This policy explains what personal data Lemma Analysis collects, why we collect it, the legal basis for each purpose, who we share it with, how long we keep it, and the rights you have over it. It is written to meet Art. 13 of the EU General Data Protection Regulation.
Who we are (controller)
Lemma Analysis is operated by a sole trader (OSVČ) established in the Czech Republic.
For any privacy question or to exercise your rights, contact us at support@lemma-analysis.com. We have not appointed a Data Protection Officer, as we are not required to.
What we collect, why, and our legal basis
We name a specific legal basis for each purpose — never a blanket statement.
a) Account creation and authentication. Data: your email, a securely hashed password, and profile details you provide (display name, short bio, country, investor type, avatar image). To keep your account secure we also store session records including your IP address and browser user-agent.
Legal basis: Art. 6(1)(b) — performance of our contract with you (your account is the service).
Security attributes (IP/user-agent, abuse prevention, session-reuse detection) also rely on Art. 6(1)(f) legitimate interests — see §4.
b) Portfolio and valuation analytics (the core service). Data: the portfolios, holdings, transactions, watchlists, valuation scenarios, saved screens and free-text journal entries you create.
Legal basis: Art. 6(1)(b) — performance of the contract.
c) Subscription and billing. Data: your subscription status and identifiers linking your account to our payment provider. We never see or store your card details — payment is handled by LemonSqueezy as Merchant of Record (see §5).
Legal basis: Art. 6(1)(b) — performance of the contract; and Art. 6(1)(c) — legal obligation, for accounting/tax record retention.
d) Transactional email. Data: your email address, used to send verification, password-reset, security and trial-related emails. We do not send marketing email and keep no marketing list.
Legal basis: Art. 6(1)(b) — performance of the contract.
e) Security, monitoring and error handling. Data: request logs (a numeric user id, request paths, timing) and the session data noted in (a). Our website also uses Sentry for error tracking, hosted in the EU (Germany). An error report contains the technical fault and the page it happened on, your browser and operating system, the page that referred you, and a short trail of what led up to the error: the pages you moved between and the requests the page made. It does not record what you clicked or what you typed. Links are stripped of everything after the ?, so verification and password-reset tokens never travel with them, and no user identity is attached to the report.
Legal basis: Art. 6(1)(f) — legitimate interests (see §4).
f) Product analytics. Data: pageviews and a few product events (e.g. sign-up, trial start) associated with your user id, collected via PostHog on its EU cloud. Our analytics is cookieless (no persistent tracking cookie), and automatic capture of clicks/inputs is disabled.
Legal basis: Art. 6(1)(f) — legitimate interests (understanding and improving how the Service is used). See §4.
You can opt out at any time — a single switch in Settings, and at the bottom of this page, turns product analytics off (see §8).
g) Record of your privacy requests. Data: when you exercise a privacy right in the app — downloading your data, or deleting your account — we record the type of request, your user id and email address, when it arrived, and when it was completed. When your account is finally erased, the identifying part of that record is erased with it: what remains is only that a request of that type was received and handled on those dates.
Legal basis: Art. 6(1)(c) — legal obligation. Data protection law requires us to be able to demonstrate that we honour your rights and meet the one-month response deadline.
h) Connected broker accounts. Data: if you connect a brokerage account so that your transactions arrive on their own, we store which broker it is, which of your portfolios it feeds, the access key you issued at the broker (encrypted — see below), the state of the connection (working, or rejected by the broker), and how each run ended: when it last ran, the date up to which it has read your history, how many transactions it brought in, and the broker’s reason if it did not succeed. The transactions themselves are imported into your portfolio and become part of (b), together with a note of which broker they came from and the broker’s own identifier for each trade.
Legal basis: Art. 6(1)(b) — performance of the contract: you ask for the connection, and the sync is the service you asked for.
The key is a credential to a third party, and we treat it differently from your password. Your password to us is kept as a one-way hash and never reproduced. The broker key has to be sent to the broker on every run, so it is stored reversibly encrypted (AES-256-GCM, under a key that lives only in the server’s configuration and never in the database) and decrypted only for the length of that call. It is never returned — not in any response, not to you, not masked or shortened — never written to a log, and left out of your data export. Disconnecting deletes it immediately.
The key must be read-only. We use it to read your transaction history and nothing else: we place no orders and move no money, and we ask you to issue a key that cannot. The key is yours to revoke at the broker at any time.
i) The public feedback page. If you write on our public feedback page, we store and — once a person on our team has read it — publish what you wrote, together with the display name from your profile at the moment you sent it. This is the one place in the Service where something you write is shown to everyone, including people who are not signed in and search engines, so a few things are worth stating plainly:
Nothing appears until a human has read it. Every message, including a reply in your own thread and any edit of a message already published, goes into a review queue first. If we refuse one, we tell you and we tell you why.
