Privacy notice
Your data, in plain words.
What personal data Vengyr holds, why, and what you can do about it. It covers this website and the Vengyr app.
The short version
We hold only what is needed to run your account.
Your trading key never reaches us.
We sell nothing about you. No trackers, no ads.
Optional uses stay off until you turn them on.
Download or delete everything from Settings.
Who is responsible
The controller is António João Lopes Silvestre, founder of Vengyr, Luxembourg. Once the Vengyr company is formed, it takes over this role and we will update this notice. Contact: hello@vengyr.eu.
We have not appointed a data protection officer, because we do not monitor people at scale.
This website
This site sets no cookies, runs no analytics and loads nothing from other companies: fonts and images come from our own server. Our host keeps standard server logs (address, time, page requested) for security, for up to 30 days.
If you write to us for an invite, we keep your email and message only to reply and to send your invite, and delete them when the beta opens or when you ask.
What we hold in the app, and why
Your account
BasisContractSign-in id, email, base currency, chosen markets, your own limits and notes
- Why
- Run your account
- Kept
- Until you delete your account
Read-only keys
BasisContractExchange and broker keys that can’t trade or withdraw, sealed so no person can read them
- Why
- Read your balances and trades
- Kept
- Until you remove the key or delete your account
Your trading record
BasisContractTrades read from your accounts, costs you type, price alerts, practice bots
- Why
- Show your holdings and gains, run practice tests, prepare tax exports for your own filing
- Kept
- Until you delete them or your account
Activity log
BasisContractLegitimate interestWhat you did, in plain words
- Why
- Show you your own history; security; proof of what you accepted
- Kept
- Account life; after deletion only a bare event with no user id, for 5 years
Consent records
BasisLegal obligationLegitimate interestWhich text you saw, its version and your answers. No IP or device data
- Why
- Prove what you were told and accepted
- Kept
- The life of your account, then 5 years
Proof stamps
BasisLegitimate interestHashes only, never your data
- Why
- Prove when a setting or consent was recorded
- Kept
- 5 years
Beta invites
BasisLegitimate interestEmail, who invited you, when you joined
- Why
- Limit sign-up to invited testers
- Kept
- Until the beta opens
Feedback
BasisLegitimate interestWhat you send us from the app
- Why
- Fix what testers report
- Kept
- Until you delete your account
Balances and trades are not a special category under the GDPR, but they reveal wealth and behaviour, so we treat them as high risk: keys are sealed, each account is kept apart from every other, and no outside analytics run in the app.
What we never receive
Your trading key. It goes from your device straight into your own cloud account.
Your cloud project’s contents, except the health and trade receipts your bot sends back so the app can show them to you.
Card or bank details for trading. No money for trading passes through us.
Google sign-in and your bot
When you choose “Deploy my bot”, Vengyr asks you to sign in with Google and grant it permission on your own Google Cloud account. We use that permission for one purpose only: to create one project for your bot in your Google Cloud account and install the Vengyr runner there.
What we use
The permission you grant, only while setup runs. We don’t read your Gmail, Drive, contacts or any other Google data.
What we store
No Google data. The access token stays in your browser during setup and is never saved on our servers. We keep only the name of the project that was created, so the app can show your bot’s health.
When it ends
When setup finishes, Vengyr gives the access back by revoking the token. You can check this in your Google Account under “Third-party apps and services”, and remove it there yourself.
Sharing
We don’t share, sell or transfer any data received from Google, use it for ads, or use it to train AI models.
Vengyr’s use and transfer of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
Your bot runs in your own cloud account under your own contract with Google, and Google processes its data as your provider. Vengyr is not the controller of that data.
AI agents
The app’s agents are AI systems, and everything they write is marked as AI-generated. When you ask an agent something, we send your question and the figures needed to answer it to our AI provider, Anthropic (Claude), under terms that forbid it from training its models on your data. Anthropic processes it in the United States and keeps it for at most 30 days, unless its abuse checks flag a request or the law requires longer.
Who else receives data
Google Cloud
WhereEU (Belgium)Hosting, database, key sealing
- Receives
- The data above
Zitadel
WhereEUSign-in
- Receives
- Sign-in id, email, two-factor
Anthropic
WhereUnited StatesAI provider: answers to questions you ask agents
- Receives
- Your question and the figures needed
OpenTimestamps
WherePublic calendarsPublic time-stamping
- Receives
- One hash, never your data
Exchanges, brokers and data providers receive nothing from us: your own keys call them, under your own agreement with them.
Transfers outside the EU
One: questions you ask an agent go to Anthropic in the United States. The safeguard is the EU Standard Contractual Clauses in Anthropic’s data processing terms. Everything else stays in the EU. If we add another transfer, we will list it here with its safeguard before it starts.
Optional uses
Product usage statistics, if we add them, will be off by default, under their own switch in Settings. Turning a switch off is as easy as turning it on, and withdrawing consent does not affect anything else in your account.
No automated decisions about you
Vengyr makes no automated decision with legal or similar effect about you. The app runs your own rules, with the limits you set.
Your rights
You can access, download, correct and delete your data, object to or restrict some uses, and withdraw consent at any time.
Download all my dataSettings, one file with everything we hold about you.
Delete my accountSettings. Removes every row that carries your user id in one step; only the bare activity events and proof hashes described above remain.
You can also write to hello@vengyr.eu. We answer within one month.
Complaints
You can complain to the Luxembourg data protection authority, the CNPD (cnpd.public.lu), or to the authority in your own country.
Changes
Each version of this notice carries a number and a date. If a change matters, we tell you in the app before it applies, and where it involves consent, we ask again.