Privacy Policy

1. Who We Are

CandleRange is operated by SAH Consult Ltd, a company registered in England and Wales. We are the data controller for personal data collected through candlerange.com.

Contact: support@candlerange.com

2. Data We Collect

Account data: Email address and authentication credentials when you create an account.

Usage data: Pages visited, features used, scan queries, and session information.

Trade journal data: Trade entries, notes, and performance data you voluntarily enter into the Trade Journal. This data is stored securely and is not shared with third parties.

AI conversation data: Messages you send to the AI Analyst. These are processed to generate responses and stored to maintain conversation history within your account.

Payment data: Subscription and billing information is processed by Stripe. We do not store your card details - these are held securely by Stripe under their own privacy policy.

Technical data: IP address, browser type, device information, and cookies used for authentication and session management.

3. How We Use Your Data

We use your data to provide and improve the CandleRange service, authenticate your account and maintain your session, process subscription payments, send transactional emails, respond to support requests, and monitor platform performance.

We do not sell your data to third parties. We do not use your data for advertising purposes.

4. Data Processors

Supabase - database and authentication. Your account data and trade journal are stored on Supabase infrastructure. Supabase is SOC 2 compliant.

Anthropic - AI model provider. Messages sent to the AI Analyst are processed by Anthropic's Claude API. Anthropic's usage policies apply to this processing.

Stripe - payment processing. Subscription billing is handled by Stripe. Stripe's privacy policy governs payment data.

OANDA - market data provider. Price feeds are sourced from OANDA's API. No personal data is shared with OANDA.

Vercel - hosting provider. The CandleRange application is hosted on Vercel's infrastructure.

5. Cookies

CandleRange uses essential cookies for authentication and session management. These cookies are strictly necessary for the platform to function and cannot be disabled without breaking core functionality.

We do not use advertising cookies or third-party tracking cookies.

6. Data Retention

We retain your account data for as long as your account is active. If you delete your account, your personal data will be deleted within 30 days, except where we are required to retain it for legal or regulatory purposes.

Trade journal data is retained until you delete it or close your account.

7. Your Rights

Under UK GDPR, you have the right to access the personal data we hold about you, correct inaccurate data, request deletion of your data, object to processing of your data, request restriction of processing, and data portability.

To exercise any of these rights, contact us at support@candlerange.com. We will respond within 30 days.

8. Data Security

We take reasonable technical and organisational measures to protect your personal data against unauthorised access, loss, or disclosure. This includes encrypted connections (HTTPS), secure database access controls, and limited staff access to personal data.

9. International Transfers

Some of our data processors (including Supabase, Anthropic, Stripe, and Vercel) may process data outside the UK. Where this occurs, we ensure appropriate safeguards are in place in accordance with UK GDPR requirements.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by email or by posting a notice on the platform.

11. Contact and Complaints

For privacy-related queries: support@candlerange.com

If you are unhappy with how we handle your data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.