Privacy Policy
Version 3.24 · Effective 20 October 2026
1. Introduction
This Privacy Policy explains how personal data is processed in connection with the EdgeLuma website at edgeluma.com and the EdgeLuma service, including user accounts, the paid plans, the trading systems users define, the backtests they run, the AI features, the feedback board and the support requests (together, the "Service"). It is provided pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (the "GDPR").
2. Data controller and contact
The controller of the personal data processed through the Service is Raffaele Anagni, Partita IVA (Italian VAT number) 02195180894, who provides the Service under the name EdgeLuma ("we", "us", "our"). Our address is Via Niccolò Copernico snc, Coop. Lavinia, 96011 Augusta (SR), Italy. For any question about this Privacy Policy or to exercise your rights, contact us at edgelumamain@gmail.com.
3. Personal data we process
| Category | Data | Source |
|---|---|---|
| Account data | Email address, technical user identifier, the username you choose for the feedback board and when you last chose it, the profile picture you add, if you add one (shown in your account's icon and next to your posts and replies on the feedback board; the location, date and camera details a photo file may carry are removed when it is uploaded), role, plan, account creation date and, if you enable it, your two-factor authentication factor. Your password is held by our authentication provider in hashed form. When you sign in, create an account, change your password or add a second factor, it passes through our website's servers on its way to the provider; we do not store it or record it in any log. If you sign in with Google, the authentication provider also receives the name and profile picture of your Google account; we do not use them. | Provided by you at registration, or by Google if you sign in with Google |
| User content | Trading systems, backtest configurations and results, folders and favourites. | Generated by you through the Service |
| AI conversations | Messages exchanged with the AI features (the system builder and the chat) and the drafts of trading systems produced in them, stored in your account and in internal request logs associated with your user identifier. | Provided by you |
| Feedback board data | Posts, replies, votes and any screenshots attached. Posts and replies are shown to other users together with the username you choose for your account, which you can change once a week, and with your profile picture, if you add one, which you can remove at any time; a change replaces the previous username on all your posts and replies. They cannot be published anonymously. Those written before usernames existed, signed with the part of your email address before the "@", take your username when you choose it. | Provided by you |
| Market requests | A market you ask us to add, or that is recorded automatically when you save, draft or preview a trading system on a market the Service does not yet hold, and, for the first request relating to a given market, your email address, so that we can respond to you. Your email address is not visible to other users. | Provided by you, or generated by the Service |
| Billing data | If you subscribe to a paid plan: the identifiers Stripe gives you as a customer and to your subscription, your plan, billing period, price and currency, when the subscription started, whether and when you asked for it to start at once (the box ticked before paying, kept by Stripe with your subscription), the status of the subscription, the end of the period paid, whether it is cancelled at the end of that period and when a payment last failed. To show you the Billing page, we read from Stripe the brand, the last four digits and the expiry date of your card and your invoices, and keep them only in the server's memory, for up to five minutes. We never receive your full card number. | Provided by Stripe when you subscribe and whenever your subscription changes |
| Cancellation feedback | When you cancel a paid plan from the Billing page: the reason you select and the words you write, both optional, with the plan, the billing period and the date. | Provided by you |
| Withdrawal declarations | When you withdraw from the purchase of a paid plan (Section 9 of the Terms of Service), from the Billing page or from the withdrawal page: your name, the email address for the receipt, the purchase as you identify it or as our records name it, the date and time we received the declaration, the technical user identifier of your account (or of the account whose email address you give, if there is one), and how the withdrawal was handled: the refund, the amount kept for the days used if you had asked for your plan to start at once, the end of the subscription, when the receipt was sent. | Provided by you; the handling is generated by the Service |
| Support requests | The requests you send to our team from Support: the topic you choose, the subject, your messages and any photos you attach (the location, date and camera details a photo file may carry are removed when it is uploaded), the replies of our team, the status of each request, when you last opened it, and the identification your browser sends with a new request (its name and version and your operating system). Only you and our team can read them. | Provided by you; the status, the moment you last opened a request and your browser's identification are generated by the Service |
| Usage data | Your use of the usage limits (the AI features measured in the tokens they consume, the backtests by the number you run, each record noting the days of history it covered), the records of the backtest jobs you submit, and the AI turns you have open at a given moment, used to enforce usage limits. | Generated by the Service |
| Interface state | Which feedback board posts and product updates you have already read, and whether you have completed the welcome, so that the Service can show you what is new. | Generated by the Service |
| Account deletion record | When you delete your account: your technical user identifier and the date of the deletion, and, for 30 days, a one-way fingerprint of your email address, which is not your email address and cannot be turned back into it. | Generated by the Service |
| Security record | When a member of our team moderates the feedback board, publishes or changes a product update or uses an administrative function, and when a signed-in account is refused access to one of these functions: the technical user identifier and role of the account, the action, what it concerned (for example the identifier of a feedback post or of a product update), the time and the outcome. It never contains the text of posts, replies or other content. | Generated by the Service |
| Technical data | Server and authentication logs, including IP addresses, maintained by the hosting and authentication providers listed in Section 6. | Collected automatically |
| Email delivery records | For each email the Service sends you: whether it was delivered, whether and when it was opened and whether a link in it was clicked, with the technical data your email program sends when it does so, such as its IP address and the type of device or program. | Collected automatically by Brevo (Section 6) |
We do not use advertising or analytics tracking technologies, with one exception in the emails the Service sends: Brevo, which delivers them, records their delivery, their opening and the clicks on their links (Section 6). Free-text fields, such as system descriptions, chat messages and feedback posts, contain only what you choose to enter; please do not include personal data relating to third parties.
