Privacy policy

1. Preamble

This privacy policy describes how Hyvirtus collects, processes and retains the personal data of its users, in compliance with the General Data Protection Regulation (GDPR, EU Regulation 2016/679) and the amended French Data Protection Act of 6 January 1978 (Loi Informatique et Libertés).

The data controller is Murat ERTURK, sole trader, whose full contact details appear in the legal notice. For any question or request regarding your personal data, you may write to contact@hyvirtus.com.

Hyvirtus is reserved for organizations that equip traders. You reach it through a seat opened by your organization: section 2.11 says what is kept of that link, and what your organization receives.

2. Data collected

Hyvirtus collects only the data necessary for the service to function. By category:

2.1 Account data

• Email address
• Unique user identifier (user_id), generated automatically on first save
• Account creation date and time
• The day of your last sign-in (the date, without the time)

2.2 Trader profile

• Trading style (scalping, day, swing)
• Markets traded (forex, crypto, indices, commodities, other)
• Per-market sub-blocks (pairs, leverage, volumes, instrument type)
• Capital, operational plan, declared experience

2.3 Behavioral data

Hyvirtus records events related to the trader's practice:

• Daily Rituals (inner state, intention, pillar of the day, commitment)
• Journal entries (reflections, emotional state)
• Dojo Live sessions (trade events, inner states, doors crossed, Hyvirtus readings)
• Dojo training sessions (scenarios played, pillar verdicts)
• Analyses (introspection mode or CSV import)
• Timeline (session recaps, Hyvirtus readings)

If what you write in your Journal, an Analysis, the intention of your Ritual or your feeling after a session says you are going through a very hard time, the application shows you the number of a helpline. This check runs on our server, against a list of words, and goes through no provider. It is neither kept nor passed on to anyone: not to the publisher, not to your organization, not to a trainer.

2.4 Billing data

Hyvirtus is no longer sold to individuals: no payment is asked of a user, and no banking data is collected from them. The organization that opens seats is invoiced directly by the publisher; its invoices carry the name and business contact details of its contact person.

2.5 Technical data

• IP address (used only for security, not durably linked to your account)
• Browser user-agent
• Request timestamps

2.6 Audience-measurement data

Hyvirtus runs an in-house (first-party) audience-measurement system, with no cookie and no persistent identifier, hosted on its own infrastructure. No third-party tool (Google Analytics, Plausible, Fathom or any other) is used, and no audience-measurement data is shared with any third party. The only events recorded are a page view on the public site and a click on its main button. The application sends no measurement event.

For each event, the following data is kept:

• The event name, restricted to a closed list.
• An ephemeral visitor identifier, computed by hashing and renewed each day. Earlier days' values are deleted, which makes any correlation from one day to the next impossible by design.
• The country, derived from the IP address at country level only (two-letter code), with no city and no coordinates.
• The path of the page viewed, without query string or URL fragment.
• The hostname of the referring site (never the full path); internal references to Hyvirtus are emptied.
• The browser language (two letters) and the device type (mobile, tablet, desktop), derived from the browser window width.
• The event timestamp.

The following are never kept for this purpose: your IP address (used in memory for the hash and the country lookup, then immediately discarded), your user-agent, the city or any geographic coordinates, URL query parameters (a login-link token therefore cannot appear there), the path of the referring site, and any behavioral data or data relating to your trading practice (pillar, pattern, Hyvirtus text, session content), blocked by the closed list of events.

Country-level geolocation relies on the DB-IP Country Lite database, read locally (IP Geolocation by DB-IP, under CC BY 4.0 licence). This measurement sets no cookie and writes nothing to your device. You may object at any time: see section 8 (Your rights).

