Privacy Policy
Effective: July 26, 2026 · Last updated: July 26, 2026
1. Introduction
MP Signal ("we," "our," or "us"), operated by Ben Kyeremeh (see Impressum), is committed to protecting your privacy. This policy explains how we collect, use, disclose, and safeguard your personal data when you visit mpsignalxau.com ("the Website") or use our services, in compliance with the EU General Data Protection Regulation (GDPR) and the German Federal Data Protection Act (BDSG).
2. Data Controller
Ben Kyeremeh
Winterstr 44, 28215 Bremen, Germany
Email: support@mpsignalxau.com
3. What Data We Collect
3.1 Data You Provide
- Account Data: When you register, we collect your email address and a hashed password (stored by Supabase Auth). We never see your plain-text password.
- Payment Data: When you purchase a subscription, payment is processed by third-party providers. We do not collect or store full payment card numbers, bank details, or cryptocurrency wallet private keys.
- Communication Data: If you email support@mpsignalxau.com, we collect your email address and message content.
3.2 Data Collected Automatically
- Analytics Data: We use Vercel Web Analytics and Vercel Speed Insights. These collect anonymized page view data (page URL, referrer, device type, country-level location, browser). Vercel does not use cookies for these analytics services — data is collected via script-based signals.
- Authentication Cookies: Supabase Auth stores a session token in your browser's localStorage and a refresh token in a secure cookie. These are strictly necessary for the login/dashboard functionality and are not used for tracking.
- Server Logs: Our hosting provider (Vercel) may process access logs including IP address, timestamp, requested URL, and user agent. These are retained for a limited period for security and debugging purposes.
4. Cookies and Similar Technologies
Our Website uses the following types of cookies and storage:
| Name | Type | Purpose | Duration |
| sb-*-auth-token | Essential | Supabase session token (localStorage) | Session / 1 hour |
| sb-*-refresh-token | Essential | Supabase refresh token (secure cookie) | Until logout |
| cookie-consent | Essential | Stores your cookie preferences (localStorage) | 6 months |
| Vercel Analytics | Analytics | Anonymized page view metrics (no cookies) | N/A (signal-based) |
We do not use advertising cookies, third-party tracking cookies, or social media pixels. You can manage your preferences via the cookie consent banner displayed on your first visit. You may withdraw or modify your consent at any time by clicking "Cookie Settings" in the footer.
5. How We Use Your Data
We process your personal data for the following purposes and legal bases under GDPR:
- Service Provision (Art. 6(1)(b) GDPR): To create and manage your account, deliver trading signals and dashboard access, and process your subscription.
- Communication (Art. 6(1)(b) GDPR): To send you service-related emails including welcome messages, trial status updates, login security alerts, and subscription confirmations.
- Analytics (Art. 6(1)(f) GDPR — Legitimate Interest): To understand how visitors use our Website, improve our service, and monitor performance. Vercel Analytics data is anonymized and aggregated.
- Legal Obligations (Art. 6(1)(c) GDPR): To comply with applicable laws, tax regulations, and respond to lawful requests from authorities.
- Marketing (Art. 6(1)(a) GDPR — Consent Only): We will NEVER send you marketing emails without your explicit opt-in consent. You can unsubscribe at any time.
6. Third-Party Services & Data Processors
We use the following processors who may receive limited personal data:
- Supabase (Singapore / US): Database hosting, authentication services, and API. Processes email addresses, hashed passwords, session tokens, and subscription data. Supabase Privacy Policy.
- Vercel Inc. (US): Website hosting and analytics. Processes anonymized page view data. Vercel Privacy Policy.
- Resend (US): Transactional email delivery. Processes email addresses and message content for service emails only. Resend Privacy Policy.
For transfers to US-based processors (Vercel, Resend), we rely on Standard Contractual Clauses (SCCs) and supplemental measures as the lawful transfer mechanism under Art. 46 GDPR.
7. Data Retention
- Account data: Retained for the lifetime of your account. Deleted within 30 days of account deletion request.
- Analytics data: Vercel retains anonymized analytics for up to 12 months.
- Email communications: Retained for up to 12 months for reference, unless legal requirements require longer retention.
- Server logs: Retained for up to 30 days.
8. Data Security
We implement appropriate technical and organizational measures (TOMs) including: TLS encryption for all data in transit, Supabase Row-Level Security (RLS) on all database tables, password hashing via bcrypt (Supabase Auth), and regular security monitoring. While we strive to protect your data, no method of transmission over the internet is 100% secure. We cannot guarantee absolute security.
9. Your GDPR Rights
As a data subject in the EU/EEA, you have the following rights:
- Right of Access (Art. 15 GDPR): Request confirmation of whether we process your personal data and a copy of that data.
- Right to Rectification (Art. 16 GDPR): Request correction of inaccurate or incomplete personal data.
- Right to Erasure (Art. 17 GDPR): Request deletion of your personal data ("right to be forgotten"), subject to legal retention obligations.
- Right to Restriction (Art. 18 GDPR): Request restriction of processing under certain conditions.
- Right to Data Portability (Art. 20 GDPR): Receive your data in a structured, machine-readable format, or request direct transfer to another controller.
- Right to Object (Art. 21 GDPR): Object to processing based on legitimate interests, including profiling.
- Right to Withdraw Consent (Art. 7(3) GDPR): Withdraw previously given consent at any time, without affecting the lawfulness of processing before withdrawal.
- Right to Complain (Art. 77 GDPR): Lodge a complaint with a supervisory authority — in Bremen: Die Landesbeauftragte für Datenschutz und Informationsfreiheit der Freien Hansestadt Bremen.
To exercise any of these rights, email support@mpsignalxau.com. We will respond within 30 days as required by GDPR.
10. Children's Privacy
Our Service is not directed to individuals under 18. We do not knowingly collect personal data from minors. If you believe a minor has provided us with personal data, contact us immediately.
11. Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be communicated via email to registered users and via a notice on the Website. The latest version is always available at mpsignalxau.com/privacy.html.
12. Contact & Supervisory Authority
For privacy inquiries: support@mpsignalxau.com
Supervisory Authority:
Die Landesbeauftragte für Datenschutz und Informationsfreiheit Bremen
Arndtstraße 1, 27570 Bremerhaven
Website: datenschutz.bremen.de