4. Purposes and legal bases
| Purpose | Data | Legal basis |
|---|---|---|
| Provision of the Service, including account management, storage of user content, the AI features and the feedback board | Account data, user content, AI conversations, feedback board data, market requests, interface state | Performance of a contract (Art. 6(1)(b) GDPR) |
| Paid plans: starting and managing your subscription, giving your account the plan you pay for and showing you the Billing page | Account data, billing data | Performance of a contract (Art. 6(1)(b) GDPR) |
| Understanding why paid plans are cancelled, in order to improve the Service and its plans | Cancellation feedback | Legitimate interest in improving the Service (Art. 6(1)(f) GDPR) |
| Enforcement of usage limits and prevention of abuse, including keeping a deleted account closed and preventing the deletion of an account from being used to reset its usage limits | Usage data, account deletion record, technical data | Legitimate interest in maintaining the security and availability of the Service (Art. 6(1)(f) GDPR) |
| Security and accountability of the Service: a record of the moderation and administrative actions of our team and of refused attempts to use them | Security record | Legitimate interest in the security of the Service and in being able to account for how it is moderated and administered (Art. 6(1)(f) GDPR) |
| Delivering the Service's emails reliably and preventing abuse of the sending service | Email address, email delivery records | Legitimate interest in the reliable and secure delivery of the Service's emails (Art. 6(1)(f) GDPR) |
| Responding to your requests, including support, feedback and market requests | Email address, content of your message, support requests | Performance of a contract (Art. 6(1)(b) GDPR) |
| Handling a withdrawal from a purchase: receiving it, sending its receipt, refunding the purchase and ending the subscription, and keeping the proof that this was done | Withdrawal declarations, account data, billing data | Legal obligation (Art. 6(1)(c) GDPR: Article 54-bis and following of the Italian Consumer Code) and, for a customer the law does not cover, performance of a contract (Art. 6(1)(b) GDPR) |
| Compliance with legal obligations | Data required by the applicable obligation | Legal obligation (Art. 6(1)(c) GDPR) |
We do not send marketing communications. Should this change, such communications will be sent only with your prior consent, and this Privacy Policy will be updated in advance.
5. Mandatory and optional data
An email address and a password, or a Google account, are required to create an account; without them we cannot provide the Service. To subscribe to a paid plan you must give your payment details to Stripe; without them a paid plan cannot be provided. The provision of any other data, including the reason for a cancellation, is optional.