2.7 Newsletter data

If you subscribe to the Hyvirtus newsletter, your email address is recorded, along with the timestamp and IP address evidencing your consent, as proof. Consent is collected depending on where you sign up: from the public site, when a form is offered there, on a double opt-in basis (nothing is sent until you confirm through the link received by email); from your signed-in space, where your address has already been verified at login, by explicit opt-in (one click), with no confirmation email. The list is hosted on Hyvirtus infrastructure; email delivery is handled by our sending provider (Resend). Every message includes an unsubscribe link, and you can unsubscribe at any time, which ends the processing. Legal basis: your consent (Article 6.1.a GDPR). Retention: until you unsubscribe.

2.8 Trading psychology test data

The trading psychology test is closed: no address is collected this way any more, and no further content is sent on this basis, apart from the reading promised to those who had asked for it before it closed. What follows describes the processing of the addresses given before that closure. When you use the free trading psychology test and choose to leave your email address, Hyvirtus stores your email address and the behavioural trap the test found in your answers (one of five traps, plus your most exposed pillar), along with the timestamp and IP address evidencing your consent, as proof. These form a profile inferred from your declared answers, used to send you Hyvirtus content tailored to your result, starting with a detailed reading email of the trap found, sent after your subscription is confirmed. Consent is collected through a form with no checkbox: the notice shown next to the button names the purpose, the email address and result kept, and the right to withdraw, and clicking Get my reading constitutes acceptance; it is then confirmed by a validation email (double opt-in); the list is hosted on Hyvirtus infrastructure and email delivery is handled by our sending provider (Resend). This is profiling within the meaning of Article 4.4 GDPR; it leads to no automated decision producing legal or similarly significant effects (Article 22 does not apply). Legal basis: your consent (Article 6.1.a GDPR). You can withdraw your consent and object at any time (Articles 7.3 and 21 GDPR) through the unsubscribe link in every email: your email address and this profile are then deleted from the list. Never kept for this purpose: your test answers or the computed scores, only the email, the trap, the pillar and the proof of consent. Retention: three years from your last contact, or until you unsubscribe.

2.9 Business contact data

When you send a request through the contact form on the business surface, Hyvirtus stores the information you enter: your name, your work email address, your company name, the kind of organisation you represent, the rough number of traders concerned and the free text message you write, along with the timestamp and IP address evidencing your consent, as proof. This information is used only to answer your request and to prepare the conversation that follows; it is stored on Hyvirtus infrastructure and sent by email to the publisher, delivery being handled by our sending provider (Resend). Consent is collected through a form with no checkbox: the notice shown above the button names the purpose and the right to deletion, and clicking Send constitutes acceptance. This information is never matched against behavioural data, and no trading practice data enters this record. Legal basis: your consent (Article 6.1.a GDPR). You can withdraw your consent and ask for deletion at any time (Articles 7.3 and 17 GDPR) by writing to contact@hyvirtus.com. Retention: three years from your request, or until you ask for deletion.

2.10 Sharing with a trainer

From your Settings, you can give a trainer or a trading education organization read access to part of your practice, with the trainer code they gave you. Nothing is shared unless you take this step: the confirmation screen names the trainer, lists what they will see and what they will never see, and sharing only starts once you confirm. Declining changes nothing about your access to the service.

The trainer reads what Hyvirtus has read of your practice: your Dojo Live sessions, your Dojo Live trade closes, your Dojo exercises, your Weekly Audits and your Monthly Reports, across all your trading profiles, archived ones included, whatever their date. They never see your Journal, your Analyses, your Ritual, the free notes you add to a trade, a session or an exercise, your email address or the names of your profiles. They see you under the name you choose when you share, prefilled with the first part of your email address, which you can change. They read and nothing else: they cannot start anything from your space, and every reading goes through the service, which then checks your authorization.

For each authorization, Hyvirtus keeps the trainer concerned, the name you appear under, the date and time, the version of the confirmation text you accepted and the shared categories, as proof of your consent. If you are a trainer yourself, Hyvirtus keeps the name you appear under, your trainer code and the list of the access opened to you; your name is shown only to the people who enter your code.

