Privacy policy

1. Preamble

This privacy policy describes how Hyvirtus collects, processes and retains the personal data of its users, in compliance with the General Data Protection Regulation (GDPR, EU Regulation 2016/679) and the amended French Data Protection Act of 6 January 1978 (Loi Informatique et Libertés).

The data controller is Murat ERTURK, sole trader, whose full contact details appear in the legal notice. For any question or request regarding your personal data, you may write to contact@hyvirtus.com.

2. Data collected

Hyvirtus collects only the data necessary for the service to function. By category:

2.1 Account data

• Email address
• Unique user identifier (user_id), generated automatically on first save
• Account creation date

2.2 Trader profile

• Trading style (scalping, day, swing)
• Markets traded (forex, crypto, indices, commodities, other)
• Per-market sub-blocks (pairs, leverage, volumes, instrument type)
• Capital, operational plan, declared experience

2.3 Behavioral data

Hyvirtus records events related to the trader's practice:

• Daily Rituals (inner state, intention, pillar of the day, commitment)
• Journal entries (reflections, emotional state)
• Dojo Live sessions (trade events, inner states, doors crossed, Hyvirtus readings)
• Dojo training sessions (scenarios played, pillar verdicts)
• Analyses (introspection mode or CSV import)
• Timeline (session recaps, Hyvirtus readings)

2.4 Billing data

For subscription payment (via Stripe): billing email, subscription periods, amounts, Stripe customer identifier. No complete banking data is ever stored by Hyvirtus.

2.5 Technical data

• IP address (used only for security, not durably linked to your account)
• Browser user-agent
• Request timestamps

2.6 Audience-measurement data

Hyvirtus runs an in-house (first-party) audience-measurement system, with no cookie and no persistent identifier, hosted on its own infrastructure. No third-party tool (Google Analytics, Plausible, Fathom or any other) is used, and no audience-measurement data is shared with any third party. The only events recorded are a page view and a few steps of the sign-up journey (a click on a call-to-action button, the display of the subscription page, a login-code request).

For each event, the following data is kept:

• The event name, restricted to a closed list.
• An ephemeral visitor identifier, computed by hashing and renewed each day. Earlier days' values are deleted, which makes any correlation from one day to the next impossible by design.
• The country, derived from the IP address at country level only (two-letter code), with no city and no coordinates.
• The path of the page viewed, without query string or URL fragment.
• The hostname of the referring site (never the full path); internal references to Hyvirtus are emptied.
• The browser language (two letters) and the device type (mobile, tablet, desktop), derived from the browser window width.
• The event timestamp.

The following are never kept for this purpose: your IP address (used in memory for the hash and the country lookup, then immediately discarded), your user-agent, the city or any geographic coordinates, URL query parameters (a login-link token therefore cannot appear there), the path of the referring site, and any behavioral data or data relating to your trading practice (pillar, pattern, Hyvirtus text, session content), blocked by the closed list of events.

Country-level geolocation relies on the DB-IP Country Lite database, read locally (IP Geolocation by DB-IP, under CC BY 4.0 licence). This measurement sets no cookie and writes nothing to your device. You may object at any time: see section 8 (Your rights).

2.7 Newsletter data

If you subscribe to the Hyvirtus newsletter, your email address is recorded, along with the timestamp and IP address evidencing your consent, as proof. Consent is collected depending on where you sign up: from the public site, on a double opt-in basis (nothing is sent until you confirm through the link received by email); from your signed-in space, where your address has already been verified at login, by explicit opt-in (one click), with no confirmation email. The list is hosted on Hyvirtus infrastructure; email delivery is handled by our sending provider (Resend). Every message includes an unsubscribe link, and you can unsubscribe at any time, which ends the processing. Legal basis: your consent (Article 6.1.a GDPR). Retention: until you unsubscribe.