What is shown: your message, the display name captured at the moment you sent it (or “Anonymous” if you choose), the time, and the team’s reply. The name is a snapshot, like a signature under a letter: renaming your profile later does not rewrite it, and we never look your current name up to draw the page. Your email address, the account the message belongs to, and your avatar are never shown — the link to your account is stored so that the message stays yours to edit and delete, and it appears in no page, no reply and nobody else’s data export. Links inside a message are not turned into clickable links.
You stay in control. You can hide your name at any time, and put it back; you can edit the message (it returns to review); and you can delete it, which also takes the whole thread — our replies included — off the page.
Legal basis: Art. 6(1)(a) consent for publishing your message — you can withdraw it by deleting the message or your account; Art. 6(1)(c) legal obligation for keeping the record of our moderation decision and telling you its ground (Regulation (EU) 2022/2065, the Digital Services Act, Arts. 16-17); and Art. 6(1)(f) legitimate interests for the review itself — see §4.
If you delete your account, your messages are deleted with it — not renamed to “Anonymous”. Text that was already published under your name, at the same address, with the same timestamp, would still point back at you, so leaving it up under another label would not protect you.
To report something you see on that page, write to the address in §1 — we act on notices about published content there.
Cookies. We use only strictly-necessary cookies — the access_token and refresh_token authentication cookies that keep you signed in. We set no advertising or tracking cookies: our analytics (PostHog) is cookieless, and error tracking (Sentry) sets none. Because we use no non-essential cookies, no cookie-consent banner is required. The only thing product analytics writes to your device at all is a small flag recording that you completed sign-up (so that email verification, which usually opens in a new tab, can pick up where you left off); it is not written if you have opted out, and is deleted the moment you do.
Our legitimate interests (named)
Where we rely on Art. 6(1)(f), the specific interests are:
Protecting the service and our users against unauthorised access, credential-stuffing, token theft/replay, and abuse — this is why we store session IP/user-agent, apply rate limiting, and detect refresh-token reuse.
Diagnosing and resolving technical incidents to keep the service reliable and secure.
Understanding and improving how the Service is used (privacy-friendly, cookieless product analytics) so we can prioritise features and fix usability problems.
Reviewing what is written on our public feedback page before it appears, so that unlawful or abusive content is not published on a page we host and that carries our name.
You can object to processing based on legitimate interests (see §8). If your browser sends a Global Privacy Control signal, we honour it as an objection to product analytics by default, even before you have made an explicit choice.
LemonSqueezy — independent controller (Merchant of Record): handles your payment. As Merchant of Record it is a separate data controller with its own privacy policy, not our processor.
Market-data providers (Twelve Data, Finnhub): we send them stock tickers only — never your identity or holdings. They are not recipients of your personal data.
News publishers’ image servers: where a news item comes with a thumbnail, your browser loads that image directly from the publisher’s own servers (for example CNBC, Benzinga or Seeking Alpha), which lets them see your IP address and browser. We send them nothing about you, and we suppress the referrer so they are not told which page you were reading. They are not our processors.
Your broker — independent controller, not our processor: if you connect a brokerage account, we send the broker the key you issued and a request for your own account’s transaction history, over the interface the broker offers its customers. We send it nothing about you that it does not already hold — no identity and no detail of your account with us — and we act on your instruction, with your key. The broker processes your data under its own agreement with you and its own privacy policy, as an independent controller; it is not our subprocessor and does not appear on the Subprocessors page. The brokers that can be connected are listed in the app.
Everyone, for what you publish on the feedback page: a message we approve is shown on a public page that anybody can read and search engines can index. That is not us sharing your data with a recipient — it is publication, at your own request, of what you chose to write. Everything else about you stays where it was.
The current list, with roles and hosting regions, is on our Subprocessors page.
International transfers
Your data is stored within the EU: our database is hosted on Aiven (an EU company) in an EU region, our backend runs on Railway in the EU, profile avatars are stored in Cloudflare’s Eastern Europe region, transactional email is sent via Resend from Ireland, error reports go to Sentry’s EU (Germany) project, and product analytics to PostHog’s EU cloud. Some of these providers (Cloudflare, Resend, Railway, Sentry, PostHog) are headquartered in the United States and could in principle access data from there. For any such transfer or access we rely on an appropriate safeguard — the provider’s Standard Contractual Clauses and/or its EU-US Data Privacy Framework certification. You can request a copy of the relevant safeguard by contacting us at the address in §1.
If you connect a brokerage account, the request carrying your key goes to wherever your broker operates, which may be outside the EU. You chose that broker and hold your account under its own terms; for a broker outside the EU the transfer is one necessary to perform the contract you asked us to perform (Art. 49(1)(b)). Nothing else about you travels with it — see §5.
