Privacy Policy

Introduction

This Privacy Policy explains how Mastos Odyssey Limited (trading as "CandleScan", "we", "our", or "us") collects, uses, and safeguards your information when you use our mobile application. Under the UK GDPR, Mastos Odyssey Limited acts as the "Data Controller" of your personal data.

Information We Collect

Account Information

• Email address (for account creation and authentication). If you sign in with Apple, we receive the email address Apple provides, which may be a private relay address.
• Username (for your profile)
• Display name (optional)
• Phone number (optional, only if you choose to add and verify one)
• Password (hashed and securely stored — applies to email accounts only; Sign in with Apple accounts have no password with us)

Profile & Onboarding Information

• Answers you give during onboarding: trading experience level, trading goals, trading pain points, and the markets/assets you select
• Risk preferences you set in the app (account balance, risk percentage)

Chart Analysis & AI Chat Data

• Chart images you upload for AI analysis
• Analysis results generated by our AI system
• Questions and messages you send to the AI assistant, along with the analysis context needed to answer them
• Analysis history and timestamps

Trading Journal Data

• Trade entries (entry/exit prices, quantities, notes)
• Journal entries and performance tracking data

Usage Data

• Daily counts of the analyses and AI chat messages you use (to operate fair-usage limits)
• Crash and error reports may be collected to improve app stability

Subscription Information

• Subscription status and purchase history (managed by RevenueCat)
• Payment information is handled entirely by Apple and is never stored by us

How We Use Your Information

We use your information to:

• Provide and maintain the CandleScan service
• Process your chart analyses and AI chat conversations using AI
• Store your trading journal and analysis history
• Manage your subscription and account
• Send important updates about your account or subscription
• Improve app performance and fix bugs
• Provide customer support

Our Lawful Basis for Processing

Under the UK GDPR, we only process your personal data where we have a valid Lawful Basis to do so. These are:

• Performance of a Contract: To create your account, provide the core app functionality, and manage your subscription.
• Legitimate Interests: To analyze app usage statistics, fix bugs, improve our AI integrations, and keep our services secure.
• Consent: If you explicitly opt-in to receive marketing or promotional emails from us (which you can withdraw at any time).
• Legal Obligation: To maintain accurate financial records for tax and accounting purposes.

Data Storage and Security

• Authentication: We use Supabase for secure authentication and user management
• Database: All user data is stored in encrypted databases with industry-standard security
• Chart Images: Processed securely and only retained for your analysis history
• Encryption: All data transmission uses HTTPS/TLS encryption

Third-Party Services

We use the following trusted third-party services:

• Supabase: Database and authentication infrastructure
• RevenueCat: Subscription management and payment processing
• Apple App Store: Payment processing (we never see your payment details)
• OpenAI: For chart analysis and the AI chat assistant. We transmit your chart images and chat messages strictly via secure APIs. Your data is not used to train their models, though it may be temporarily retained by them for up to 30 days for standard security and abuse-monitoring purposes.

International Data Transfers

To provide the Service, we use third-party infrastructure and AI providers (such as Supabase and OpenAI) that may store or process your data on servers outside of the United Kingdom and the European Economic Area (EEA), primarily in the United States. Whenever we transfer your personal data internationally, we ensure it is protected by requiring our partners to use UK government-approved safeguards, such as the International Data Transfer Addendum or Standard Contractual Clauses (SCCs).

Data Retention

• Account Data: Retained while your account is active
• Analysis History: Retained until you delete them or close your account
• Journal Entries: Retained until you delete them or close your account
• Deleted Data: Permanently removed from our systems within 30 days

Your Rights

You have the right to:

• Access your personal data
• Update your profile information at any time
• Delete your account and all associated data
• Export your data (contact us for assistance)
• Opt-out of non-essential communications

Data Deletion

To delete your account and all data:

• Go to Settings → Account → Delete Account inside the app
• Or contact us at info@candlescan.tech

Upon deletion, all your data will be permanently removed within 30 days.

Children's Privacy

CandleScan is not intended for users under 18. We do not knowingly collect data from children. If you believe a child has provided us with personal information, please contact us.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by:

• Updating the "Last Updated" date
• Displaying a notice in the app
• Sending an email (for material changes)

California Privacy Rights (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA):

• Right to know what personal information is collected
• Right to delete personal information
• Right to opt-out of the sale of personal information (we do not sell your data)

UK & European Privacy Rights (GDPR)

If you are in the United Kingdom or the European Union, you have rights under the UK/EU GDPR:

• Right to access your data
• Right to rectification
• Right to erasure ("right to be forgotten")
• Right to data portability
• Right to object to processing

You also have the right to lodge a complaint with the UK Information Commissioner's Office (ICO) at www.ico.org.uk, though we kindly ask that you contact us first so we can try to resolve any issues.

Data We Do NOT Collect

• We do NOT collect precise location data
• We do NOT access your contacts
• We do NOT track you across other apps or websites
• We do NOT sell your personal information to third parties
• We do NOT use your data to train AI models

Contact Us

If you have questions about this Privacy Policy or your data, contact us:

• Email: info@candlescan.tech
• In-App: Settings → Support
• Post: Data Protection Contact, Mastos Odyssey Limited, 27 Old Gloucester Street, London, WC1N 3AX, United Kingdom

By using CandleScan, you agree to this Privacy Policy.