2.11 Your organization and your seat

You reach Hyvirtus through a seat opened by your organization (your school, the firm that funds you or your broker), with the code it gave you. Hyvirtus keeps the link between your account and that organization: which one, the date and time you took the seat, and the version of the information text you read before confirming. This link says that you are a student or a trader of that organization; it stays for as long as your account exists, or until you leave the organization or take a seat elsewhere.

While you hold a seat, Hyvirtus also notes the days on which you practice. It keeps one date for each day on which you did at least one of these: validate a Ritual, open or close a position in Dojo Live, signal a state or an action there, write in the Journal, resolve a Dojo situation, launch an Analysis. Nothing else is noted on this basis: neither the time, nor what you did, nor what you wrote. Opening the application, reading your Timeline or an audit does not count.

From those days, your organization receives numbers about all its traders together, and nothing else: how many seats are open, how many are taken, how many were used in the last thirty days, the average number of practice days per week and per active trader, and the share of traders still practicing thirty, sixty and ninety days after taking their seat. It reads them in its space, frozen on the last day of each month and on the last day of the cohort: a frozen report never changes, and no number is given day by day. These numbers never describe fewer than five people: below five seats taken, it receives only the number of seats taken. It never receives your name, your email address, what you write, what Hyvirtus reads of your practice, or your results, and it does not know who entered its code.

You can object to this counting at any time: leaving your organization, from your Settings, erases your practice days at once and closes your access. They are also erased if you take a seat in another organization, and with your account.

2.12 The name of an organization given on the site

On the site's home page, a trader can write the name of their school, of the firm that funds them or of their broker. Hyvirtus keeps that name as it was first written, the number of times it was given, and the date and time of the first and of the last time. Nothing is kept of the person who writes it: neither their name, nor their email address, nor their browser. Their IP address is used only to limit the number of submissions, in memory, for one hour; it is not recorded. The field is meant for the name of an organization: an email address or a number is refused there. If the name written is that of a person, an independent trainer for example, it is removed on simple request to contact@hyvirtus.com.

2.13 The people who read an organization's space

A client organization can name, in its contract with the publisher, up to five people per cohort who read its space: its cohorts, its seats, the numbers described in section 2.11, and its traders' code, which they can change. If you are one of these people, Hyvirtus keeps your email address, the cohorts it gives access to and the date the publisher registered it there, as well as the sign-in sessions of your account. Each new code you create leaves a trace (your address, the organization, the date and time, never the code), and the publisher is notified by email. Your address is used only to open the space to you and to write to you about it. The space never shows you a trader's name, address or practice.

3. Purposes of processing

Each category of data corresponds to a clear purpose:

• Account: enable access to the service and identification of the user.
• Trader profile: adapt the context provided to Hyvirtus so it can produce relevant readings. Important: the profile never dictates the state of a pillar or the pattern of a behavior. Hyvirtus observes behaviors and never infers a state from the declared profile.
• Behavioral data: produce session readings, closing readings, timeline readings and aggregated progress statistics.
• Invoicing of organizations: issue the invoices of client organizations and meet accounting obligations.
• Technical data: ensure the security of the service, prevent fraud, diagnose incidents.
• Audience measurement: measure site traffic in an aggregated way, with no persistent identifier and no individual profiling (visitors, page views, traffic sources, languages, countries, device types), count clicks on the site's main button, and steer the site. No advertising.
• Internal product-improvement statistics: from behavioral data already stored, the publisher produces monthly aggregated and anonymous readouts (counters only, with no identifier and no per-user row) about how the user base behaves (dominant patterns, most-used doors, scores and practice intensity), for the sole purpose of improving the product. These readouts cannot be traced back to a user.
• Newsletter: send you the Hyvirtus newsletter, only if you have consented (double opt-in from the site, or explicit opt-in from your signed-in space).
• Trading psychology test: send you Hyvirtus content tailored to the behavioural trap the test found, only if you have consented.
• Business contact: answer a request sent from the business surface and prepare the conversation that follows. No matching against behavioural data.
• Sharing with a trainer: letting the trainer you authorize read what Hyvirtus has read of your practice, in the categories shown when you confirm, and keeping proof of your agreement. Only if you have decided to.
• Organization and seat: opening the access your organization pays for, and showing it through overall numbers that its seats are in use (section 2.11).
• Organization space: opening the reading of its space to the people it names only, and letting the publisher know when one of them changes a code (section 2.13).
• Last sign-in: knowing since when an account has not been used, in order to apply the retention period of section 5.
• Name of an organization given on the site: knowing which organizations to approach.

