Conformità al GDPR

1. Data Controller

Predite (“we”, “us”) acts as the data controller for personal data processed through our platform at predite.io. We are committed to protecting your privacy in accordance with the General Data Protection Regulation (EU) 2016/679 (“GDPR”).

2. Legal Basis for Processing

We process your personal data under the following legal bases:

Contractual necessity (Art. 6(1)(b)): Processing necessary to provide our prediction market intelligence services, including account management, subscription billing, and market data delivery.

Legitimate interests (Art. 6(1)(f)): Platform security, fraud prevention, service improvement, and analytics. We conduct balancing tests to ensure our interests do not override your rights.

Consent (Art. 6(1)(a)): Marketing communications, optional cookies, and third-party integrations. You may withdraw consent at any time.

Legal obligation (Art. 6(1)(c)): Tax records, financial reporting, and regulatory compliance.

3. Data We Collect

Account data: Name, email address, authentication credentials (managed by Clerk), timezone, language preference.

Financial data: Stripe customer ID, subscription plan, payment history. We do not store credit card numbers — Stripe handles all payment processing as a PCI-DSS Level 1 certified processor.

Platform data: Public wallet addresses (Polymarket) for read-only display and, if you opt in to automated live trading, the encrypted credentials needed to sign orders on your behalf (wallet private key and CLOB secrets for Polymarket; API key id and RSA private key for Kalshi). Also paper trading positions, bot configurations, alert rules.

Usage data: Pages visited, features used, scan frequency, signal interactions. Collected via Vercel Analytics (privacy-focused, no cookies).

Security data: IP addresses (hashed after 30 days), login timestamps, audit trail events.

4. Your Rights Under GDPR

You have the following rights, exercisable at any time by contacting privacy@predite.io:

Right of access (Art. 15): Request a copy of all personal data we hold about you. We will respond within 30 days.

Right to rectification (Art. 16): Correct inaccurate data via your Settings page or by contacting us.

Right to erasure (Art. 17): Request deletion of your account and all associated data. We will process within 30 days, retaining only data required by law (e.g., tax records for 7 years).

Right to restriction (Art. 18): Request that we limit processing while a dispute is resolved.

Right to data portability (Art. 20): Export your data in machine-readable JSON format from your dashboard Settings.

Right to object (Art. 21): Object to processing based on legitimate interests. We will cease processing unless we demonstrate compelling legitimate grounds.

5. Data Retention

Active accounts: Data is retained for as long as your account exists. Cancelling a subscription ends your access to paid features but does not delete your data — you can keep the account, reactivate later, or ask for deletion at any time.

Deleted accounts: Personal data erased within 30 days of deletion request. Anonymized analytics data may be retained indefinitely.

Financial records: 7 years as required by tax law.

Security logs: IP addresses hashed after 30 days, audit logs retained for 1 year.

6. International Transfers

Your data may be processed in the United States (Vercel, Clerk, Stripe) and European Union (Supabase). All transfers are protected by Standard Contractual Clauses (SCCs) as approved by the European Commission.

7. Sub-processors

We use the following sub-processors: Clerk (authentication, US), Stripe (payments, US/EU), Supabase (database, EU), Vercel (hosting, US), Upstash (caching, EU). Each sub-processor maintains GDPR-compliant data processing agreements.

8. Data Protection Officer

For GDPR inquiries, contact our Data Protection Officer at dpo@predite.io. You also have the right to lodge a complaint with your local supervisory authority.

9. Delete My Data

You have the right to request deletion of all your personal data. This action is permanent and will remove your account, subscription history, bot configurations, alert rules, and all associated data from our systems within 30 days.

To request data deletion, email dpo@predite.io with the subject “Data Deletion Request” from the email address associated with your account, or use the button in your Settings page.

10. Changes

We will notify you of material changes to this policy at least 30 days in advance via email. Continued use after notification constitutes acceptance.