Privacy Policy

1. Who is responsible for your data

WorldLab Trading, Florinas Papakosta 3, 2326 Lakatamia, Cyprus is the controller of the personal data described in this policy, for the purposes of Regulation (EU) 2016/679 (the GDPR) and the Cypriot law implementing it.

Contact us about anything in this policy at support@blueflow.trade. We aim to answer within a few days, and we will answer any formal request within one month, as the GDPR requires.

We have not appointed a Data Protection Officer, because our processing does not require one. Privacy questions go to the address above and reach a person who can act on them.

2. The short version

We collect what BlueFlow needs to work and almost nothing else.

• We do not sell your personal data, and we never have.
• We do not share it for advertising, and we run no advertising.
• We do not track you across other apps or websites. The app contains no advertising SDK and no cross-app tracking.
• Your charts are sent to our model provider to be read, and to nobody else.
• Your charts are not used to train any AI model, by us or by our provider.
• You can delete your account, your history and your charts permanently from inside the app, in two taps.

3. What we collect

Account data — your email address, and the authentication identifier from Apple or Google if you sign in that way. We never see or store your password; authentication is handled by our provider.

Profile data — the name you give us, your date of birth, and the trading preferences you set: the markets you trade, your horizon, how you read a chart, your risk framing, your goals, and how you want to use BlueFlow.

Charts and analyses — the chart images you upload, and the analyses produced from them, including the model’s factor readings and the strength score derived from them.

Watched setups — the instruments and timeframes you have chosen to follow, and a snapshot of what BlueFlow said about each one at the moment you saved it.

Usage and technical data — how many analyses you have run in the current month, which is what enforces the free allowance, plus error records, timestamps, and the technical logs needed to keep the service running and to investigate abuse.

Subscription data — whether you hold a subscription, which plan, when it started, and whether it is in a trial. Your card details are handled by Apple or Google and never reach us.

Legal acceptance data — the version of the Terms and this policy you accepted, and when.

We do not collect your broker credentials, your positions, your balances, your trades, or your financial circumstances. BlueFlow has no connection to any brokerage, and we ask you not to give us any of that.

We do not intentionally collect special categories of personal data under Article 9 of the GDPR, and BlueFlow does not ask for any.

4. Why we collect it, and our legal basis

To provide the service — creating your account, producing analyses, storing your history so it follows you between devices, and applying your preferences to how an analysis is written. Basis: performance of a contract with you (Article 6(1)(b)).

To check you are old enough. Your date of birth answers one question — whether you are 18 — and it is never sent with a chart and never used for anything else. Basis: our legitimate interest in not providing a trading tool to a minor, and compliance with a legal obligation (Articles 6(1)(f) and 6(1)(c)).

To enforce the free monthly allowance and to bill correctly. Basis: performance of a contract (Article 6(1)(b)).

To keep the service secure and working — rate limiting, abuse prevention, fault diagnosis. Basis: our legitimate interest in a service that stays up and is not abused (Article 6(1)(f)).

To record which version of our terms you accepted. Basis: our legitimate interest in being able to show what was agreed, and compliance with a legal obligation (Articles 6(1)(f) and 6(1)(c)).

To comply with law, and to establish, exercise, or defend legal claims. Basis: legal obligation and legitimate interest (Articles 6(1)(c) and 6(1)(f)).

Where we rely on a legitimate interest, we have considered whether it is outweighed by your interests and rights, and we have kept the processing to the minimum that achieves the purpose. You can object to any of it — see section 12 — and you can ask us for our assessment.

5. What is sent with an analysis

Only a subset of your profile travels with a chart: your markets, your horizon, how you read charts, your risk framing, your goals, and your preferred explanation depth. It carries no name, no email address, no date of birth, and no account identifier.

The review screen, shown before an analysis is sent, names the horizon and the reading styles that will travel with the chart. The rest of the list above is set by you on the Trading profile screen and is visible there at any time. Nothing outside that list is sent.

6. Chart images and AI processing

To produce an analysis, the chart image you upload is transmitted to our model provider, Anthropic, which processes it and returns the reading. This is the core function of BlueFlow and cannot be switched off while still using it.

Anthropic acts as our processor for this purpose and is bound by a data processing agreement with us. Under Anthropic’s commercial API terms, inputs and outputs submitted through the API are not used to train its models. Their handling of the data is also governed by their own privacy policy, which we encourage you to read.

We send the image, the analysis mode, any setup you asked about, and the anonymous preference summary described in section 5. We do not send your name, your email address, or your date of birth.

Do not upload a chart containing information you would not want processed this way — for example a screenshot that also shows your account balance, your open positions, your order history, or your broker login. If you do so by accident, delete the analysis in the app and the image goes with it.

7. Automated processing, and decisions about you

BlueFlow’s output is generated automatically by an AI model. That is the product, and section 8 of our Terms of Service explains what it means for how much you should trust it.

We do not use automated processing to make any decision that produces a legal effect concerning you or similarly significantly affects you, within the meaning of Article 22 of the GDPR. BlueFlow does not score you, rank you, assess your creditworthiness, decide anything about your access to any service, or profile you for any purpose. It reads a picture you sent and describes it.

The preferences you set change the emphasis and wording of an analysis. They are not a profile of you that we act on, and they are not shared with anyone.

8. Who else processes your data

We use a small number of processors, each bound by a data processing agreement, and each used for one purpose.

