Privacy Notice — EdgeLuma Waitlist
Version 2.2 · Effective 5 September 2026
1. Scope and application
This notice describes the processing of personal data carried out in connection with the waitlist registration form published at edgeluma.com. It does not cover the EdgeLuma product, which is not available to users; a separate notice will be issued before any account can be created.
It applies to every person who registers, irrespective of residence: the controllers are established in Italy and process this data in the context of that establishment, so Regulation (EU) 2016/679 (“GDPR”) governs all processing described here under Article 3(1), together with Italian Legislative Decree 196/2003 as amended (“Codice Privacy”).
2. Identity and contact details of the joint controllers
Raffaele Anagni and Matteo De Piccoli, natural persons resident in Italy, jointly determine the purposes and means of this processing and are joint controllers within the meaning of Article 26 GDPR. No legal entity has been incorporated; upon incorporation of the operating company, that company becomes the controller and this notice will be reissued.
| Channel | Details |
|---|---|
| edgelumamain@gmail.com | |
| Postal address | Supplied on request to the email address above |
No data protection officer has been designated; the conditions of Article 37(1) GDPR are not met. No representative under Article 27 GDPR is required, the controllers being established in the Union.
3. Categories of personal data and their sources
| Source | Data |
|---|---|
| Provided by you | Email address (required). Optionally, two selections from fixed lists: the markets you trade and what you use to trade. Your indication of consent |
| Collected automatically on submission | Date and time of consent; the referring page and any campaign parameters in the URL; your browser language; a referral code issued to your registration; and, where you arrived by invitation link, the code that issued it |
| Generated by us | Record identifier, registration timestamp, status, and internal notes recorded in administering the waitlist |
| Processed transiently, not stored in the register | The IP address submitting the form, used to apply a rate limit for fifteen minutes; connection data in our hosting provider's server logs |
Registrations made before 3 September 2026 may also contain answers given to an earlier version of the form: a selection describing the tools then in use, and free text of up to 280 characters describing the first strategy the person would test. Those answers are retained with the registration record and are no longer requested.
We collect no name, financial account details or trading positions, and no special category of data within the meaning of Article 9 GDPR. No data is obtained from third-party sources.
4. Purposes of processing and legal bases
| Purpose | Data used | Legal basis | |
|---|---|---|---|
| P1 | Notifying you when a place becomes available, and sending occasional product updates while you wait | Email address, browser language | Consent — Art. 6(1)(a) GDPR; Art. 130 Codice Privacy |
| P2 | Administering the register, including the order of invitation and the attribution of referrals | Registration record, optional answers, referral codes, status, internal notes | Legitimate interests — Art. 6(1)(f): operating the waitlist you asked to join |
| P3 | Understanding which channels produce registrations | Referring page, campaign parameters | Legitimate interests — Art. 6(1)(f): measuring the effect of our own communications |
| P4 | Preventing automated abuse of the form | IP address, hidden anti-automation field | Legitimate interests — Art. 6(1)(f): security and integrity of the service |
| P5 | Demonstrating that consent was validly obtained and giving effect to its withdrawal | Consent record and timestamp, suppression record | Legal obligation — Art. 6(1)(c), with Arts. 5(2) and 7(1) |
Where processing rests on legitimate interests you may object under Article 21(1) GDPR on grounds relating to your particular situation (Section 9).
5. Whether provision of data is required
Provision of your email address is necessary in order to be registered; it is not a statutory or contractual requirement. Without it you cannot be added to the waitlist and we cannot notify you. The two additional answers are optional and declining them does not affect your registration, but, as stated in Section 12, the answers inform the order in which invitations are issued.
