How we handle your information
We keep very little about you, and this page says exactly what, why, and for how long.
In short
- What we keep: your email address, the funds and investors you follow, when you signed in, and one key if you asked for one.
- Why: to send the alerts you asked for, and to keep the site safe.
- Who else sees it: our hosting company OVH in France; Cloudflare, which passes traffic to us; Amazon, which sends our emails from the European Union; and the provider of our contact mailbox.
- How long: until you delete your account. Logs up to 90 days. Backups 14 days.
- Your choices: delete your account, stop any email with one click, download what we keep, or write to us.
- Where to complain: the Polish data protection office, UODO (address below).
- No tracking: no advertising cookies, no third-party analytics, no tracking in our emails. We count page views ourselves, in our own server logs, without cookies.
Who is responsible for your information?
The person responsible for your information - the law calls this the "controller" - is Mateusz Duliński, [not yet provided]. Email: hello@cefradar.com.
We have not appointed a data protection officer. For anything about your information, write to hello@cefradar.com.
This applies to everyone who uses the site, wherever you live. The European rules (the GDPR) protect you because we run the site from Poland.
What do we collect and why?
Each purpose below names the legal reason in plain words, with the article of the GDPR in brackets.
Your account and the sign-in link
Your email address, when you created the account, when you last signed in, your plan and your Founder number. We need these to provide the service you asked for (Art. 6(1)(b)). The sign-in link is a one-time code that lives for 60 minutes.
Each time you accept our Terms, ask for the Monday summary or create a key, we record the date, the version of the text you saw, the shortened address of your connection and your browser type, so we can show later what you agreed to (Art. 7(1)).
Alerts about your funds
The funds, investors and fund types you follow, and a record of each alert we sent or tried to send. Same reason: it is the service you asked for (Art. 6(1)(b)).
The optional Monday summary
Whether you asked for the weekly summary, and when. We send it only with your consent (Art. 6(1)(a)). You can withdraw it any time with one click, and the earlier emails stay lawful.
Server and security logs
Our web server records the address of your connection (shortened, so it names a neighbourhood of addresses, not your device), your browser type, the page you asked for, the page that sent you to us if your browser tells us, and the time. Sign-in codes are never written to it. Our legitimate interest is keeping the site safe and finding abuse, such as someone asking for hundreds of sign-in links (Art. 6(1)(f)).
The same log is how we count visits and see which sites send readers to us: first-party, cookie-free counting in our own server logs; no third-party analytics. Each page loads one tiny image from our own server, which adds one line to that log. Nothing is stored about you beyond that line, and it does not follow you to other sites.
The list of addresses we no longer email
When an address bounces, reports us as junk or asks us to stop, we keep it on a "do not email" list. Our legitimate interest is not emailing you again; honouring your objection is also our legal duty (Art. 6(1)(f), Art. 21(3)).
A key for the developer interface
If you create a key, we keep a scrambled copy of it, the date you created it, and a daily count of your requests. Reason: the service you asked for (Art. 6(1)(b)).
Backups
A copy of our database is made every day. The copies exist for the same reasons as the information in them.
Replying to your email
When you write to us we keep your message and our reply, to answer you and to show later what was said. Legitimate interest in running the service, or the contract with you when you are an account holder (Art. 6(1)(f), Art. 6(1)(b)).
Is giving your email required?
Yes, for alerts; without it we cannot send them. You can read everything on the site without an account.
Who else receives it?
Companies that work for us - the law calls them "processors" - handle your information only on our instructions:
- OVH SAS (France): hosts our server and our backups.
- Cloudflare, Inc. (a U.S. company with servers worldwide): passes traffic to our server, runs our domain names, protects the site, and forwards mail sent to our contact address.
- Amazon Web Services EMEA SARL: sends our emails and reports which ones bounced, from Ireland in the European Union.
- The company that runs our contact mailbox, when you write to us.
We never sell, rent or share your information for advertising.
If you live in Nevada: we do not sell covered information; you may send a request to hello@cefradar.com.
Does your information leave the European Union?
Some of these companies are American. Transfers rely on the EU-U.S. Data Privacy Framework (Commission Decision (EU) 2023/1795 - these companies are certified) and, as a back-up, the standard contractual clauses (Decision (EU) 2021/914) in their data-processing agreements. Copies on request.
If you are in the United States, your information is stored in the European Union (France and Ireland).
How long do we keep it?
| What | How long | Why it ends then |
|---|---|---|
| Your account and the funds you follow | Until you delete it | Also 7 days if you never finished signing up; 90 days after your address stops accepting our mail; 24 months with no funds followed, no sign-in, no key and no paid plan |
| Sign-in links | 24 hours | Used or expired links are worthless |
| Sign-in cookie | 30 days | Then you sign in again |
| Security cookie | 24 hours | Protects forms only while you use them |
| Traffic logs | 90 days | Enough to find abuse and to see, over a season, which pages readers use |
| Application logs | 30 days | Enough to fix a problem |
| Backups | 14 days | A deleted account disappears from backups within 14 days |
| Addresses that bounced or reported us as junk | For as long as needed | Kept as a scrambled code once your account is gone, so we never email that address again |
| Email delivery records | 90 days to 13 months | Proof of what we sent and what came back; the raw report from the mail service goes after 30 days |
| Your consents | Your account plus 3 years | Proof of what you agreed to, kept as a scrambled code once your account is gone |
| Our contact mailbox | 24 months | To show later what was said |
What are your rights?
- See what we keep: download what we keep about you (sign in first).
- Correct it: to change your address, delete your account and sign up again with the new one.
- Delete it: "Delete my account" on your alerts page removes everything at once.
- Restrict it: ask us to pause using your information while a question is settled.
- Take it with you: the download above is a plain file you can keep or give to someone else.
- Withdraw consent: the Stop link in any Monday summary, or the checkbox on your alerts page.
You can object at any time - especially to our legitimate-interest processing and to any marketing email. Use the Stop link in the email, your alert options, or write to us. This sentence is set apart on purpose.
Write to hello@cefradar.com for anything you cannot do yourself. We answer within 1 month; for a complex request we may take up to 2 months more and will tell you. We check it is you by emailing your account address - we never ask for an identity document.
Where can you complain?
Prezes Urzędu Ochrony Danych Osobowych (the Polish data protection office, UODO), ul. Stawki 2, 00-193 Warszawa, Poland, uodo.gov.pl.
If you live elsewhere in the European Union you may also complain to your local authority. If you are in the United States you can also contact your state attorney general.
Do we profile you or decide things automatically?
No.
We do not track you across other websites. We do not respond to "Do Not Track" signals because we do no such tracking. No third party collects information about your activity over time on this site.
Children
This site is for adults. You must be at least 16 to create an account. We do not knowingly keep information about anyone younger; write to us and we will delete it.
How do we keep it safe?
Everything travels encrypted. There are no passwords to steal: you sign in with a one-time link. Keys for the developer interface are stored as scrambled codes. Backups are encrypted. Only the operator has access to the server. If a breach is likely to put you at high risk we will tell you by email.
Changes to this page
We will email account holders before a material change takes effect and show the date below.
Risks of using an online service
Emails can be forged. We never ask for a password or payment. A sign-in link works for anyone who opens it within 60 minutes - do not forward it.
Last changed: Sept 16, 2026. What changed: First published version.