2.8 Trading psychology test data

When you use the free trading psychology test and choose to leave your email address, Hyvirtus stores your email address and the behavioural trap the test found in your answers (one of five traps, plus your most exposed pillar), along with the timestamp and IP address evidencing your consent, as proof. These form a profile inferred from your declared answers, used to send you Hyvirtus content tailored to your result, starting with a detailed reading email of the trap found, sent after your subscription is confirmed. Consent is collected through a form with no checkbox: the notice shown next to the button names the purpose, the email address and result kept, and the right to withdraw, and clicking Get my reading constitutes acceptance; it is then confirmed by a validation email (double opt-in); the list is hosted on Hyvirtus infrastructure and email delivery is handled by our sending provider (Resend). This is profiling within the meaning of Article 4.4 GDPR; it leads to no automated decision producing legal or similarly significant effects (Article 22 does not apply). Legal basis: your consent (Article 6.1.a GDPR). You can withdraw your consent and object at any time (Articles 7.3 and 21 GDPR) through the unsubscribe link in every email: your email address and this profile are then deleted from the list. Never kept for this purpose: your test answers or the computed scores, only the email, the trap, the pillar and the proof of consent. Retention: three years from your last contact, or until you unsubscribe.

3. Purposes of processing

Each category of data corresponds to a clear purpose:

• Account: enable access to the service and identification of the user.
• Trader profile: adapt the context provided to Hyvirtus so it can produce relevant readings. Important: the profile never dictates the state of a pillar or the pattern of a behavior. Hyvirtus observes behaviors and never infers a state from the declared profile.
• Behavioral data: produce session readings, closing readings, timeline readings and aggregated progress statistics.
• Billing: perform the subscription contract and meet accounting obligations.
• Technical data: ensure the security of the service, prevent fraud, diagnose incidents.
• Audience measurement: measure site traffic in an aggregated way, with no persistent identifier and no individual profiling (visitors, page views, traffic sources, languages, countries, device types), follow the steps of the sign-up journey, and steer the site. No advertising.
• Internal product-improvement statistics: from behavioral data already stored, the publisher produces monthly aggregated and anonymous readouts (counters only, with no identifier and no per-user row) about how the user base behaves (dominant patterns, most-used doors, scores and practice intensity), for the sole purpose of improving the product. These readouts cannot be traced back to a user.
• Newsletter: send you the Hyvirtus newsletter, only if you have consented (double opt-in from the site, or explicit opt-in from your signed-in space).
• Trading psychology test: send you Hyvirtus content tailored to the behavioural trap the test found, only if you have consented.

4. Legal basis for processing

In accordance with Article 6 of the GDPR, the legal bases relied upon by Hyvirtus are as follows:

• Account, trader profile, behavioral data, Hyvirtus personalization: performance of the contract (Article 6.1.b GDPR) to which the user is a party.
• Billing: performance of the contract and legal obligation (Articles 6.1.b and 6.1.c GDPR), in particular accounting and tax obligations.
• Technical security data: legitimate interest (Article 6.1.f GDPR) of the publisher in protecting its service against abusive use.
• Audience measurement: legitimate interest (Article 6.1.f GDPR) of the publisher in understanding the traffic to its site. As the measurement uses no cookie, no persistent identifier, no correlation from one day to the next and no individual profiling, its impact on privacy is minimal.
• Internal product-improvement statistics: legitimate interest (Article 6.1.f GDPR) of the publisher in improving its service. As the readouts are aggregated and anonymous (counters only, with no identifier and no individual profiling), their impact on privacy is minimal.
• Newsletter: consent (Article 6.1.a GDPR), which can be withdrawn at any time by unsubscribing.
• Trading psychology test: consent (Article 6.1.a GDPR), which can be withdrawn at any time by unsubscribing; the inferred profile is then deleted. Profiling within the meaning of Article 4.4, with no automated decision (Article 22 does not apply).

5. Retention periods

• Active account: for as long as the account exists.
• After account deletion: directly identifying personal data (email, user_id, trader profile) is erased within thirty days. Behavioral data may be retained beyond that point only after irreversible anonymization within the meaning of Article 29 Working Party opinion WP29 5/2014, for the sole purpose of aggregated statistics on the use of the service. Any information allowing an identified or identifiable user to be traced is deleted at this stage.
• Billing data: ten years from the close of the financial year, pursuant to Article L123-22 of the French Commercial Code.
• Technical logs: twelve months maximum, in accordance with the CNIL recommendations on security and connection logs.
• Audience-measurement data: four hundred days maximum, after which the event logs are deleted.
• Newsletter data: until you unsubscribe; the email and the proof of consent are then deleted.
• Trading psychology test data: three years from your last contact, or until you unsubscribe; the email address, the inferred profile and the proof of consent are then deleted.