6. Recipients, processors and international transfers
| Recipient | Role and function | Establishment | Transfer mechanism |
|---|---|---|---|
| Supabase Pte. Ltd | Processor (Art. 28 GDPR). Hosts the database holding the register; data are stored in the European Union (Germany) | Singapore | Standard contractual clauses (Decision (EU) 2021/914) in the processor's data processing addendum, with its UK addendum and Swiss amendments |
| Vercel Inc. | Processor (Art. 28 GDPR). Hosts the website and the server function receiving the form | United States | Standard contractual clauses (Decision (EU) 2021/914) in the processor's addendum, with the UK International Data Transfer Addendum. Vercel Inc. additionally self-certifies under the EU–U.S. Data Privacy Framework |
| Google LLC | Provider of the mailbox used for correspondence with the controllers | United States | Commission adequacy decision of 10 July 2023 on the EU–U.S. Data Privacy Framework; Google LLC is a self-certified participant |
Sub-processors engaged by the above are listed in their respective data processing addenda.
Recipients identified as processors act only on our documented instructions. The mailbox provider is not engaged under Article 28 GDPR: correspondence conducted through it is processed by Google LLC under the terms applicable to that mailbox.
Access to the register is limited to the two joint controllers. We do not sell, rent, exchange or otherwise disclose personal data to third parties for their own purposes, including advertising networks and data brokers. Data may be disclosed to a public authority where the law requires it.
Should the adequacy decision cease to apply, transfers relying on it will be made under standard contractual clauses. A copy of the clauses relied upon may be obtained at the contact address in Section 2.
7. Retention
| Data | Retention period |
|---|---|
| Registration record | Until you accept a place or ask to be removed, and in any event no longer than 24 months from registration |
| Suppression record | After deletion of the registration record, the email address in hashed form, retained solely to ensure no further contact, and deleted if you register again |
| Consent record | The registration period and five years thereafter, to demonstrate that consent was validly obtained |
| Rate-limiting data | Not persisted; held in memory for fifteen minutes |
| Server logs | One day, being the retention period applied by the hosting provider |
| Email correspondence | 24 months from the last message |
| Correspondence relating to a data protection request | Five years, aligned with the consent record |
The suppression record is retained under Article 6(1)(c) GDPR and falls within the exception in Article 17(3)(b). It serves no purpose other than suppression, and is therefore deleted when it ceases to serve it: where you register again, the record created by your earlier withdrawal is erased as part of the new registration. A record created following a request for erasure or an objection made to the contact address in Section 2 is not affected by a new registration and is lifted only on request.
8. Security
Traffic is transmitted over TLS. The register is not readable from the browser: access requires a server-side credential never exposed to the client, and the database grants permitting direct access have been revoked. The form does not disclose whether an address is already registered and cannot be used to test addresses. Submissions are rate-limited and screened for automation, length limits are enforced on every field, and free-text answers are never rendered back to any browser. The measures applied by our processors are described in their respective documentation.
9. Your rights and how to exercise them
You have the right to request access to your personal data (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and portability (Art. 20). You may object at any time, on grounds relating to your particular situation, to processing based on legitimate interests (Art. 21(1)), and at any time and without giving reasons to processing for direct marketing (Art. 21(2)).
Requests should be addressed to the contact details in Section 2 and are handled free of charge. We respond within one month of receipt, extendable by up to two further months where necessary given the complexity and number of requests; where extended, we inform you within one month, with reasons. Where a request is manifestly unfounded or excessive we may charge a reasonable fee or refuse to act (Art. 12(5)), and we may request information necessary to confirm your identity where we have reasonable doubts (Art. 12(6)).
10. Withdrawal of consent
You may withdraw consent at any time, without giving reasons and at no cost; every email we send carries an unsubscribe link having that effect. Withdrawal does not affect the lawfulness of processing carried out before it. Your registration record is then deleted and a suppression record retained as described in Section 7. Withdrawal does not bar you from registering again: a new registration is a new consent, and it erases the suppression record created by the withdrawal.
11. Complaints
You may lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work, or of the alleged infringement (Art. 77 GDPR). The authority competent for the controllers is the Garante per la protezione dei dati personali, Rome, Italy (garanteprivacy.it). You also have the right to an effective judicial remedy under Articles 78 and 79 GDPR.
