Privacy Policy

This policy explains what personal data we process when you use EdgeFlow, why we process it, and the rights you have under the EU General Data Protection Regulation (GDPR), the California Consumer Privacy Act (CCPA/CPRA) and equivalent international privacy laws. EdgeFlow is operated by Mizznes BV (België), trading as EdgeFlow, and serves users worldwide.

1. Who we are

Data controller: Mizznes BV, Ransuildreef 16, 2900 Schoten, België. Company registration (KBO/BCE): 1026.527.343. VAT: BE 1026.527.343.

For all privacy matters, contact us at privacy@youredgeflow.com. No Data Protection Officer has been appointed; the controller acts through its statutory representative.

2. What we collect and why

2.1 Account data

Email address, hashed password, display name (optional), username (optional), timezone and language. If you arrived through an affiliate's link, which affiliate referred you. Legal basis: performance of contract (Art. 6(1)(b) GDPR).

2.2 Consent evidence

Timestamps and version identifiers for the age confirmation, Terms acceptance and Privacy acknowledgement given at signup — and, if applicable, marketing opt-in. Stored in an append-only consent_events record. We do not retain your IP address as consent evidence. For the e-book and discount-code forms (section 2.10) we keep a one-way code made from it, never the address itself. Legal basis: legal obligation (Art. 5(2), 7(1) GDPR — accountability).

2.3 Trading data

Trades you log, journal entries, screenshots, confluences, rules, trade plans, account balances and statistics. This is your data — we do not buy, sell, share or monetise individual trading data. Legal basis: performance of contract.

2.4 Billing data

Subscription status, plan, invoices and Stripe customer/subscription identifiers. We never see or store your full card number — Stripe processes payments. Legal basis: performance of contract and legal obligation (Belgian accounting law — 7-year invoice retention).

2.5 Technical data

Your country (a two-letter code) at signup. Our hosting provider, Vercel, works it out from your connection; we use it to enforce sanctions restrictions and to apply the right tax. Vercel also keeps short-lived request logs (which page was asked for, the result and the time), which can include the IP address of the connection.

EdgeFlow does not store your IP address with your account, your trades or your consent records. Our limits on repeated requests (for example on login attempts) hold it briefly in server memory, never in the database. Messages sent through the contact form keep a one-way code made from it, never the address itself, so we can see when many messages come from one place. To stop one person from taking many free trials, we keep the same kind of one-way code of your IP address when a trial starts, without your account or e-mail address next to it. It is deleted automatically after 24 hours. Legal basis: legitimate interest in keeping the service secure and working (Art. 6(1)(f) GDPR).

2.6 Communication

Messages you send us by email or through the contact form: your name, email address, topic and message, and the name of the browser you used (which helps us reproduce a problem). Legal basis: legitimate interest in answering you (Art. 6(1)(f) GDPR).

2.7 Marketing (optional)

If you opt in at signup or later in Settings, we send occasional product updates and offers. You can withdraw consent at any time (Settings → Email preferences, or the unsubscribe link in each marketing email). Legal basis: consent (Art. 6(1)(a) GDPR).

2.8 Waitlist

If you joined the waitlist before launch: your email address, the date you joined, and which form you used. If you arrived through one of our own advertisement links, we also keep what that link carried: the labels we wrote ourselves — which platform it was on and which advertisement it was, which describe the link and not you — and, if it was a paid advertisement, the identifier the advertising platform added to the link itself. That identifier belongs to your single click; the platform that issued it could connect it back to you, and we keep it only so we can tell which advertisement led to your entry. We send nothing back to the advertising platform, and none of this is stored on your device. We use it only to email you about EdgeFlow's launch and the launch offer. Every email has a one-click unsubscribe link. After you unsubscribe we keep the address marked as unsubscribed, so it is never emailed again; ask us and we delete it completely. Legal basis: consent, given when you joined (Art. 6(1)(a) GDPR).

2.9 Product analytics

We count every visit to the site. Your answer to the cookie banner does not decide whether we count, but it decides how much we may know about the visit, and it is a real difference.

Without your consent — whether you rejected or never answered — PostHog, hosted in the European Union, records which page was opened, where the link came from, and errors the app ran into. Nothing whatsoever is written to your device: no cookie, no browser storage, no identifier. Nothing is tied to your EdgeFlow account, even while you are logged in, and separate visits cannot be joined up into one person. Like any web service, PostHog receives the IP address your browser connects from. PostHog receives it on its own servers in the European Union; EdgeFlow itself never sees or stores it for this purpose, and we use it to count visits and pages, nothing else. Because nothing is kept on your device, a visit on another day cannot be joined to this one. Legal basis: legitimate interest in knowing how the site and product are used (Art. 6(1)(f) GDPR). Because nothing is read from or written to your device, the ePrivacy consent rule does not apply to this count. You can object at any time: privacy@youredgeflow.com.

If you accept analytics cookies, PostHog additionally stores a cookie and browser-storage items on your device, which give you a lasting identifier. With it we can see which features you use (for example: logging a trade, opening Edge Discovery, reaching the pricing page) as one continuing story, linked to your EdgeFlow user id, your plan, how many trading accounts you have and how many days ago you signed up. It never receives the content of your trades, notes or journal, and never your email address. Withdrawing your consent removes those items at once and puts you back to the count described above. Legal basis: consent (Art. 6(1)(a) GDPR).

