Privacy Policy & Data Protection
Last updated: September 2026 • Compliant with EU GDPR & ePrivacy Directive
We do not sell your personal data, track your browsing behavior across the web, or embed third-party advertising scripts. We only collect the minimum information required to deliver the email alerts and passwordless sign-in you explicitly request.
1. Information We Collect
Drawdown Tracker practices strict data minimization. We only collect and store:
Provided when requesting alerts or signing in. Requires double opt-in verification for dormant subscriptions.
Optional personal notes or reminders attached to your alert rules (up to 300 characters, sanitized against control codes).
Pseudonymized Network Identifiers: To protect the service from automated abuse and denial-of-service attacks, we do not store raw IP addresses. Client network identifiers are transformed using non-reversible one-way cryptographic hashing before storage. This prevents personal identification while allowing our security filters to protect service availability.
2. Legal Basis for Processing (GDPR Article 6)
Under the EU General Data Protection Regulation (GDPR), we process your information under the following lawful bases:
- Consent (Art. 6(1)(a)): When you enter your email to subscribe to an alert, you explicitly opt in. Dormant alerts remain unverified until confirmed via magic link.
- Performance of a Contract (Art. 6(1)(b)): To manage your notifications, generate verification links, and dispatch drawdown alert emails as requested.
- Legitimate Interests (Art. 6(1)(f)): To safeguard infrastructure integrity and prevent automated abuse and spamming through rate-limiting controls.
3. Cookies & Tracking Policy
We use a single strictly functional authentication cookie to keep you securely signed in when accessing your alert management dashboard. This cookie contains a signed session token, is transmitted exclusively over encrypted HTTPS connections, and is inaccessible to third-party scripts or ad networks.
Because we do not use marketing, tracking, or profiling cookies, no cookie consent banner is legally required under Article 5(3) of the EU ePrivacy Directive.
4. Sub-processors & Cloud Infrastructure
We partner only with reputable cloud infrastructure providers to operate the service:
- Database Infrastructure: Managed cloud database provider (Supabase) used to securely store instrument catalog data, your verified subscriptions, and abuse-prevention hashes.
- Transactional Email Service: Cloud email delivery provider (Resend) utilized to securely dispatch magic link sign-in emails and drawdown notifications.
5. Data Retention & Right to Erasure
You maintain complete control over your personal data at all times with built-in self-service tools:
- Self-Service Right to Erasure (GDPR Art. 17): You can permanently delete your entire account, email address, all active/paused alert rules, and personal notes at any time with a single click in the Dashboard. This action instantaneously purges your records from our database and invalidates all session cookies.
- Self-Service Data Portability & Access (GDPR Art. 15 & 20): You can download a complete, machine-readable JSON export of all personal data held in connection with your account directly from your dashboard.
- One-Click Unsubscribe: Every alert email contains a secure, one-click unsubscribe link that immediately disables notifications without requiring you to log in.
- Selective Alert Management: You can pause, resume, or delete individual alert rules and customize or clear your notes at any time.
- Automated Security & Token Hygiene: Temporary authentication tokens and rate-limiting security records are automatically pruned and deleted on a rolling schedule.
6. Your Rights Under GDPR & UK Data Protection
If you reside in the European Economic Area (EEA), the United Kingdom, or jurisdictions with equivalent privacy regulations, you are entitled to exercise statutory data protection rights:
- Right of access (Art. 15): Request confirmation and inspect the data processed about you.
- Right to rectification (Art. 16): Update or correct your personal notes and preferences.
- Right to erasure / “Right to be forgotten” (Art. 17): Permanently delete your account and personal records.
- Right to restriction of processing (Art. 18): Pause active alerts or suspend processing.
- Right to data portability (Art. 20): Receive your personal data in a structured, machine-readable JSON format.
- Right to withdraw consent (Art. 7(3)): Unsubscribe or cancel alerts at any time with immediate effect.
You can exercise both your Right to Erasure and Right to Data Portability directly and instantly through the Dashboard. For any questions, data requests, or specific regulatory inquiries, please reach out via our contact form.