6. Recipients and processors
| Recipient | Role | Location |
|---|---|---|
| Supabase | Authentication and database hosting for the data listed in Section 3 | European Union (Frankfurt, Germany, region eu-central-1) |
| Hetzner Online GmbH (Gunzenhausen, Germany) | Hosts the server that runs the Service's backend (the API, the backtests, the market data, the feedback board's screenshots, the photos attached to support requests and the internal AI request logs) and the storage space that holds the encrypted backups of the database, as our processor under its data processing agreement. | European Union (Nuremberg, Germany, for the server; Helsinki, Finland, for the backups) |
| Vercel | Website hosting and delivery, including the server functions that handle signing in: they pass your email address and password to the authentication provider and set the session cookies described in Section 15 | United States; see Section 7 |
| Cloudflare, Inc. | Carries every request your browser sends to the Service's backend (api.edgeluma.com) and protects it against attacks. It handles each request in transit, including your IP address; it does not store the content of the requests. | Its global network; see Section 7 |
| DeepSeek | Provider of the language model powering the AI features. When you use them, the content of the conversation and the context required to generate a response are transmitted to its API. Your email address and account identity are not transmitted. | People's Republic of China; see Section 7 |
| Brevo (Sendinblue SAS, Paris) | Sends the Service's account emails (invitations, the confirmation of a new account's email address, password resets and similar messages about your account), the confirmation of a purchase and the receipt of a withdrawal from a purchase. It receives your email address and the content of the message, and keeps the email delivery records of Section 3: it adds an invisible image to each email and passes its links through its own servers, a measurement its service applies to every email it delivers. Your email program can prevent the image from being loaded. | European Union (France and Germany) |
| Stripe (Stripe, LLC and its affiliates, including Sold through Link, LLC) | Sells the paid plans as reseller and merchant of record and processes their payments (Section 9 of the Terms of Service). When you start a subscription we pass it your email address and your technical user identifier; it collects your payment details directly, on its own pages, and processes them as an independent controller under its own privacy policy. It informs us of the status of your subscription and, for the Billing page, of your card's brand, last four digits and expiry date and of your invoices. | United States and Stripe's other locations; see Section 7 |
| Provider of our email service. If you choose to sign in with Google, Google authenticates you and shares your email address, name and profile picture with our authentication provider, under Google's own terms and privacy policy. | Google's infrastructure, under Google's terms |
Feedback board screenshots, the photos attached to support requests and internal AI request logs are stored on the server that runs the Service's backend, hosted by Hetzner. Any additional hosting provider will be added to this list before it processes personal data. We do not sell personal data and do not share it with advertisers.
7. International data transfers
Data processed by Vercel may be transferred to the United States under Vercel's data processing agreement and the Standard Contractual Clauses adopted by the European Commission. Data transmitted to DeepSeek when you use the AI features is processed in the People's Republic of China, a country for which no adequacy decision has been adopted; this transfer is based on the provider's contractual terms. All features of the Service other than the AI features can be used without this transfer taking place. Requests to the Service's backend pass through Cloudflare's network, which may handle them outside the European Union, including in the United States: Cloudflare, Inc. is certified under the EU-U.S. Data Privacy Framework, and its data processing agreement includes the Standard Contractual Clauses for any transfer the Framework does not cover. Data passed to Stripe when you subscribe to a paid plan may be processed in the United States: Stripe, LLC is certified under the EU-U.S. Data Privacy Framework.
8. Data retention
| Data | Retention period |
|---|---|
| Account data, user content, AI conversations, usage data, interface state, billing data, cancellation feedback, support requests | For as long as your account exists; see Section 10 for erasure |
| Records kept by Stripe | Stripe keeps the records of your purchases, payments and invoices as the seller of the paid plans, under its own privacy policy and the tax and accounting obligations that apply to it. Deleting your account ends your subscription but does not delete those records |
| Feedback board data | For as long as the contributions remain on the board. When you delete your account, your votes and screenshots are deleted and your posts and replies remain without your name, marked "Deleted user"; on request, we remove them |
| Market requests | For as long as the request is open or is kept as a record of demand for the market; the stored email address is deleted when you delete your account, or on request |
| Internal AI request logs | 90 days from the request, or until you delete your account or request deletion, whichever comes first; entries are linked to your user identifier so that they can be located and deleted |
| Account deletion record | The fingerprint of your email address for 30 days after the deletion; the identifier and the date until your record at the authentication provider has been deleted and 30 days have passed. If an account is created with the same email address within those 30 days, its usage limits remain blocked until they have passed |
| Withdrawal declarations | 24 months from the declaration, to prove that it was received and handled, also if you delete your account in the meantime (Art. 17(3)(b) and (e) GDPR) |
| Email delivery records | Kept by Brevo in its sending logs for its own retention periods; we do not copy them into the Service |
| Security record | 12 months from each entry. It is kept when an account is deleted; from then on, the identifier it contains no longer leads to an email address or an account |
| Database backups | Encrypted copies of the database, kept for 30 days. Data you delete, a deleted account included, remains in them until the last copy that holds it is deleted, at the latest 30 days after the deletion |
| Provider logs (hosting, authentication) | In accordance with the respective providers' retention policies |
9. Security
All data is encrypted in transit (TLS). Your password passes through our website's servers only to be handed to the authentication provider, which keeps it in hashed form; we never store it or record it in any log. The database is not publicly accessible: access is denied by default on every table and is possible only through the authenticated API. Access to production systems is restricted to the EdgeLuma team. Your payment details are entered on Stripe's pages and held by Stripe: we never receive or store your full card number.
