Privacy Policy

Effective date: 29 June 2026 · Data controller: Fourdesk · Contact: legal@fourdesk.io

This Privacy Policy explains how Fourdesk ("we", "us") collects, uses, stores, and protects your personal data when you use our Service. As we operate from the Canary Islands, Spain, we are subject to the EU General Data Protection Regulation (GDPR) and Spanish data protection law (LOPDGDD).

1. Data Controller

Operated from the Canary Islands, Spain. Contact: legal@fourdesk.io.

You may exercise any of your GDPR rights by contacting us at legal@fourdesk.io.

2. Data We Collect

Account data: Your email address and authentication credentials when you register.

Usage data: Pages visited, features used, session duration, device type, browser, and IP address.

Journal and trading data: Trade records, mood and confidence ratings, notes, and any other content you enter into the Service.

Chart uploads: Images you upload for analysis. These are transmitted to our AI provider for processing and are not used for any other purpose.

Payment data: We do not store card details. Payment processors collect and handle payment information directly.

Communications: Emails or messages you send us.

3. How We Use Your Data

  • To provide, operate, and maintain the Service.
  • To process chart uploads through AI analysis and return results to you.
  • To generate coaching and psychological insights based on your journal data.
  • To send transactional emails (account verification, password reset, billing receipts).
  • To understand product usage through privacy-friendly analytics (PostHog), where you have given consent, so we can improve the Service.
  • To comply with legal obligations.

4. Legal Basis for Processing (GDPR)

  • Contract performance (Art. 6(1)(b)): Processing necessary to provide the Service you signed up for.
  • Legitimate interests (Art. 6(1)(f)): Improving the Service, ensuring security, preventing fraud.
  • Legal obligation (Art. 6(1)(c)): Retaining records as required by law.
  • Consent (Art. 6(1)(a)): Where you have opted in to optional communications or cookies.

5. Third-Party Services

We use the following sub-processors to operate the Service:

  • Supabase: Database, authentication, and file storage. Data is stored in EU regions. Privacy policy.
  • Anthropic: AI provider used to generate chart analysis and coaching/psychology insights. The chart images you upload and the text you enter (for example trade notes and check-in notes) are transmitted to Anthropic's API to produce your results and may contain personal data you choose to include. Under Anthropic's commercial API terms, this data is not used to train their models. We send only what is needed to generate your results. Privacy policy.
  • Vercel: Hosting and deployment infrastructure. Privacy policy.
  • Stripe: Payment processing for subscriptions. Stripe collects and handles your payment details directly; we do not store card numbers. Privacy policy.
  • PostHog: Product analytics, used only with your consent, with EU data hosting. Privacy policy.
  • Resend: Sending transactional and notification emails (processes your email address). Privacy policy.
  • Google: Optional "Sign in with Google" authentication; used only if you choose it. Privacy policy.

We do not sell your personal data to third parties.

6. Accountability Partners

Fourdesk offers an optional Accountability Partner feature. If you choose to use it, you can nominate one trusted person (for example a mentor, coach, or friend) to receive copies of your Coach, Risk Manager, and Psychologist report emails.

What is shared: When enabled, your nominated partner receives the same report content you do — this includes your trading performance and discipline metrics, your mood and confidence ratings, risk-management assessments, and your session debriefs. Your partner cannot log in to, view, or modify your account; they only receive the emails your activity generates.

Consent and verification (double opt-in): Adding a partner requires two separate confirmations. First, you must actively confirm — via a dedicated checkbox, separate from accepting our Terms — that the person has agreed to receive your reports. Second, we email the partner a unique confirmation link, and no report is ever sent until they click it to verify. Either of you can end the arrangement at any time: you from your settings, and your partner from an unsubscribe link included in every report email.

Legal basis (GDPR): We rely on your consent (Art. 6(1)(a)) to share your reports with the person you nominate, and on the legitimate interest (Art. 6(1)(f)) of both you and your partner in supporting trader improvement through external accountability. We process the partner's email address (and optional display name) solely to deliver these reports and to honor their verification and unsubscribe choices; it is not used for marketing or any other purpose.

Retention: We keep the partner relationship until you remove it or close your account, after which it is archived and then deleted in line with Section 7. Emails already sent to a partner cannot be recalled, as described in Section 7. Report emails to partners are delivered through Resend (see Section 5).

7. Data Retention

We retain your account data for as long as your account is active. Journal entries, trade records, and uploads are retained until you delete them or close your account. Anonymised, aggregated usage data may be retained indefinitely. We will delete your personal data within 30 days of a verified account deletion request.

Deleting content and its effect on AI features: You can delete individual Coach and Psychologist conversations, individual check-ins and debriefs, or all of your Psychologist data at any time from within the Service. When you delete a conversation or check-in, we permanently remove it from our database, and it is excluded from your Coach's and Psychologist's memory and from all future correlations, analyses, and insights — deleted content does not influence any future output. Some limits are inherent and worth stating plainly:

  • Reports already generated: A Coach report, Psychologist analysis, or correlation report reflects your data at the moment it was produced. Deleting a single underlying conversation or check-in does not retroactively alter a report that was already generated; those point-in-time reports remain until you use the “delete all Psychologist data” action or close your account.
  • Emails already sent: Emails we have already sent you (such as a weekly performance summary or a milestone email) may contain a snapshot of your data at the time of sending and cannot be recalled. We retain only metadata about these emails (type, subject, and timestamp), not their contents.
  • Derived summaries: Where you have previously discussed a check-in inside a Coach or Psychologist conversation, deleting the check-in removes it from correlations and live context, but any summary of that earlier conversation is only removed when you delete that conversation.
  • Aggregate metrics and streak counters: Certain derived values (for example achievement milestones you have earned and streak counters) are not retroactively recalculated when a single item is deleted; they update from your remaining data over time.

8. Your Rights Under GDPR

You have the following rights regarding your personal data:

  • Access: Request a copy of the personal data we hold about you.
  • Rectification: Ask us to correct inaccurate or incomplete data.
  • Erasure: Request deletion of your personal data ("right to be forgotten").
  • Restriction: Ask us to limit how we use your data in certain circumstances.
  • Portability: Receive your data in a structured, machine-readable format.
  • Objection: Object to processing based on legitimate interests.
  • Withdraw consent: Where processing is based on consent, withdraw it at any time without affecting prior processing.

To exercise any of these rights, contact us at legal@fourdesk.io. We will respond within 30 days.

9. Cookies

We use essential cookies for authentication, session management, and remembering your preferences (including your cookie choice). With your consent, we also use privacy-friendly analytics cookies (PostHog) to understand product usage; these are off by default and only enabled if you accept them in our cookie banner. We do not use advertising or cross-site tracking cookies. For full details and to change your choice at any time, see our Cookie Policy.

10. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction, including encrypted connections (HTTPS) and access controls on our databases.

11. International Transfers

Your data is primarily processed within the EU/EEA. Where sub-processors operate outside the EEA (for example, Anthropic in the United States), we ensure appropriate safeguards are in place, including Standard Contractual Clauses approved by the European Commission.

12. Supervisory Authority

If you believe we have not handled your data lawfully, you have the right to lodge a complaint with the Spanish data protection authority, the Agencia Española de Protección de Datos (AEPD) at www.aepd.es, or with the data protection authority in your country of residence.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or in-app notice. Continued use of the Service after the effective date of any changes constitutes acceptance of the updated policy.

14. Contact

For any privacy-related questions or to exercise your rights, contact us at legal@fourdesk.io.