Privacy Notice

  1. Who we are
    Robert Szabo trading as Auctralytix is the controller of personal data described in this Notice, unless expressly stated otherwise. Contact: support@auctralytix.com. Website: https://auctralytix.com. The operator's geographic business address is to be displayed on the website's legal/contact information. Auctralytix states that it is registered with the UK Information Commissioner's Office under registration number ZC141137.


  2. Scope
    This Notice applies to visitors to auctralytix.com, users of the Auctralytix application, invite recipients, account holders, prospective customers, customers and people who contact support. It does not govern third-party websites or services that have their own privacy notices.


  3. Personal data we may process
    Account data: email address, encrypted/hashed password credentials or authentication identifiers, account ID, plan, invite-code status, account creation and status information. Usage and analytical-history data: instruments selected, analysis requests, generated analysis records, saved instruments, schedule settings, feature usage, quota usage and related timestamps. Technical and security data: IP address, device/browser information, authentication events, security logs, anti-abuse records, session identifiers and diagnostic information. Communications data: support requests, feedback, complaints, email correspondence and records of notices sent. Billing data, once payments are enabled: subscription status, billing plan, payment-provider customer and transaction identifiers, invoice information, payment status and limited payment metadata. We do not need to store full payment-card numbers to administer the Service. Marketing and preference data: marketing consent or objection status, communication preferences and campaign interaction where lawful and enabled.


  4. Data we are not designed to collect
    The core Service is not designed to collect brokerage credentials, broker API keys, bank-login credentials, trading capital, portfolio holdings, identity documents or instructions to execute trades. Users must not submit unnecessary sensitive data through free-text support channels.


  5. Purposes and lawful bases
    Contract: to create and administer accounts, authenticate users, provide requested analyses, enforce plan limits, operate scheduled analyses, provide support, process billing and deliver the Service. Legitimate interests: to secure the Service, prevent fraud and abuse, diagnose faults, maintain audit records, improve reliability, defend legal claims, manage business operations and understand non-intrusive product usage, where those interests are not overridden by your rights. Legal obligation: to comply with tax, accounting, consumer, data-protection, law-enforcement and other legal requirements. Consent: where we rely on consent for non-essential cookies, optional marketing or another specific activity. You may withdraw consent without affecting earlier lawful processing.


  6. AI processing

    Auctralytix may submit computed market-analysis inputs and necessary technical context to third-party AI providers to generate natural-language explanations. The intended analytical prompt should not require your identity, brokerage credentials, bank data or portfolio information. Where user account identifiers or other personal data are technically included in provider traffic, we will minimise that data and ensure the appropriate controller-processor or equivalent contractual arrangements are in place.

  7. Market-data providers
    Market-data providers primarily supply market information rather than user personal data. The application is designed to retrieve market data server-side so users do not provide their own data-vendor credentials.

  8. Recipients and processors
    Personal data may be processed by carefully selected service providers for hosting/cloud infrastructure, authentication, database services, transactional email, support, security, analytics, AI processing and payments. A current Processor & Third-Party Services Register should be maintained internally. Named providers currently or prospectively relevant include Anthropic for AI services, Twelve Data for market data, and Stripe when payment functionality is activated. Hosting, database, email and analytics providers must be inserted into the internal register before launch.

  9. International transfers
    Some service providers may process data outside the United Kingdom. Where UK data-protection law requires safeguards, we will use an adequacy regulation, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or another lawful transfer mechanism, together with any required transfer-risk assessment.

  10. Retention
    We retain personal data only for as long as reasonably necessary for the purpose for which it was collected, including legal, security, accounting and dispute-resolution needs. Detailed periods are set out in the internal Data Retention & Deletion Policy. Indicative periods, subject to operational verification: active-account records for the life of the account; account and contractual records for up to 6 years after closure where needed for legal claims; billing and tax records for the legally required period; routine security logs for a shorter risk-based period; support and complaint records for a period proportionate to legal and service needs.

  11. Security
    We use appropriate technical and organisational measures designed to protect personal data, including access controls, authentication, encryption where appropriate, least-privilege access, logging, patching, secret management and backup controls. No system can be guaranteed completely secure.

  12. Your rights
    Depending on the circumstances and lawful basis, you may have rights to be informed, access your personal data, correct inaccurate data, request erasure, restrict processing, object to certain processing and receive portable data. You have an absolute right to object to direct marketing. Where the application provides self-service export, this is an additional mechanism to facilitate access/portability and does not reduce any statutory right. To exercise a right, contact support@auctralytix.com. We may need to verify your identity. We will respond within the statutory timeframe, subject to lawful extensions and exemptions.

  13. Account deletion
    Account deletion may require an operator-assisted process rather than a self-service button. You may request deletion by email. Deletion is subject to data that we must or may lawfully retain, such as records required for tax, fraud prevention, security, dispute resolution or legal claims.

  14. Automated decision-making
    The analytical engine makes deterministic market-structure calculations about market data; it is not intended to make decisions producing legal or similarly significant effects about you. Plan-access controls and quotas determine service entitlements, not employment, credit, insurance or comparable decisions about individuals.

  15. Cookies
    Our use of cookies and similar technologies is described in the Cookie Policy. Strictly necessary authentication/security technologies may be used without consent where permitted by PECR. Non-essential technologies will be deployed only where the applicable consent or other legal conditions are met.

  16. Direct marketing
    We will send electronic direct marketing only where permitted by PECR and data-protection law. Every marketing message will provide a practical method to opt out. Service, security, billing and legally required notices are not marketing.

  17. Complaints
    Please contact us first so we can investigate a privacy concern. You also have the right to complain to the Information Commissioner's Office. The ICO is the UK's independent data-protection regulator. We will not discourage or penalise you for exercising that right.

  18. Changes
    We may update this Notice when processing changes. Material changes will be communicated in an appropriate manner and the effective date will be updated.


  19. Contact

    Robert Szabo trading as Auctralytix.

    Registered Address: 126 Heathfield Drive, London, CR4 3RG

    Legal and support enquiries: support@auctralytix.com

    Document preparation and professional support

    Document preparation support. This document has been prepared with legal and compliance consultancy support from Admiral Strategic Consulting Ltd, a company registered in England and Wales under company number 16088287, registered office: 95 Hounslow Road, Hanworth, Feltham, England, TW13 6QA. Specialist legal matters may be referred to independent qualified solicitors and other professional advisers through the relevant professional network where appropriate. This attribution does not constitute FCA authorisation, regulatory approval or certification by a solicitor.

    Key legal and regulatory references

    The following references inform this draft. They are not an exhaustive statement of law and should be checked again immediately before launch.

    • UK GDPR, including Articles 5, 6, 12-22, 28, 32 and 33-34, as amended and supplemented by applicable UK data-protection legislation.

    • Data Protection Act 2018.

    • Privacy and Electronic Communications (EC Directive) Regulations 2003 (PECR), as amended.

    • ICO guidance on the right to be informed, privacy notices, cookies and similar technologies, direct marketing, processors and individual rights.

    • ICO guidance: What privacy information should we provide?; Right to be informed; Rights of individuals; Right to object; Data sharing and processor contracts.

    • Electronic Commerce (EC Directive) Regulations 2002, regulation 6.

    Version control

    Effective date: 12 August 2026. This document supersedes earlier Auctralytix versions of the same subject.