How long we keep your data (retention)
Account data (profile, portfolios, transactions, watchlists, journals, scenarios, screens): for as long as your account exists; deleted 30 days after you delete your account (see below).
Account deletion: when you delete your account, we immediately close access to it and cancel any active subscription. We keep your data for a further 30 days so that you can change your mind — signing in with the same email address and password within that period restores the account. After 30 days the data is erased permanently. Until then the email address stays reserved for your account and cannot be used to register a new one.
Sessions / refresh tokens: expired sessions are removed nightly; revoked sessions are kept for up to 30 days for security purposes.
Password-reset tokens: valid for 60 minutes; expired tokens are removed nightly. Email-verification tokens are valid for 24 hours and are likewise removed nightly once they expire.
Connected broker accounts: the connection — the encrypted key, the connection state and the run dates — is kept for as long as the connection exists. Disconnecting deletes it, encrypted key included, immediately; deleting the portfolio it feeds, or your account, deletes it the same way. The transactions it imported are your account data: they stay in your portfolio when you disconnect and follow the account-data rule above.
Messages on the public feedback page: kept for as long as your account exists, and deleted with it. You can remove one earlier yourself at any time. A message we refused is deleted 90 days after the refusal — long enough that you can ask us about it, short enough that we do not keep text nobody will ever see. The record that a decision was taken, and on what ground, is kept indefinitely, as we must be able to show it; it holds no copy of your message and stops identifying you when your account is erased.
Logs: technical server logs are kept for 7 days by our hosting provider and then deleted automatically.
Record of your privacy requests: kept indefinitely, because we must be able to show that we honoured them. It stops identifying you when your account is erased — your user id and email address are removed from it at that moment, leaving only the type of request and its dates.
Billing/accounting records: retained for the period required by Czech accounting and tax law, even after account deletion. Most of this obligation is carried by LemonSqueezy as Merchant of Record.
Your rights
You have the right to: access your data; rectify inaccurate data; erase your data (“right to be forgotten”); restrict processing; data portability; and to object to processing based on our legitimate interests. Where processing is based on consent, you may withdraw it at any time without affecting prior processing. To exercise any right, contact us (§1).
Objecting to product analytics. Your Art. 21 right to object to processing based on our legitimate interests is a single switch: a checkbox in Settings, and the same control at the bottom of this page for visitors who are not signed in. Turning it off stops analytics immediately and clears the one thing it had stored on your device.
Access and portability. You can download a complete export of everything we hold about you — your profile, portfolios, transactions, watchlists, valuation scenarios, saved screens, anything you wrote on the public feedback page, and account and session details — as a single file in a standard, machine-readable format. It is a self-service download in your account Settings, available to every account holder regardless of subscription plan or payment status, because access to your own data is not something we put behind a paywall. The one thing the export never contains is the access key of a connected broker account — see §3(h): it is a credential to a third party, and it leaves our systems only towards that third party.
Right to lodge a complaint. You have the right to lodge a complaint with the Czech supervisory authority:
Úřad pro ochranu osobních údajů (ÚOOÚ) Pplk. Sochora 27, 170 00 Praha 7, Czech Republic — https://www.uoou.cz
Whether providing data is required
Providing your email, a password and payment details is necessary to create an account and subscribe — without them we cannot provide the service (the data is a contractual requirement). Optional profile fields (bio, avatar, country, investor type) are voluntary and not providing them does not affect your access. Connecting a brokerage account is optional too: the same transactions can be entered by hand or imported from a file you exported.
Automated decision-making
Our valuation and analysis tools — including DCF, reverse-DCF, and the ”In Buy Zone” heuristic — produce analytical, informational outputs about public companies. They are not automated decisions about you, and they do not produce legal effects or similarly significantly affect you within the meaning of Art. 22 GDPR. You remain solely responsible for your own investment decisions.
Age requirement
Lemma Analysis is intended for adults aged 18 or over. Although the Czech age of consent for information society services is 15, a financial-analytics product is restricted to adults, and you must be at least 18 to create an account. Creating an account accepts our Terms of Use, where the requirement stands as a separate clause, and the moment of that acceptance is recorded with your account.
Changes to this policy
We update this policy as needed. The date at the top of this page is the date of the most recent change; we keep a record of every earlier version and will provide it on request at the address in §1. A change to the third parties who process data for us is announced separately, on our Subprocessors page, which carries its own date and its own notice period.
Product analytics
Cookieless and EU-hosted — pageviews and a few product events. The only thing it stores on this device is a flag marking a completed sign-up, and turning this off clears it. Error tracking stays on: it keeps the service working. Its reports carry no account identity, and nothing you clicked or typed.