12. Automated decision-making and profiling
No decision producing legal effects concerning you, or similarly significantly affecting you, is taken solely by automated processing within the meaning of Article 22(1) GDPR. Invitations are issued in batches selected by the controllers, informed by your optional answers and the registrations attributable to your referral code. We construct no advertising or behavioural profiles.
13. Minimum age
The waitlist is directed at persons of 18 years or older and not at children. We do not knowingly register any person below that age; where we become aware that a registration was made by one, the record is deleted.
14. Cookies and similar technologies
As at the effective date of this notice, the pages published at edgeluma.com do not store information in, and do not access information already stored in, your terminal equipment. No cookies are set; no browser local storage, session storage or indexed database is written; and no third-party script, pixel, analytics service or advertising technology is loaded, all page resources being served from edgeluma.com.
Consent under Article 122 of the Codice Privacy, implementing Article 5(3) of Directive 2002/58/EC, is accordingly not required and no banner is presented; that rule is technology-neutral, covering any means of storing or accessing information on terminal equipment, not cookies alone. Should this change, consent will be obtained before any non-essential technology is loaded and this notice amended.
15. Essence of the joint controller arrangement (Article 26(2) GDPR)
Both controllers are responsible for the information obligations under Articles 13 and 14 GDPR, which this notice discharges; for the security measures in Section 8 and the engagement of processors under Article 28 GDPR; and for assessing and, where required, notifying personal data breaches under Articles 33 and 34 GDPR. The contact details in Section 2 are the single point of contact: either controller may receive and act on a request, and both answer within the periods in Section 9.
Irrespective of this allocation, you may exercise your rights against each controller (Art. 26(3) GDPR). The terms of the arrangement may be requested at the contact address in Section 2.
16. Changes to this notice
This notice may be amended, in particular upon incorporation of the operating company, engagement of a new processor, a change to the categories of data collected, or a change of hosting plan affecting the retention periods in Section 7. Where an amendment materially affects processing based on your consent, or introduces a new purpose, we will inform you by email before it takes effect.
17. Effective date and version
Version 2.2, effective 5 September 2026. Previous versions: 2.1 of 3 September 2026, 2.0 of 14 August 2026 and 1.0 of 3 August 2026.
Service disclosure
What EdgeLuma does, what it does not do, and what a backtest is worth. This disclosure is published for your information. It does not form part of the privacy notice above, which concerns personal data alone.
What EdgeLuma is
EdgeLuma is a research tool. It turns a trading strategy you describe in your own words into a set of rules, replays those rules over market data that has already printed, and reports what they would have done. Coverage is crypto: spot and perpetual futures markets on Bybit and Binance, on timeframes from one minute to one week.
What EdgeLuma is not
It is not a signal service, a trading bot or a managed account. It does not place orders, hold funds, or connect to your exchange account in order to trade. It does not forecast prices and it promises no returns. Nothing the platform produces is a personal recommendation to buy or sell anything.
What a backtest can and cannot tell you
A backtest replays your rules over candles that have already closed. Exchange maker and taker fees and an estimated spread cost are charged on every fill, so the result you read is net of those costs rather than gross.
Other real conditions are not accounted for. Funding paid or received on a perpetual position is not modelled, so a system that holds through funding stamps costs more in reality than the report shows. Exchange outages, rejected orders, and the effect of your own order size on the price are outside the test as well. A result also depends on the period tested and on the assumptions you set, and past results are not future returns.
Figures published on this website
Where a performance figure appears on a public page, it is one example run of one system, shown together with the venue, instrument, timeframe and period it came from. It illustrates what a report contains. It is not a representative result, not a track record, and not an offer.
No investment advice
Nothing on this website or in the platform is investment advice, a personal recommendation, or an inducement to trade. We hold no authorisation from any financial supervisory authority and we provide no regulated investment service. Trading crypto assets carries the risk of losing your capital, and leveraged instruments such as perpetual futures can lose it faster than the market moves. Decisions you take with information from EdgeLuma remain yours; if you want advice, take it from someone authorised to give it.