Privacy notice

The controller for the processing of personal data in this application is:

No data protection officer has been appointed, as there is no statutory obligation to do so.

Bionics Pulse is a stock-market dashboard behind a login. Apart from the sign-in page, no content is publicly accessible; accounts are created by the administrator or via an invitation code. Data is processed only for operating this service — it is not sold, and it is not used for advertising or profiling.

When the application is accessed, the web server automatically records the IP address, the date and time, the requested path, the HTTP status, the referrer and the browser identification. This is technically necessary to deliver the service and to detect attacks. Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in secure, stable operation). Log data is stored separately from the account data and is deleted as part of normal log rotation.

The application runs on a virtual server operated on our behalf by the following provider, on servers in Germany. A data processing agreement pursuant to Art. 28 GDPR is in place.

To use the service you need an account. We store your name or user name, your email address and a salted hash of your password — never the password itself. Accounts created with a user name instead of an email address receive an internal placeholder address that is never used to send mail. Legal basis: Art. 6 (1) (b) GDPR (performance of the user relationship).

To defend against brute-force attacks, sign-in and registration attempts are rate-limited per IP address. The IP address is evaluated only for this purpose and is not stored permanently. Legal basis: Art. 6 (1) (f) GDPR.

This application sets only cookies that are strictly necessary for the service you requested. No consent is required for these under § 25 (2) no. 2 TDDDG, and no tracking or advertising cookies are used.

• Session cookie ("bp…") — keeps you signed in. Lifetime 14 days, refreshed once a day.
• "bp_lang" — stores the chosen interface language. Lifetime 1 year.
• "bp_intro" — plays the welcome animation once after sign-in. Lifetime 60 seconds.

Alongside the cookie, a session record is kept in the database containing the IP address and browser identification at sign-in, so that active sessions can be recognised and ended.

For each account we store the time of the last sign-in and the time of the last request, so that the administrator can see which accounts are in use. This information is visible only to administrators. Legal basis: Art. 6 (1) (f) GDPR (legitimate interest in the administration of the user group).

Alert rules you create, and the alerts triggered by them, are stored against your account. Notifications are only sent through channels you set up yourself:

• Browser push: your browser's push endpoint is stored and passed to the push service of your browser vendor (e.g. Google, Mozilla, Apple) when a notification is delivered. Message contents are encrypted end-to-end (VAPID).
• Telegram: if you enter a chat ID, the alert text is transmitted to Telegram Messenger Inc. Their privacy policy applies.
• Webhook: if you enter a URL, the alert text is transmitted to the service you chose (e.g. Discord, Slack, ntfy).

Legal basis: Art. 6 (1) (b) GDPR for the alert function itself, Art. 6 (1) (a) GDPR for the channel you activate. You can remove any channel in the settings at any time.

Quotes, charts and news are fetched exclusively by the server and then delivered to your browser. Your IP address is therefore never transmitted to the data sources (including Yahoo Finance, Google News, Bing News, SEC EDGAR, press-release and trade-press feeds). The application loads no third-party scripts, fonts, or web analytics, and sets no advertising cookies.

The optional briefing on the dashboard is generated by a language model operated by Anthropic PBC (USA). Only publicly available market data and headlines are transmitted for this purpose — no account data, no personal data about you. Transfer to a third country is safeguarded by the EU standard contractual clauses. Legal basis: Art. 6 (1) (f) GDPR.

Account data is stored for as long as your account exists. When an account is deleted, all data belonging to it — alert rules, triggered alerts, push subscriptions, notification settings and activity status — is removed from the database in the same operation. Backups containing the data are overwritten within their rotation cycle.

You have the right to access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21 GDPR). Where processing is based on consent, you may withdraw it at any time with effect for the future. To exercise these rights, contact us using the details in section 1.

Irrespective of any other remedy, you have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR). The authority responsible for us is:

The connection is encrypted with TLS. Passwords are stored only as salted hashes, sessions are protected against forgery, and every request to protected data is validated on the server. Access to the server is limited to the controller.

This notice is adapted whenever the application changes in a way that is relevant to data protection. The current version always applies, with the date shown above.