Privacy Policy

Last updated: September 6, 2026

In one sentence. GexVision stores your email address and little else. We do not sell data, there are no ads, there are no third-party trackers, and your card never touches our servers.

1. Who handles your data

GexVision (gexvision.io) is the controller of your data. For anything related to it, write to [email protected].

2. Exactly what we store

This is the complete list. There is nothing else:

Data	Why	How long
Email address	Identify your subscription, support you, reissue your key	While you have an account, and up to 7 years where payments occurred (tax obligation)
Stripe customer and subscription IDs	Know whether your subscription is current	Same as above
SHA-256 hash of your access key	Validate it without being able to read it	While the licence exists
Plan, status and expiry date	Grant or cut off access	While the licence exists
Last time your key was used	Detect shared or compromised keys	Overwritten on each use
Your TradingView username, if you give it	Invite you to the private indicator	While you have an account
Morning Brief preferences (symbols, editions, language) and, if you connect one, your Discord webhook URL	Send your brief and alerts where you choose	While you have an account; the webhook is deleted when you disconnect it
Your browser's push subscription (endpoint and keys the browser itself generates)	Send push notifications if you turn them on	Until you turn them off or the browser revokes it
Your alerts (condition, symbol, channel)	Notify you when they trigger	Until you delete them
Where your first visit came from (e.g. "tradingview" or "direct") and the landing page	Know how customers find us. Never combined with anything external	90 days in the cookie; afterwards only the label next to your licence
IP address	In memory only, to rate-limit login attempts and stop abuse	Minutes. Never written to a database

The files you download for NinjaTrader 8, Sierra Chart or Bookmap carry your access key inside: they live on your machine and create no new data on our servers. If you connect a broker (Tradier), its token travels with each request from your browser and is never stored on our servers.

3. What we do NOT store

Your card. Stripe processes payment end to end. Card details never touch our servers; we only receive an identifier and whether the charge succeeded.
Your trading activity. We do not know what you trade, when, or with how much. The platform does not log which levels you look at.
Trackers. No Google Analytics, no Meta pixel, no advertising, no third-party tool following you across sites. On public pages we use Cloudflare Web Analytics, which counts visits without cookies, without fingerprinting and without identifying you.
Sensitive data. We do not ask for and do not want ID documents, health data, or any special category of data.

4. Cookies

We use three first-party cookies, none from third parties and none for advertising:

gxv_lang — remembers whether you prefer the site in English or Spanish. Lasts one year. Contains nothing that identifies you.
gxv_sess — keeps you signed in when you log in with a password, an email link or Google. Lasts 30 days or until you log out. Strictly necessary for the service to work.
gxv_src — records where you came from on your first visit (for example "tradingview" or "direct") and the landing page, so we know how customers find us. Lasts 90 days, is read only by our server and is never shared. If you visit from the European Union, the European Economic Area, the United Kingdom or Switzerland, this cookie is not set.

Separately, your own browser stores your access key, language and chart settings in localStorage, on your machine. That is never sent to anyone except our own API to validate your licence, and you can clear it by clearing site data in your browser.

That is why you will not see a cookie banner: the first two are necessary, and the third is not used where the law requires consent.

5. Who we share with (processors)

GexVision collects and processes personal data (the items in section 2). To run the service, some of that data is shared with the providers that make it work, and only with them:

Stripe (payments) — receives your email and card details directly. Payment processor, with its own privacy policy.
Railway (hosting) — hosts the server; its access logs contain IP addresses.
Resend (email) — sends emails to customers; receives your email address and the message content sent to you. Only used if you subscribe.
Anthropic (artificial intelligence) — see section 6. Processes the text you write to the support assistant and business data; card details, passwords and keys are never sent to it.
Cloudflare (network & security) — processes edge traffic (your IP address, for anti-abuse protection) and routes inbound email sent to our addresses. It does not receive your card.
Google (optional sign-in) — only if you choose «Sign in with Google»: Google confirms your verified email to us. If you don't use that button, Google is not involved.
Your data provider (BYOD) — only if you connect one (Tradier, Finnhub, etc.): your live-price requests travel to THAT provider with YOUR token, under their terms. Your token is not stored on our servers.
CBOE (market data) — the options data source. It receives nothing about you at all — we only request public options chains.

We do not sell, rent or hand over personal data to anyone else, for any reason. Each of these providers acts as a data processor under contract.

6. Use of artificial intelligence

GexVision uses artificial-intelligence models from Anthropic (Claude) in two places. What you should know:

Customer support assistant (chatbot). There is a help chat in the dashboard. If you use it, the text you write and that conversation thread are sent to Anthropic to generate the reply. Don't type sensitive data there; for billing questions your card number is not needed. You can use email support instead of the chat if you prefer.
Internal admin assistant. Used only by the GexVision team to summarize business status and help draft support replies.
Card details, passwords and access keys are never sent to the AI.
The AI makes no automated decisions that affect you (it does not cut off access or charge on its own): any action with real effect is confirmed by a person.
Anthropic processes that data as a processor and, per its policy, does not use it to train its models.

Any text a customer writes is treated as data, never as an instruction to the AI.

7. Your rights

By writing to the address above, you can ask us to:

Show you everything we hold about you.
Correct anything that is wrong.
Delete your account and data. We cancel the licence and remove the record, except what tax law requires us to keep about payments already made.
Export it in a machine-readable format.
Object to any processing. We do no profiling. We occasionally email customers about product updates; every such email carries a one-click unsubscribe link, and that choice is honoured permanently.

We respond within 30 days at most. Exercising any right is free.

8. How we protect what we store

All traffic is encrypted over HTTPS, with HSTS.
Access keys are stored only as a SHA-256 hash — not even we can read them.
The key handed to you after payment is encrypted while pending and deleted after 30 minutes.
The server does not run with administrator privileges and the database is not readable by other processes.
Login attempts are rate-limited, and response headers prevent your key from leaking to third parties.

No system is invulnerable. If there were ever a breach affecting your data, we will tell you by email without undue delay and within 72 hours of detecting it at the latest.

8b. Subscription and automatic renewal

Your GexVision subscription renews automatically at the end of each period ($49/month on the monthly plan, $39/month billed annually) until you cancel. No lock-in: you can cancel anytime from your account (Stripe billing portal), and cancelling is as easy as subscribing — one click. If you cancel, you keep access until the end of the period you already paid for. The 7-day trial is not charged if you cancel within it.

9. Minors

The service is not directed at anyone under 18 and we do not knowingly collect data from minors.

10. International transfers

Servers are located in the United States. If you write to us from the European Union or the United Kingdom, your data is processed there, and you still have the rights in section 6.

11. Changes

If we change something material, we update the date above and notify active subscribers by email before it takes effect.

Honest note. A lawyer did not write this. It is a faithful, verifiable description of what the system actually does, written to be understood. If you sell into the European Union, California, or several states at once, have a lawyer review it.

See the Terms of Service too →