Either way, if you arrived through a link we placed in an advertisement or a post, that link's labels travel with these events: the ones we wrote ourselves (which platform, which campaign, which version of the advertisement) and, on a paid advertisement, an identifier the advertising platform itself added to the link. That platform identifier is unique to your click, and the platform that issued it can connect it back to you — we do not, and we send nothing back to the platform. We read it out of the address of the page you arrived on; it is not stored on your device.

Separately, when our server itself hits an error, it sends PostHog the error message and the page it happened on, without your user id. Legal basis: legitimate interest in keeping the service working (Art. 6(1)(f) GDPR).

2.10 E-book and discount-code sign-ups

If you ask for our e-book or a discount code on the website: your e-mail address, which form you used and where on the site, the advertisement labels described in section 2.9 if you arrived through one of our links, the exact sentence you ticked with its version and the time, and a one-way code made from your IP address (never the address itself) as part of the proof of your consent. If you ask for a code, we also keep your personal code, its end date and whether it was used. Stripe holds the code itself; it receives an internal number, never your e-mail address.

We use this to send you what you asked for and the e-mails the sentence you ticked describes, each with a one-click unsubscribe link. If the same e-mail address also has an EdgeFlow account, we match the two so we stop sending these e-mails once you pay, do not send you the same code twice, and extend your code when you start a trial. Legal basis: consent (Art. 6(1)(a) GDPR); the matching and the proof of consent rely on our legitimate interest in sending only e-mails that are correct and wanted (Art. 6(1)(f) GDPR).

2.11 Free trial

If your account gets a free trial (Terms section 4A): your trial number, the start and end of the trial, how you used EdgeFlow during it (for example how many trades you logged and whether you set up your own checks), whether you paid afterwards, and your answer if you choose to tell us why you stopped. We use this to run the trial, to send you the trial e-mails (section 2.13) and to learn how to make EdgeFlow easier to start with. Legal basis: performance of contract (Art. 6(1)(b) GDPR) for running the trial; legitimate interest in improving the product (Art. 6(1)(f) GDPR) for the rest. Your answer to “What stopped you?” is optional.

2.12 The set-up call

If you book the free set-up call, our booking tool, Cal.com, receives your name, e-mail address, the answers you give on the booking form (the e-mail address of your EdgeFlow account, your strategy in one sentence and the journal you use now) and the time you pick. The call takes place on Google Meet or Zoom; the booking confirmation says which. The call is not recorded. Milo may take written notes during the call, for example about how you trade, what you find hard and which tools you have used, to help you set up EdgeFlow and to improve the product. We ask before we take notes, and we never ask for account balances or passwords. If we would like to quote you later, we ask you separately, in writing. Legal basis: performance of contract (the call is part of your trial) and legitimate interest in improving EdgeFlow (Art. 6(1)(b) and (f) GDPR).

2.13 The e-mails we send

• Account and payment e-mails: confirming your sign-up, payments, withdrawal, renewals, price changes, failed payments and security. You always get these while you have an account. Legal basis: performance of contract and legal obligation.
• Trial and tips e-mails: during a trial and in your first weeks as a customer, a few e-mails about using EdgeFlow, booking your set-up call, how your trial ends and what Pro costs. You can turn them off with one click in every one of them, or in Settings. Legal basis: legitimate interest (Art. 6(1)(f) GDPR) and, where it applies, the rule that lets a business e-mail its own customers about similar services as long as they can refuse at any time.
• Marketing e-mails: product updates and offers, only if you said yes (section 2.7) or, as a customer, about similar EdgeFlow services under the same rule. Every one has a one-click unsubscribe link. Legal basis: consent (Art. 6(1)(a) GDPR) or that same rule.

Every e-mail says who sends it: Mizznes BV, trading as EdgeFlow, Ransuildreef 16, 2900 Schoten, België.

3. AI features

Where you use an AI feature — Flow AI, and the written observations in features such as Risk Advisor and Behavioral Coach — we send the AI provider what that feature needs to answer: for Flow AI, the messages you type in the conversation; for the others, a structured summary of your trading (for example win rate, R results, results per system and per session, rule breaks). The provider is OpenAI (USA), reached either directly or through Emergent's LLM gateway (integrations.emergentagent.com, USA), depending on how the service is configured. AI output is probabilistic; it does not constitute an automated decision producing legal or similarly significant effects under GDPR Art. 22.

OpenAI's API terms say that data sent through its API is not used to train its models. Legal basis: performance of contract (a feature you chose to use).

4. Aggregated research use

We may use aggregated, anonymised data — never personally identifiable — for:

• Improving EdgeFlow's edge-discovery algorithms.
• Internal research into trading patterns and outcomes.
• Publishing aggregate insights where individuals cannot be re-identified.

Legal basis: legitimate interest (Art. 6(1)(f) GDPR). We never sell raw data. We never re-identify anonymised records.