4. Legal basis for processing

In accordance with Article 6 of the GDPR, the legal bases relied upon by Hyvirtus are as follows:

• Account, trader profile, behavioral data, Hyvirtus personalization: performance of the contract (Article 6.1.b GDPR) to which the user is a party.
• Invoicing of organizations: legal obligation (Article 6.1.c GDPR), in particular accounting and tax obligations, and legitimate interest (Article 6.1.f GDPR) of the publisher in managing the relationship with its clients.
• Technical security data: legitimate interest (Article 6.1.f GDPR) of the publisher in protecting its service against abusive use.
• Audience measurement: legitimate interest (Article 6.1.f GDPR) of the publisher in understanding the traffic to its site. As the measurement uses no cookie, no persistent identifier, no correlation from one day to the next and no individual profiling, its impact on privacy is minimal.
• Internal product-improvement statistics: legitimate interest (Article 6.1.f GDPR) of the publisher in improving its service. As the readouts are aggregated and anonymous (counters only, with no identifier and no individual profiling), their impact on privacy is minimal.
• Newsletter: consent (Article 6.1.a GDPR), which can be withdrawn at any time by unsubscribing.
• Trading psychology test: consent (Article 6.1.a GDPR), which can be withdrawn at any time by unsubscribing; the inferred profile is then deleted. Profiling within the meaning of Article 4.4, with no automated decision (Article 22 does not apply).
• Business contact: consent (Article 6.1.a GDPR), which can be withdrawn at any time; the request and the proof of consent are then deleted.
• Sharing with a trainer: consent (Article 6.1.a GDPR), which you can withdraw at any time, in one click, from your Settings ("Take the key back"); the trainer's access is then cut immediately, past readings included, and the authorization is erased. Withdrawal does not affect the lawfulness of readings made before it. For trainers, keeping their code and the list of their access: performance of the contract (Article 6.1.b GDPR).
• Link with your organization: performance of the contract (Article 6.1.b GDPR), since this link is what opens your access.
• Practice days and numbers given to your organization: legitimate interest (Article 6.1.f GDPR) of your organization in knowing that the seats it pays for are in use, and of the publisher in showing it. Only dates are kept, only overall numbers are given, never for fewer than five people, and you can object by leaving your organization (section 2.11).
• Address of the people who read an organization's space: legitimate interest (Article 6.1.f GDPR) of the publisher and of that organization in performing the contract between them, by opening the space to the people it names only (section 2.13).
• Day of the last sign-in: legitimate interest (Article 6.1.f GDPR) of the publisher in not keeping without limit the data of an account that is no longer used.
• Name of an organization given on the site: legitimate interest (Article 6.1.f GDPR) of the publisher in knowing which organizations to approach. Nothing is kept of the person who writes that name.

