Privacy Policy
Last updated: 2026-08-03
1. Controller
The data controller responsible for your personal data is:
Theocharis Kartsolis (registered as ΚΑΡΤΣΩΛΗΣ ΘΕΟΧΑΡΗΣ ΔΗΜΗΤΡΙΟΣ), sole proprietor, trading as EcoQ Trapezountos 17, Edessa 58200, Greece VAT identification number: EL105955066 Contact: legal@krinofin.com
We have not appointed a Data Protection Officer. A DPO is not required for processing of this nature and scale. Contact the address above for any data protection matter.
2. Scope
This notice explains how we process personal data when you visit krinofin.com, create an account, or subscribe. It applies to data for which we determine the purposes and means of processing.
It does not cover payment card data. We never receive, see, or store payment card details — see section 5.
3. What we collect, why, and on what basis
| Data | Purpose | Legal basis (Art. 6 GDPR) | Retention |
|---|---|---|---|
| Email address | Account creation, authentication, service notices | Contract (6(1)(b)) | Duration of account + 30 days |
| Account identifier, timestamps | Authentication, security | Contract (6(1)(b)) | Duration of account + 30 days |
| Authentication provider identifier (if you sign in with Google or GitHub) | Authentication | Contract (6(1)(b)) | Duration of account + 30 days |
| Subscription level, status, billing period | Access control, service provision | Contract (6(1)(b)) | Duration + 7 years (tax law) |
| Business name, VAT number, country (business customers only) | Invoicing, VAT treatment | Legal obligation (6(1)(c)) | 7 years (tax law) |
| IP address, request metadata | Security, abuse prevention, rate limiting | Legitimate interests (6(1)(f)) | Up to 30 days |
| Marketing preference and its timestamp | Proof of consent | Consent (6(1)(a)) | Until withdrawn + 3 years |
| Correspondence you send us | Responding to you | Legitimate interests (6(1)(f)) | 3 years |
Legitimate interests assessment. Where we rely on legitimate interests, the interest is operating a secure, functioning service and preventing abuse. We consider this proportionate because the data involved is minimal, retention is short, and no profiling or automated decision-making affecting you takes place.
We do not collect financial account information, investment holdings, trading activity, or any special category data under Article 9.
4. Marketing communications
If you have given consent, we may send you emails about the Service, new features, and offers.
Consent is separate and optional. Providing your email address to create an account does not constitute consent to marketing. You will only receive marketing email if you have separately and affirmatively opted in.
You may withdraw consent at any time — via the unsubscribe link in any marketing email, or by writing to legal@krinofin.com. Withdrawal does not affect the lawfulness of processing before withdrawal, and does not affect service emails necessary to operate your account (billing notices, security alerts, changes to these terms).
5. Who else processes your data
Processors acting on our instructions:
| Processor | Role | Location of processing |
|---|---|---|
| Supabase | Authentication, account and subscription database | European Union (Frankfurt) |
| Cloudflare | Website and API delivery, security, rate limiting | Global edge network |
We have data processing agreements in place with each.
Independent controller:
Paddle.com Market Limited acts as merchant of record for all payments and is an independent data controller for payment data. Payment card details are submitted directly to Paddle and never reach our systems. Paddle's own privacy notice governs that processing. We receive from Paddle only the subscription status data listed in section 3.
International transfers. Cloudflare is a US-headquartered company and processing may occur outside the European Economic Area. Such transfers are made under Standard Contractual Clauses and applicable supplementary measures. Our primary database is hosted within the EU.
Note on our published data. The stock data the Service distributes through Cloudflare's global network contains no personal data whatsoever — it consists solely of financial information about publicly listed companies.
6. Cookies and similar technologies
We use only what is strictly necessary to operate the Service:
- Authentication tokens — required to keep you signed in. Without these the Service cannot function.
Strictly necessary technologies do not require consent under the ePrivacy Directive and Greek implementing law.
We do not currently use analytics, advertising, or tracking cookies. If that changes, we will request your consent before setting any non-essential technology, and update this notice.
7. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you;
- rectification of inaccurate data;
- erasure ("right to be forgotten"), subject to retention we are legally required to observe — notably tax records;
- restriction of processing in certain circumstances;
- data portability — to receive your data in a structured, machine-readable format;
- object to processing based on legitimate interests;
- withdraw consent at any time where processing is based on consent.
To exercise any right, contact legal@krinofin.com. We will respond within one month. We may ask you to verify your identity before acting.
Deleting your account. On request we delete your account record and the associated subscription record. Invoicing records are retained for the period required by Greek tax law and are then deleted.
Complaints. You have the right to lodge a complaint with a supervisory authority. In Greece this is the Hellenic Data Protection Authority (Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα), Kifissias 1-3, 115 23 Athens, www.dpa.gr. You may also complain to the authority in your country of residence.
8. Automated decision-making
We do not carry out automated decision-making producing legal or similarly significant effects concerning you.
The scoring the Service performs is applied to companies, not to users. It does not evaluate, profile, or make decisions about you.
9. Security
We apply measures appropriate to the risk, including encryption in transit, access controls restricting subscription data to authorised systems only, and segregation of payment data (which we never hold).
No system is perfectly secure. If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the Hellenic Data Protection Authority within 72 hours, and you directly where the risk is high.
10. Children
The Service is not directed at persons under 18 and we do not knowingly collect their data. If you believe a minor has provided us data, contact legal@krinofin.com and we will delete it.
11. Changes
We may update this notice. Material changes will be notified by email or prominently on the Service before taking effect. The "last updated" date above always reflects the current version.
12. Contact
Theocharis Kartsolis (registered as ΚΑΡΤΣΩΛΗΣ ΘΕΟΧΑΡΗΣ ΔΗΜΗΤΡΙΟΣ), sole proprietor, trading as EcoQ Trapezountos 17, Edessa 58200, Greece legal@krinofin.com