10. Your rights
Under Articles 15 to 21 GDPR you have the right to:
- access your personal data;
- obtain the rectification of inaccurate data;
- obtain the erasure of your data;
- obtain the restriction of processing;
- receive your data in a structured, machine-readable format (portability);
- object to processing based on legitimate interest.
| Right | How to exercise it |
|---|---|
| Access and portability | Your account settings allow you to export, in JSON format, your account details, your profile picture, trading systems, backtest runs, AI conversations, folders and favourites, feedback board posts, replies and votes, the list of the screenshots you attached, your market requests, your usage records, your subscription as Stripe last reported it, your cancellation feedback, your withdrawal declarations and your support requests with their messages and the list of the photos you attached. Your payments and invoices are held by Stripe, as the seller. The screenshots and photos themselves, and the other data listed in Section 3, are provided on request. |
| Erasure | Deleting your account from the account settings first ends any paid subscription, then removes your billing data and cancellation feedback, your trading systems, backtest runs, backtest jobs, AI conversations, folders and favourites, usage data, interface state, feedback board votes and uploaded screenshots, your support requests with their messages and photos, any stored market-request email address, your entries in the internal AI request logs, your profile picture, your account record and your record at the authentication provider. Your feedback board posts and replies remain on the board without your name, marked "Deleted user"; we remove them on request. We keep the account deletion record and the security record described in Section 8. |
| All other rights | Send your request to edgelumamain@gmail.com. |
We respond to requests within one month of receipt, in accordance with Article 12(3) GDPR.
11. Withdrawal of consent
None of the processing described in this Privacy Policy is based on consent. Should a consent-based feature be introduced, you will be able to withdraw your consent at any time, as easily as it was given, without affecting the lawfulness of processing carried out before its withdrawal.
12. Right to lodge a complaint
You have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it) or with the supervisory authority of the Member State of your habitual residence, place of work or place of the alleged infringement.
13. Automated decision-making
The Service does not carry out automated decision-making, including profiling, within the meaning of Article 22 GDPR. The AI features generate content at your request and do not take decisions that produce legal or similarly significant effects concerning you. Backtest results are computed solely from the rules and data you select.
14. Minimum age
The Service is not directed at minors. You must be at least 18 years old to create an account.
16. Changes to this Privacy Policy
We will update this Privacy Policy whenever changes to the Service affect the processing of personal data. Each update is identified by a new version number and effective date, and account holders will be informed of material changes before they take effect.
17. Version
Version 3.24, effective 20 October 2026. It supersedes version 3.23 of 16 October 2026.
Risk and Service Disclosure
Nature of the Service
EdgeLuma is a research tool. It converts a trading strategy described by the user in natural language into a set of rules, applies those rules to historical market data and reports the results they would have produced. The Service covers crypto assets only: spot and perpetual futures markets on Bybit and Binance, on timeframes from one minute to one week. EdgeLuma is independent of these exchanges: it is not affiliated with, endorsed or sponsored by them, and it works from the market data and fee schedules they make public.
What the Service does not do
EdgeLuma is not a signal service, a trading bot or a portfolio management service. It does not place orders, hold funds or connect to your exchange account for trading purposes. It does not forecast prices and does not promise any return. The trading ideas tested through the Service are your own: the AI features explain concepts and convert your description into rules, and any option they describe is general in nature, is not based on an assessment of your personal circumstances and is not presented as suitable for you. Nothing produced by the Service constitutes a personal recommendation to buy or sell any asset.
Limitations of backtesting
A backtest applies a set of rules to historical price data. When an exchange cost model is selected, the exchange's maker and taker fees are applied to every simulated fill, and an estimated slippage cost, which increases with the size of the order, is applied to every fill executed as a taker; the reported results are net of those costs. If you select custom costs or no costs, the results reflect that selection.
Other market conditions are not modelled. Funding payments on perpetual futures positions are not included, so a position held across funding times may cost more in practice than the backtest shows. Exchange outages and rejected orders are also outside the scope of the simulation. Results depend on the period tested and on the assumptions selected. Past performance is not a reliable indicator of future results.
Performance figures on this website
Where a performance figure appears on a public page, it refers to a single example run of a single system and is shown together with the venue, instrument, timeframe and period from which it is derived. It is intended to illustrate the content of a backtest report. It is not a representative result, a track record or an offer.
No investment advice
Nothing on this website or within the Service constitutes investment advice, a personal recommendation or an inducement to trade. EdgeLuma is not authorised by any financial supervisory authority and does not provide regulated investment services. Trading crypto assets involves a high risk of losing your capital, and leveraged products such as perpetual futures can amplify losses. Any decision you make on the basis of information obtained through the Service is your sole responsibility. If you require investment advice, consult an appropriately authorised professional.