Privacy policy
We only process the data we actually need for the website, the waitlist, the journal and the subscription. This policy follows the Swiss Federal Act on Data Protection (FADP). For people in the EU and EEA it also serves as information under the General Data Protection Regulation (GDPR).
1. Controller
Linus Schenker and Nils Bürki, GexPilot
Gibelweg 5, 9442 Berneck, Switzerland
Email: support@gexpilot.com
For any privacy question or to exercise your rights, an email to this address is enough.
2. What data we process and why
| Area | Data | Purpose | Legal basis (GDPR) | Retention |
|---|---|---|---|---|
| Visiting the website | IP address, date and time, page visited, referrer, browser and operating system | Secure and stable operation, preventing abuse | Legitimate interest (Art. 6(1)(f)) | As set by the hosting provider, usually no more than 30 days |
| Waitlist and launch news | Email address, time of sign-up | Informing you about the launch and the founder price | Consent (Art. 6(1)(a)) | Until you unsubscribe, at the latest 6 months after launch |
| Purchase and subscription | Name, email address, country or billing address, subscription status, payment date and amount | Concluding and performing the contract, delivering the levels, bookkeeping | Contract (Art. 6(1)(b)), legal obligation (Art. 6(1)(c)) | Contract data until the subscription ends, accounting records 10 years (Art. 958f Swiss Code of Obligations) |
| Payment | Payment details such as card or TWINT | Paying for the subscription | Contract (Art. 6(1)(b)) | Held by the payment provider under its own terms; we never see full card details |
| Delivery of the levels | Email address or username on the channel used | Sending the daily levels via [CHANNEL, e.g. email, Discord or Telegram] | Contract (Art. 6(1)(b)) | Until the subscription ends |
| Trading journal (account) | Email address for login, your trades (date, instrument, prices, result, setups, rules, emotion, notes), uploaded chart images, finance entries, settings, self-ratings and weekly reviews | Running your journal, statistics and reports | Contract (Art. 6(1)(b)) | Until you delete the data or close your account |
| Feedback form | Area, type and text of your message; email address only if you provide it | Improving the products, follow-up questions and replies | Legitimate interest (Art. 6(1)(f)) | Until the idea is shipped or declined, no more than 2 years |
| Contact by email | Name, email address, content of your message | Answering your request | Legitimate interest or contract (Art. 6(1)(b) and (f)) | Until the request is resolved, no more than 2 years |
We do not create personality profiles, do not carry out profiling and do not make automated individual decisions.
3. Cookies and tracking
This website uses no advertising or analytics cookies and no tracking. The journal stores your login session in your browser so you stay signed in. During checkout the payment provider may set strictly necessary cookies to process the purchase securely and prevent fraud. If we add analytics or marketing tools later, we will update this policy first and ask for your consent where required.
4. Service providers that process data for us
- Hosting: Netlify, Inc., USA. Runs the website and stores the waitlist.
- Feedback form: Web3Forms (web3forms.com). Forwards messages from the feedback form to our inbox by email.
- Email inbox: Google Workspace (Google LLC, USA). Receives feedback and support emails.
- Payment: [PAYMENT PROVIDER, e.g. Stripe or Lemon Squeezy]. Processes payments and subscriptions.
- Journal database, login and image storage: Supabase Inc. (servers in the EU (Ireland)).
- Email delivery: [EMAIL SERVICE, e.g. Brevo or MailerLite]. Sends launch news and the levels.
- Fonts: Google Fonts (Google LLC, USA). When the page loads, your IP address is sent to Google.
These providers process data only on our behalf and according to our instructions. We do not sell data or share it for advertising. Authorities receive data only where we are legally required to provide it.
5. Transfers abroad
Some providers are based in the USA or process data there. The USA is considered to provide adequate protection only for companies certified under the Swiss-U.S. or EU-U.S. Data Privacy Framework. For other providers we rely on the European Commission's standard contractual clauses, which are recognised by the Swiss Federal Data Protection and Information Commissioner (FDPIC). You can request a copy.
6. Data security
The website is encrypted (HTTPS). We protect data with appropriate technical and organisational measures, such as two-factor login for all service providers and access by the operators only. In the journal, each user can only access their own data.
7. Your rights
- Access to your data (Art. 25 FADP, Art. 15 GDPR)
- Correction of inaccurate data (Art. 32 FADP, Art. 16 GDPR)
- Erasure or restriction of processing, unless we are required to keep the data (Art. 17 and 18 GDPR)
- Objection to processing based on legitimate interest (Art. 21 GDPR)
- Receiving or transferring your data (Art. 28 FADP, Art. 20 GDPR)
- Withdrawing consent at any time with effect for the future, for example via the unsubscribe link in every email
Write to support@gexpilot.com. We usually reply within 30 days. You can also lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC, edoeb.admin.ch). In the EU, the data protection authority of your country of residence is responsible.
8. Age
Our services are intended for adults. We do not knowingly process data of people under 18.
9. Changes
We update this policy when our services or providers change. The version published on this page applies.
Last updated: 19 October 2026