Opt out: email privacy@youredgeflow.com with the subject “Research opt-out” and your trades are left out of every future aggregate. Opting out does not affect normal use of EdgeFlow.

5. Automated decision-making & profiling

EdgeFlow does not use your personal data to make automated decisions that produce legal or similarly significant effects on you (GDPR Art. 22). AI-generated insights are analytical output presented to you — they do not change your subscription, pricing or access rights automatically.

6. Sub-processors

Mizznes BV relies on the following processors, bound by contract and (where applicable) the European Commission's Standard Contractual Clauses for transfers outside the EEA:

• MongoDB Atlas — primary database. Hosting region: AWS eu-west-3 (Paris, EU).
• Vercel (USA) — hosts the website and runs our server code.
• Stripe (Ireland / USA) — payments and subscription management.
• Resend (USA) — sends our emails.
• OpenAI (USA) and Emergent (USA, LLM gateway) — AI features, as described in section 3.
• PostHog (EU hosting) — product analytics on every visit (cookieless unless you accept), and server error reports (section 2.9).
• Cal.com (USA, or the EU if we use cal.eu) — booking the set-up call (section 2.12).
• Google Meet or Zoom (USA) — the video call itself (section 2.12).

7. Sale and sharing of personal data

Mizznes BV does not sell your personal information and does not share it for cross-context behavioural advertising. There are no advertising cookies and no data-broker relationships. The only analytics tool is PostHog, which runs on our own account, in the European Union, and shares nothing with anyone (section 2.9).

8. How long we keep data

• Account & trading data: until you delete your account, then permanently erased — including waitlist and contact-form entries under the same email address.
• Invoices & billing records: 7 years (Belgian accounting law).
• Consent records: kept after you delete your account, to prove what you agreed to and that you asked for deletion. 3 years after that deletion they are no longer needed, and our next clean-up removes them. They hold your user id, the event, the version and the date — not your email address.
• Affiliate commission records: if an affiliate referred you, the record of their commission is kept for our accounts. It holds your user id, not your email address.
• Waitlist: until you unsubscribe; after that only the address marked as unsubscribed, until you ask us to delete it.
• Contact messages: until you delete your account or ask us to delete them.
• Product analytics in PostHog: for as long as we use them to improve the product. Events counted without your consent carry no identifier, so they cannot be traced back to you, found or removed individually. Deleting your account does not remove them from PostHog by itself; email privacy@youredgeflow.com and we delete them.
• Request logs at our hosting provider: only for the short period Vercel keeps them.
• E-book and discount-code sign-ups: until you unsubscribe or ask us to delete them. After you unsubscribe we keep only your address marked as unsubscribed, so we never e-mail it again, plus the proof of your consent for 3 years; ask us and we delete the address completely.
• Trial records: as long as your account exists; they are deleted with it.
• The one-way code used for the trial limit: 24 hours, then deleted automatically.
• Set-up call: booking data in Cal.com and Milo's notes for 12 months after the call, then deleted.
• Your answer to “What stopped you?”: as long as your account exists.
• Anonymised research data: indefinitely (cannot identify you).

9. Your rights (GDPR + worldwide)

• Access — request a copy of your data.
• Rectification — correct inaccurate data.
• Erasure — “right to be forgotten”.
• Restriction — limit how we process data.
• Portability — export your data in machine-readable format.
• Objection — opt out of research use or marketing emails.
• Withdraw consent — where processing is based on consent (marketing, cookies).
• Lodge a complaint — with the Belgian Data Protection Authority (gegevensbeschermingsautoriteit.be) or your local supervisory authority.

To exercise any right, email privacy@youredgeflow.com. We respond within one month. You can also delete your account yourself at any time in Settings.

10. California residents (CCPA / CPRA)

If you are a California resident, you have the additional rights to know the categories of personal information collected and shared, to correct inaccurate information, to delete personal information, and to be free from discrimination for exercising these rights. Because Mizznes BV does not sell or share personal information for cross-context behavioural advertising, no “Do Not Sell or Share” mechanism is required. Requests: privacy@youredgeflow.com.

11. Security

Passwords are hashed with bcrypt (10 salt rounds). Connections are HTTPS-only. Databases are encrypted at rest by MongoDB Atlas. Sessions use JSON Web Tokens with a 30-day expiry. We follow industry best practice, but no system is 100% secure. If a data breach puts you at risk, we tell you without undue delay, and we report it to the data protection authority within 72 hours, as the law requires.

12. Children

EdgeFlow is available only to persons aged 18 or older. We confirm this via a mandatory age checkbox at signup. We do not knowingly collect data from minors. If you believe we have, contact us immediately.

13. International transfers

Our database is stored in the European Union (AWS eu-west-3 (Paris, EU)). Some processors handle data in the United States: Vercel (which runs our server code), Stripe, Resend, OpenAI, Emergent, Cal.com (unless we use its EU service) and Google Meet or Zoom. These transfers rely on the European Commission's Standard Contractual Clauses (2021/914), or on the EU-US Data Privacy Framework where the provider is certified under it.

14. Changes to this policy

We will notify you of material changes by email at least 14 days before they take effect. Continued use after the effective date constitutes acceptance.