version here with a new version date and, for material changes, ask you to review and accept it before you continue using the Service.