6. Recipients of the data

Hyvirtus does not sell, rent or share its user data for advertising purposes. The only recipients of the data are:

• The publisher itself, in its capacity as data controller.
• The technical processors strictly necessary for the service to function:
  • The host of the site and infrastructure (see legal notice).
  • Stripe Payments, when the subscription opens, for payment processing (PCI-DSS certified processor).

Each processor is bound by a contract compliant with Article 28 of the GDPR.

7. Data transfers outside the European Union

Technical hosting of the site is provided by a supplier whose servers and main establishment may be located in the United States. A transfer of data from the European Union to the United States therefore takes place at this level.

These transfers are governed by one of the mechanisms provided for in Chapter V of the GDPR:

• The processor's adherence to the Data Privacy Framework between the European Union and the United States (adequacy decision of the European Commission of 10 July 2023), where applicable.
• Failing that, the implementation of Standard Contractual Clauses adopted by the European Commission.

The user may obtain, on simple request to contact@hyvirtus.com, a copy of the safeguards applicable to the transfer.

8. Your rights

In accordance with Articles 15 to 22 of the GDPR, you have at all times the following rights over your personal data:

• Right of access: obtain confirmation that your data is being processed and receive a copy of it.
• Right to rectification: correct any inaccurate or incomplete data.
• Right to erasure ("right to be forgotten"): request the deletion of your data in the cases provided for by the GDPR.
• Right to object: object, on grounds relating to your particular situation, to processing based on legitimate interest. For audience measurement, you can object immediately by activating the opt-out option in your browser (the hvts_analytics_optout key in local storage); while it is active, no further event is sent.
• Right to portability: receive your data in a structured, commonly used and machine-readable format, and transmit it to another data controller.
• Right to restriction: request the restriction of processing in the cases provided for by the GDPR.
• Right to withdraw your consent at any time when processing is based on it, without this withdrawal affecting the lawfulness of prior processing.
• Right to lodge a complaint with the French Data Protection Authority (CNIL, www.cnil.fr) if you consider that the processing of your data does not comply with the regulations.

To exercise your rights, write to contact@hyvirtus.com. A response will be provided within one month of receipt of your request, in accordance with Article 12 of the GDPR. This period may be extended by two months in the case of a complex request, in which case you will be informed of the reason for the extension.

Proof of identity may be requested in the event of reasonable doubt about your identity.

9. Security

Hyvirtus implements appropriate technical and organizational measures to ensure a level of security suited to the risk, in particular:

• Encryption of exchanges in transit via the HTTPS / TLS protocol.
• Isolation of user data by unique identifier on the server side.
• Restriction of access to the data to the data controller alone.
• Regular data backups and restoration tests.

In the event of a personal data breach likely to create a risk to your rights and freedoms, you will be informed in accordance with Articles 33 and 34 of the GDPR.

10. Automated decisions and profiling

The Hyvirtus service relies on automated processing of your behavioral data by Hyvirtus, in order to produce session, closing and timeline readings. This processing analyzes your entries (Ritual, Journal, Dojo Live sessions, trade events) to render a structured reading built around the six pillars and the authorized patterns.

In accordance with Article 22 of the GDPR, it is specified that this automated processing produces no legal decision concerning you nor any effect that similarly significantly affects you. Hyvirtus observes, reads, structures and reveals behavioral elements. It makes no decision on your behalf, triggers no action on the markets, and has no bearing on access to any right, service or benefit outside Hyvirtus.

You remain at all times the sole decision-maker over your practice and your trading operations.

11. Cookies and trackers

The Hyvirtus site uses no audience-measurement cookie, no advertising pixel and no third-party cookie. The audience measurement described in section 2.6 works without any cookie. The use of strictly necessary cookies and of any trackers is governed by a dedicated policy. See the cookie policy.

12. Updates to the policy

This policy may change to reflect changes in how the service operates, in legislation, or in the providers involved. Any substantial change will be notified by email to users with an active account, at least thirty days before it takes effect.

The date of the last update appears at the top of the document.