Privacy policy

1. Who looks after your data

Actal is run by Jusell Enterprises (business ID 3309064-7), in Finland. We are the controller of the personal data described here. Questions, requests and complaints go to hello@actal.io.

2. What we store

Your account:

• Your email address, the display name you choose, your timezone and your settings.
• Your password, stored only as a secure hash by our sign-in provider. If you sign in with Google, we get your Google account's email and name instead.

What you put into Actal:

• The trades and fills you import or type in, the files you import, and your accounts with their names, sizes and commissions.
• Your reviews, grades, notes, tags, mistakes, plans, journal entries, rules, ideas and the pictures and screenshots you add.
• Feedback you send us, with any pictures you attach.

Actal Recorder, the Windows app that comes with Pro+:

• It records only the windows you choose, on your own PC. The footage stays on your PC and is deleted there after the number of days you set (3 by default).
• When you import trades, the screenshots and clips it cuts for those trades are uploaded and show up in your journal. Nothing else from the footage leaves your PC.
• It tells Actal your PC's name and which stretches of time it has footage for (times only, no pictures), so a trade can offer a clip that's still on your PC.

Payments:

• Paid plans are sold through Stripe's Link service, which takes the payment and handles tax and receipts. We never see or store your card number.
• We store your Stripe customer ID, which plan you have, its status and when it renews or ends.

How Actal is used:

• Vercel Web Analytics counts visits and shows which pages and steps people use, such as signing up or importing a file. It runs without cookies and doesn't recognise you from one day to the next.
• Our hosting keeps short-lived server logs with IP addresses, browser and time of each request, for security and to fix problems.

3. What other people can see

• Your journal is private. Nobody else sees it unless you share it.
• Friends and groups you join see what you choose to share with them, as the friends and groups settings show.
• A public trade card you create can be opened by anyone who has its link, until you remove it.

4. Why we use it

• To run Actal for you: your account, your journal, imports, stats, the recorder's pictures and clips, and support. The legal basis is our contract with you.
• To take payment for paid plans and keep the records the law asks for. The legal basis is our contract with you and our legal obligations.
• To keep Actal secure and fix what breaks. The legal basis is our legitimate interest in a working, safe service.
• To understand how Actal is used and make it better. The legal basis is our legitimate interest.
• To email you about your account, such as confirmations, password resets, replies to your feedback and important changes to Actal or these terms.

We don't sell your data and we don't use it for advertising.

5. Who helps us run Actal

These companies process data for us, only to do their part:

• Supabase: our database, sign-in and file storage. Your journal is stored on its servers in London, UK.
• Vercel: hosts the website and counts visits. The parts that read your data run in London; the site is served from its worldwide network.
• Stripe and its Link service: payments, tax and receipts for paid plans.
• Google: sign-in with Google, if you use it.
• Namecheap: our hello@actal.io mailbox, for when you email us.

6. Data outside the EU

Your journal is stored in the UK, which the EU recognises as protecting personal data to its standard. Vercel, Stripe and Google are US companies; where they handle personal data in the US, it is covered by the EU-US Data Privacy Framework or the EU's standard contractual clauses.

7. Cookies

Actal sets only the cookies it needs to work:

• Sign-in cookies that keep you signed in.
• actal_plans_seen: remembers that you've seen the plans pop-up, so it shows only once.
• actal_gs_dismissed: remembers that you closed the getting-started guide.
• actal_confirm_email: used while you confirm your email address.
• actal_ga_events: briefly holds a sign-up or import so analytics can count it.

None of them follow you around the web, and there are no advertising cookies. Counting visits uses no cookies.

8. How long we keep it

• Your account and journal: for as long as you have an account. Moving to the Free plan deletes nothing.
• When you ask us to delete your account, we delete it and everything in it within 30 days. Backups roll over within 7 more days.
• Billing records: as long as accounting law requires.
• Server logs: a few days to a few weeks, as our hosting providers keep them.
• Recorder footage never reaches us. It's deleted on your PC after the days you set.

9. Your rights

You can ask to see the data we have about you, get a copy of your journal to take elsewhere, correct it, delete it, or object to or limit how we use it. Email hello@actal.io from your account's address and we answer within a month.

If you think we got it wrong, you can complain to the Finnish Data Protection Ombudsman at tietosuoja.fi, or to the data protection authority where you live.

10. Age

Actal is for adults. Don't use it if you are under 18.

11. Changes to this policy

When we change this policy we update the date at the top. If a change matters for how we use your data, we tell you by email or in Actal before it applies.