This policy explains what personal data BYKK.trades (the controller) collects, why, and what rights you have under the EU General Data Protection Regulation (GDPR) and equivalent laws.
1. Data we collect
- Account data — first and last name, email address, hashed password (bcrypt; we never store the password itself), role, and the version and timestamp of the terms you accepted.
- Technical data — the IP address of your most recent login and of each lesson view, browser user agent, and session timestamps.
- Subscription data — plan tier, billing interval, status and period dates. Card details are never seen or stored by us; they are handled entirely by Stripe.
- Usage data — pages viewed, lessons opened, checkout events, sent to our product analytics providers.
2. Why we process it, and on what legal basis
| Purpose | Legal basis (Art. 6 GDPR) |
|---|---|
| Providing the course and managing your account | Performance of a contract, 6(1)(b) |
| Taking payment and issuing invoices | Contract, 6(1)(b); legal obligation, 6(1)(c) |
| Watermarking lessons and video with your name, email and IP | Legitimate interest in protecting our content, 6(1)(f), with consent captured at registration |
| Security, fraud and account-sharing prevention | Legitimate interest, 6(1)(f) |
| Product analytics | Legitimate interest, 6(1)(f), or consent where required |
| Marketing emails | Consent, 6(1)(a) — opt-in, withdrawable at any time |
3. Watermarking
Lesson pages and the video player display your name, email address and current IP address as a visible watermark. Its sole purpose is to deter and trace unauthorised redistribution of paid content. The watermark is rendered for you alone and is not shared with other students. If material bearing your watermark is found outside the platform, we may process that data to investigate. This is described in section 7 of the Terms of Service, which you accept at registration.
4. Processors and recipients
- Stripe — payments, invoices, billing portal.
- Bunny Stream — video hosting and delivery.
- MongoDB Atlas — database hosting.
- Vercel / AWS — application hosting and logging.
- Amplitude and Mixpanel — product analytics.
- Discord — optional community chat, if you choose to join.
Each processor acts under a data processing agreement. We do not sell personal data.
5. International transfers
Some processors are established outside the EEA. Those transfers rely on the European Commission Standard Contractual Clauses or an adequacy decision, together with supplementary technical measures such as encryption in transit and at rest.
6. Retention
- Account data — for as long as the account exists, then up to 30 days in backups.
- Billing records — retained by Stripe for the period tax law requires, typically 7 to 10 years.
- Login IP addresses — the most recent login is stored on the account; server access logs are kept for up to 90 days.
- Analytics events — up to 24 months.
7. Your rights
Under the GDPR you may:
- request a copy of your data (Art. 15);
- have inaccurate data corrected (Art. 16);
- have your data erased (Art. 17) — the account-deletion endpoint removes your profile and subscription records, although billing records that tax law requires us to keep remain with Stripe;
- restrict or object to processing based on legitimate interest (Art. 18 and 21), including the watermarking described above;
- receive your data in a portable format (Art. 20);
- withdraw consent at any time, without affecting processing already carried out.
Note that objecting to watermarking means we can no longer make protected video content available to you; in that case we will offer to end your subscription.
To exercise any right, write to support@example.com. We respond within one month. You may also lodge a complaint with your national supervisory authority.
8. Cookies
We set one strictly necessary cookie, ta_token, which holds your signed session token. It is HTTP-only, SameSite=Lax and, in production, Secure. Analytics providers may set their own identifiers; where consent is legally required, they load only after you give it.
9. Security
Passwords are hashed with bcrypt. Sessions use signed JSON Web Tokens. Video access requires a short-lived token bound to your account and IP address. Access to production data is limited to staff who need it.
10. Changes
We announce material changes by email and by updating the version shown at the top of this page.