Privacy Policy
Last updated
This policy explains what personal data Heatmaps Pro collects, why, and what rights you have over it.
The data controller is Volkan Kezer, a sole proprietor established in Türkiye, contactable at support@heatmaps.pro.
1. Summary
We collect very little. We need an email address to give you an account, and we need to know which plan you are on.
We do not collect your trading activity, we have no access to any exchange account, and we never see your payment card details.
2. What we collect
Account data
When you register, our authentication provider Clerk collects and stores your email address, authentication credentials, and session information. If you sign in through a third-party provider such as Google, Clerk receives the basic profile information that provider shares.
- Purpose:
- to create and secure your account.
- Legal basis (GDPR):
- performance of a contract.
Subscription data
When you purchase a paid plan, Paddle collects your payment details, billing address, and country for tax purposes. Paddle acts as Merchant of Record and is an independent data controller for this processing — their privacy policy governs it.
We receive only the result: your subscription status and plan tier, which we store against your account.
- Purpose:
- to process payment and grant the entitlements you paid for.
- Legal basis:
- performance of a contract; compliance with tax and accounting obligations.
Usage analytics
We do not currently use any product analytics: no analytics provider receives data about your use of the Service. If we add one, we will update this policy before it starts collecting anything.
Technical data
Our servers process standard request information — IP address, browser type, timestamps — as any web server does. IP addresses are used transiently for rate limiting and abuse prevention and are not retained in a user profile.
- Purpose:
- security, abuse prevention, service operation.
- Legal basis:
- legitimate interest in keeping the Service available and secure.
Local preferences
Your interface preferences — view mode, visible columns, signal settings, selected symbol — are stored in your browser's local storage. They stay on your device, are not transmitted to us, and are cleared when you clear your browser data.
3. What we do not collect
To be explicit, because this matters for a trading-adjacent product:
- We do not collect, request, or store exchange API keys.
- We have no read or write access to any exchange account, wallet, or position.
- We do not record what you trade, when, or how much.
- We never receive your full payment card number.
4. Who your data is shared with
We do not sell personal data. We share it only with the processors needed to run the Service:
| Provider | Role | Data involved |
|---|---|---|
| Clerk | Authentication | Email, credentials, session data |
| Paddle | Payment, Merchant of Record | Payment and billing data |
| Vercel | Application hosting | Request data, logs |
| Vultr | Market data proxy (self-hosted) | IP address (transient, rate limiting) |
| Cloudflare | DNS and network protection | Request metadata |
We may also disclose data where legally required, or to establish or defend legal claims.
5. International transfers
Our providers may process data outside your country, including in the United States and the European Economic Area. Where personal data is transferred out of the EEA or the UK, our providers rely on recognized safeguards such as the European Commission's Standard Contractual Clauses or applicable adequacy decisions.
6. How long we keep data
- Account data: for as long as your account exists, then deleted or anonymized within 90 days of account deletion.
- Billing records: retained by Paddle and by us for the period required by tax and accounting law (typically up to 10 years).
- Server logs: typically 30 days.
7. Your rights
Depending on where you live, you have rights over your personal data. Under the GDPR (EU/UK) and Türkiye's KVKK (Law No. 6698), these include the right to:
- know whether we process your data, and access a copy of it;
- have inaccurate data corrected;
- have your data deleted;
- restrict or object to certain processing;
- receive your data in a portable format;
- withdraw consent where processing is based on consent;
- lodge a complaint with a supervisory authority — the Turkish Personal Data Protection Authority (KVKK), or your local data protection authority in the EU/UK.
To exercise any of these rights, email support@heatmaps.pro. We respond within 30 days.
You can ask us to delete your account at any time by emailing support@heatmaps.pro. We then delete or anonymize your account data within the period given in Section 6.
Deleting your account does not by itself cancel a paid subscription. If you have one, cancel it as described in the Refund Policy — otherwise Paddle will keep renewing it.
8. Cookies
We use cookies that are strictly necessary for the Service to work — principally authentication and session cookies set by Clerk, and security cookies set by Cloudflare. These do not require consent because the Service cannot function without them.
We set no advertising or tracking cookies. We do not run advertising, and we do not permit third parties to use the Service to track you across other websites.
9. Security
We protect data through encryption in transit (HTTPS), access controls, and reliance on established providers for authentication and payment rather than handling credentials or card data ourselves.
No system is perfectly secure. If a breach occurs that is likely to result in a risk to your rights, we will notify you and the relevant authority as required by law.
10. Children
The Service is not directed at anyone under 18, and we do not knowingly collect data from children. If you believe a minor has provided us data, contact support@heatmaps.pro and we will delete it.
11. Changes
We may update this policy. Material changes will be announced through the Service or by email before taking effect. The "Last updated" date above always reflects the current version.