5. Retention periods

• Account: for as long as the account exists. An account left two years without a sign-in is deleted, with all its data, after a notice email that gives you time to object by signing in again. The end of a seat does not delete the account: your data stays, and a new code opens everything again.
• After account deletion: directly identifying personal data (email, user_id, trader profile) is erased from the service upon deletion, then from the off-site backups as they rotate (below). Behavioral data may be retained beyond that point only after irreversible anonymization within the meaning of Article 29 Working Party opinion WP29 5/2014, for the sole purpose of aggregated statistics on the use of the service. Any information allowing an identified or identifiable user to be traced is deleted at this stage.
• Off-site backups: all of the service's data is backed up every day, and only the thirty most recent backups are kept. Data erased from the service therefore disappears from the backups after thirty daily backups, that is thirty days; each day on which the backup fails extends this period by one day.
• Invoices of organizations: ten years from the close of the financial year, pursuant to Article L123-22 of the French Commercial Code.
• Former subscriptions: Hyvirtus was offered by subscription to individuals before being reserved for organizations. If an account subscribed on that basis, the proof of that contract (dates, plan, amount paid, acceptance of the terms of sale) is kept ten years after the end of the contract where it concerns 120 euros or more, and five years in other cases, in a separate archive where the email address appears only in hashed form, with no practice or profile data. When the period ends, it is deleted automatically.
• Technical logs: twelve months maximum, in accordance with the CNIL recommendations on security and connection logs.
• Audience-measurement data: four hundred days maximum, after which the event logs are deleted.
• Newsletter data: until you unsubscribe; the email and the proof of consent are then deleted.
• Trading psychology test data: three years from your last contact, or until you unsubscribe; the email address, the inferred profile and the proof of consent are then deleted.
• Business contact data: three years from your request, or until you ask for deletion; the request and the proof of consent are then deleted.
• Sharing with a trainer: the authorization and its proof are kept until you take the key back, or until your account or the trainer's account is deleted.
• Link with your organization: for as long as your account exists, or until you leave the organization or take a seat elsewhere.
• Practice days: for as long as you hold the seat and, after it ends, until you leave the organization, take a seat elsewhere or your account is deleted. Only the four hundred most recent practice days are kept.
• Address of a person who reads an organization's space: for as long as it is on that organization's list. The publisher removes it at the request of the organization or of the person, and with the account. The trace of a new code stays in the publisher's log of actions; the address is erased from it with the account.
• Day of the last sign-in: for as long as the account exists; each sign-in replaces the previous day.
• Name of an organization given on the site: three years after the last time that name was given.

6. Recipients of the data

Hyvirtus does not sell, rent or share its user data for advertising purposes. The only recipients of the data are:

• The publisher itself, in its capacity as data controller.
• The technical processors strictly necessary for the service to function:
  • Render, host of the backend and of your application data, whose servers are located in the Frankfurt region, within the European Union.
  • Vercel, host of the site and of the application (see legal notice).
  • OpenAI Ireland Ltd, for the automated processing that produces your readings from your entries. None of your data is used to train its models.
  • Cloudflare, for storing the daily backups, on storage under European Union jurisdiction.
  • Resend, for delivering transactional emails and the newsletter.
  • Google, which hosts the publisher's mailbox: the messages you write to contact@hyvirtus.com are received there.
• The trainer or trading education organization you authorize yourself, named on the confirmation screen, for the readings you share only (section 2.10). The trainer is not a processor of Hyvirtus: they use what they read for their own coaching, under their own responsibility.
• Your organization, for the overall numbers described in section 2.11 only. These numbers do not point to you and never describe fewer than five people: it receives no personal data. For this counting, the publisher and your organization have shared their roles by contract: the publisher informs you, computes alone and answers your requests; the organization undertakes not to try to identify you, not to make use of the service compulsory and not to attach any decision to that use. You exercise your rights with the publisher.

Each processor is bound by a contract compliant with Article 28 of the GDPR.

7. Data transfers outside the European Union

Your application data is hosted within the European Union, in the Frankfurt region, and its backups on storage under European jurisdiction. The automated processing that produces your readings is carried out under a contracting entity established in the European Union (OpenAI Ireland Ltd).

Transfers to the United States nevertheless take place with certain processors whose servers or main establishment are located there, in particular for hosting the site, delivering emails and the publisher's mailbox, as well as downstream, with our providers' own sub-processors.

These transfers are governed by one of the mechanisms provided for in Chapter V of the GDPR:

• The processor's adherence to the Data Privacy Framework between the European Union and the United States (adequacy decision of the European Commission of 10 July 2023), where applicable.
• Failing that, the implementation of Standard Contractual Clauses adopted by the European Commission.

The trainer you authorize may be established outside the European Economic Area. Hyvirtus then only grants the trainer role if they are established in a country recognized as adequate by the European Commission, or after signing with them the standard contractual clauses adopted by the Commission.