• Supabase — database, authentication, and file storage. Your account, profile, analyses, and chart images are stored there. Access is enforced at the database level, so only your own account can read your rows.
• Anthropic — chart analysis, as described in section 6.
• Fly.io — hosting for the BlueFlow API, which processes analysis requests in transit.
• RevenueCat — subscription infrastructure. It receives your account identifier and the store’s purchase and renewal events, so that access can be attached to the right account. It does not receive your charts or your analyses.
• Apple and Google — sign-in, if you use it, and payment processing and subscription management if you subscribe. They are independent controllers for the payment itself.
• We may also disclose data where we are legally required to, where it is necessary to establish, exercise, or defend legal claims, or where it is necessary to protect the rights and safety of others. If our business is transferred, your data may transfer with it, and we will tell you before that happens.
• We do not disclose your data to anyone else, and we do not sell it.

9. Where your data is held, and transfers outside the EEA

Your data may be processed in countries outside the European Economic Area, including the United States.

Where that happens, we rely on an appropriate safeguard under Chapter V of the GDPR — the European Commission’s standard contractual clauses, the UK International Data Transfer Addendum where UK data is involved, or an adequacy decision such as the EU-US Data Privacy Framework where the recipient is certified under it. You can ask us for a copy of the safeguard that applies to a particular transfer.

10. How long we keep it

Account, profile, analyses, charts, and watched setups — until you delete them or delete your account. You can delete an individual analysis or watch at any time, and an analysis takes its chart with it.

Deleting your account removes your profile, every analysis, every chart, and every watch, permanently and immediately. Routine backups are overwritten on their ordinary cycle, normally within 30 days.

Technical and security logs — kept for a short period, normally no more than 12 months, and then deleted. They are the one thing that outlives your account, and they hold no chart and no analysis.

The record of which version of these documents you accepted, and when — held against your account, and deleted with it.

Records of a purchase — held by Apple or Google as the seller of the subscription, under their own retention rules, which we do not control. Our own record of your subscription is deleted with your account.

11. Security

Data is encrypted in transit. Your session credentials are stored in your device’s secure keychain rather than in ordinary app storage. Access to your rows is enforced by database policy rather than by application code, so an application bug cannot expose another user’s data. Chart images live in a private bucket and are retrieved through short-lived signed links. Access to production systems is limited to people who need it.

No system is perfectly secure, and we do not claim absolute security. If a breach affects your personal data, we will notify the supervisory authority within 72 hours where the GDPR requires it, and we will tell you directly where the breach is likely to result in a high risk to your rights.

12. Your rights

If the GDPR applies to you, you have the following rights.

• Access — to know what personal data we hold about you and to get a copy.
• Rectification — to have inaccurate data corrected.
• Erasure — to have your data deleted.
• Restriction — to have us stop processing while a dispute about it is resolved.
• Objection — to object to processing based on our legitimate interests, at any time and on grounds relating to your situation.
• Portability — to receive the data you gave us in a structured, commonly used, machine-readable format, and to have it sent to another controller where technically feasible.
• Withdrawal of consent — where we relied on consent, at any time, without affecting what we did before you withdrew it.
• To complain — to a supervisory authority, as described in section 15.

13. How to exercise your rights

Most of them you can exercise yourself, immediately, without asking us: your profile is editable on the Trading profile screen, your history is deletable row by row, and Delete account on the Account screen removes everything at once.

For anything else, email support@blueflow.trade from the address on your account and say which right you are exercising. We will respond within one month, and will tell you if we need longer, which the GDPR permits by up to two further months for a complex request.

Exercising a right is free. We may charge a reasonable fee, or refuse, only where a request is manifestly unfounded or excessive — and if we do, we will explain why and tell you how to challenge it.

14. If you are in the United Kingdom or the United States

United Kingdom — the UK GDPR gives you the same rights as section 12, and you may complain to the Information Commissioner’s Office.

California — we do not sell your personal information and we do not share it for cross-context behavioural advertising, as those terms are defined by the California Consumer Privacy Act. You have the right to know, to delete, to correct, and to limit the use of sensitive personal information, and we will not discriminate against you for exercising any of them. We do not use or disclose sensitive personal information for any purpose that would give rise to the right to limit it.

Other US states — if you live in a state with a comprehensive privacy law, you have equivalent rights to know, correct, delete, and obtain a copy of your data, and to opt out of targeted advertising, sale, and profiling with legal or similarly significant effects. We do none of those three things. Where a state gives you the right to appeal a refused request, email us and say you are appealing, and we will respond in writing with our reasons.

We honour Global Privacy Control and equivalent opt-out signals where they reach us, though we have nothing to opt you out of.

15. Complaints

If you think we have handled your data wrongly, tell us first at support@blueflow.trade — it is usually the fastest way to fix it.

You also have the right to complain to a data protection supervisory authority: the Office of the Commissioner for Personal Data Protection of the Republic of Cyprus, which is our lead authority, or the authority in the EU or EEA country where you live, work, or where the issue arose. You do not need to come to us first.

16. Children

BlueFlow is for adults. It is not directed at anyone under 18, and we do not knowingly collect personal data from anyone under 18. If you believe a minor has given us data, contact us and we will delete it.

17. Marketing

We send you the emails the service requires — confirming your address, resetting a password, telling you about a change to these documents or to your subscription. Those are not marketing and you cannot unsubscribe from them while you have an account.

We will not send you marketing email unless you have asked for it, and if we ever do, every message will carry a working unsubscribe link.

18. Changes to this policy

We will update this policy when what we do with data changes. The effective date at the top always reflects the current version, and the version you accepted is recorded against your account. Where a change is material, we will notify you in the app or by email before it takes effect.

19. Contact

Email: support@blueflow.trade

WorldLab Trading, Florinas Papakosta 3, 2326 Lakatamia, Cyprus.