The user may obtain, on simple request to contact@hyvirtus.com, a copy of the safeguards applicable to the transfer.

8. Your rights

In accordance with Articles 15 to 22 of the GDPR, you have at all times the following rights over your personal data:

• Right of access: obtain confirmation that your data is being processed and receive a copy of it.
• Right to rectification: correct any inaccurate or incomplete data.
• Right to erasure ("right to be forgotten"): request the deletion of your data in the cases provided for by the GDPR.
• Right to object: object, on grounds relating to your particular situation, to processing based on legitimate interest. For audience measurement, you can object immediately by activating the opt-out option in your browser (the hvts_analytics_optout key in local storage); while it is active, no further event is sent.
• Right to portability: receive your data in a structured, commonly used and machine-readable format, and transmit it to another data controller.
• Right to restriction: request the restriction of processing in the cases provided for by the GDPR.
• Right to withdraw your consent at any time when processing is based on it, without this withdrawal affecting the lawfulness of prior processing.
• Right to lodge a complaint with the French Data Protection Authority (CNIL, www.cnil.fr) if you consider that the processing of your data does not comply with the regulations.

From your trader profile, you can also delete a trading profile yourself. Its sessions, readings and Timeline are erased from the service immediately, then from the off-site backups as they rotate (section 5). Archiving a profile, by contrast, keeps everything: it can no longer become the active profile until you reactivate it, but it stays in your trader profile and its readings stay in your Timeline.

From your Settings, you can also take back at any time the key given to a trainer: their access is cut immediately, past readings included.

From your Settings, you can also leave your organization at any time: this is the immediate way to object to the counting described in section 2.11. Your practice days are erased at once, and your access closes.

To exercise your rights, write to contact@hyvirtus.com. A response will be provided within one month of receipt of your request, in accordance with Article 12 of the GDPR. This period may be extended by two months in the case of a complex request, in which case you will be informed of the reason for the extension.

Proof of identity may be requested in the event of reasonable doubt about your identity.

9. Security

Hyvirtus implements appropriate technical and organizational measures to ensure a level of security suited to the risk, in particular:

• Encryption of exchanges in transit via the HTTPS / TLS protocol.
• Encryption of stored data, at rest, by the hosting providers: the server disk and its snapshots at Render, the backups at Cloudflare.
• Isolation of user data by unique identifier on the server side.
• Access to the data reserved for the data controller and, for the readings you share only, for the trainer you authorize, with your authorization checked at every reading.
• Regular data backups and restoration tests.

In the event of a personal data breach likely to create a risk to your rights and freedoms, you will be informed in accordance with Articles 33 and 34 of the GDPR.

10. Automated decisions and profiling

The Hyvirtus service relies on automated processing of your behavioral data by Hyvirtus, in order to produce session, closing and timeline readings. This processing analyzes your entries (Ritual, Journal, Dojo Live sessions, trade events) to render a structured reading built around the six pillars and the authorized patterns.

In accordance with Article 22 of the GDPR, it is specified that this automated processing produces no legal decision concerning you nor any effect that similarly significantly affects you. Hyvirtus observes, reads, structures and reveals behavioral elements. It makes no decision on your behalf, triggers no action on the markets, and has no bearing on access to any right, service or benefit outside Hyvirtus. No reading reaches your organization; it has undertaken not to attach any decision to your use of the service.

You remain at all times the sole decision-maker over your practice and your trading operations.

11. Cookies and trackers

The Hyvirtus site uses no audience-measurement cookie, no advertising pixel and no third-party cookie. The audience measurement described in section 2.6 works without any cookie. The use of strictly necessary cookies and of any trackers is governed by a dedicated policy. See the cookie policy.

12. Updates to the policy

This policy may change to reflect changes in how the service operates, in legislation, or in the providers involved. Any substantial change will be notified by email to users with an active account, at least thirty days before it takes effect.

The date of the last update appears at the top of the document.