COT Bias Terminal ("Platform", "we", "us", "our") is owned and operated by Stochastic Systems UG (haftungsbeschränkt) i.G., based in Berlin, Germany, represented by Managing Director Siddeshkanth Logonathan. As a legal entity operating within the European Union, we are fully committed to complying with the General Data Protection Regulation (GDPR) (EU) 2016/679 and the German Digital Services Act / Data Protection Laws (DDG / TDDDG).
This Privacy Policy explains what personal data we collect, why we collect it, how our hosting infrastructure handles your data, and your rights as a data subject. It applies to all users of the Platform globally, with specific protections detailed below for residents of the EU/EEA and other privacy jurisdictions.
For any privacy-related questions or data inquiries, contact our Data Protection Officer at: privacy@stochastic-systems.com or support@cot-bias-terminal.com.
| Data | When Collected |
|---|---|
| Name | On account registration |
| Email address | On account registration and contact forms |
| Payment information | On subscription purchase (processed by third-party payment provider; we do not store card data) |
| Account preferences and settings | When you configure your account |
| Communications | When you contact support |
| Data | Purpose |
|---|---|
| IP address | Security, fraud prevention, geographic compliance |
| Browser type and version | Platform optimisation and debugging |
| Device type and operating system | Responsive design and compatibility |
| Pages visited and features used | Analytics and product improvement |
| Session duration and timestamps | Usage analysis |
| Referral source | Marketing attribution |
| Cookies and similar technologies | Session management, preferences, analytics (see Section 7) |
We do not collect sensitive personal data (e.g. health data, biometric data, political opinions, racial or ethnic origin) unless you voluntarily provide it in a support communication.
We do not collect trading account data, brokerage information, or personal financial details beyond subscription payment processing.
For users in the EU/EEA, all data processing is carried out under one or more of the following lawful bases under GDPR Article 6:
| Processing Activity | Legal Basis |
|---|---|
| Creating and managing your account | Performance of a contract (Art. 6(1)(b)) |
| Processing subscription payments | Performance of a contract (Art. 6(1)(b)) |
| Providing Platform features and Content | Performance of a contract (Art. 6(1)(b)) |
| Sending transactional emails (receipts, alerts) | Performance of a contract (Art. 6(1)(b)) |
| Security, fraud prevention, and abuse detection | Legitimate interests (Art. 6(1)(f)) |
| Platform analytics and product improvement | Legitimate interests (Art. 6(1)(f)) |
| Marketing communications (where opted in) | Consent (Art. 6(1)(a)) |
| Compliance with legal obligations | Legal obligation (Art. 6(1)(c)) |
You may withdraw consent for marketing communications at any time by using the unsubscribe link in any marketing email or by contacting support@cot-bias-terminal.com.
We use your personal data for the following purposes:
We will never sell, rent, or trade your personal data to third parties for their own marketing purposes.
The AI Inference feature processes COT market data — which is public domain data from the CFTC — to generate natural language summaries. This processing does not involve your personal data.
AI-generated outputs are statistical summaries of public financial data, not personalised content derived from your profile or behaviour.
Your usage patterns (e.g. which instruments you view) may be used in aggregate and anonymised form to improve the Platform, but are not used to personalise AI Inference outputs.
We do not feed your personal data into any LLM or AI model.
We host our infrastructure and process data through enterprise cloud providers under strict Data Processing Agreements (DPAs) compliant with GDPR Article 28:
| Service / Provider | Processing Purpose | Location & Safeguards |
|---|---|---|
| Google Cloud & Firebase Hosting (Google Ireland Limited) |
Web application delivery, global CDN edge caching, static asset hosting, and automated server access logs (IP, user agent, timestamps retained up to 30 days for DDoS and security defence). | EU data centres (Frankfurt / europe-west3) and global Google Cloud edge locations. Standard Contractual Clauses (SCCs). |
| Google Firebase Authentication (Google Ireland Limited) |
User identity management, email/password credential hashing (scrypt), Google OAuth tokens, and session token generation. | EU data centre. Passwords are cryptographically hashed; plain passwords are never accessible to our personnel. |
| Google Cloud Firestore (Google Ireland Limited) |
Secure database storage for user account settings, subscription tier status, saved market watchlists, and waitlist records. | EU data centres with encryption at rest (AES-256) and granular security rules. |
| Payment Gateways (Stripe / Creem) | Subscription billing, checkout flow, VAT/tax compliance, and invoicing. | PCI-DSS Level 1 certified processors. We never see or store full credit card numbers. |
| AI Inference (Google Vertex AI / Frontier LLMs) | Synthesis and natural language generation of public CFTC market reports. | Zero personal data transmitted. Only public government market data is passed in prompt contexts. Model inputs are not used to train foundation models. |
| CFTC Public Feeds | Ingestion of weekly Commitments of Traders market positioning reports. | Public government data release from the U.S. Commodity Futures Trading Commission. |
Where data is transferred outside the EU/EEA, it is protected by the European Commission's Standard Contractual Clauses (SCCs) and Data Privacy Framework safeguards.
COT Bias Terminal is designed with a strict privacy-first architecture. In compliance with the German Telecommunications-Telemedia Data Protection Act (§ 25 TDDDG) and the EU ePrivacy Directive:
| Storage Mechanism | Purpose | Duration | Classification |
|---|---|---|---|
localStorage / IndexedDB (Firebase Auth) |
Stores your authenticated session token so you stay logged in between page refreshes. | Until sign-out or session expiration | Strictly Necessary (§ 25 Abs. 2 Nr. 2 TDDDG) |
localStorage (UI Preferences) |
Stores selected market instruments, chart timeframes, and dark theme states. | Persistent on device | Functional / User Preference |
We do not load advertising tracking pixels, cross-site trackers, or third-party marketing cookies (such as Facebook Pixel, TikTok Pixel, or advertising beacons).
Because our storage is strictly limited to technically necessary functions requested by the user, an invasive cookie banner is not required under § 25 Abs. 2 Nr. 2 TDDDG. You may clear your browser's local storage at any time via your browser settings.
We retain personal data only for as long as necessary for the purposes described in this policy:
| Data Type | Retention Period |
|---|---|
| Account data | For the duration of your account, plus 2 years after closure |
| Payment and billing records | 10 years (required under German commercial law / HGB §257) |
| Support communications | 3 years from the date of correspondence |
| Usage and analytics data | 24 months, then deleted or anonymised |
| Marketing consent records | Until consent is withdrawn, plus 1 year |
When data is no longer needed, it is securely deleted or anonymised.
Under GDPR, you have the following rights:
To exercise any of these rights, visit our Data Deletion Page or email: privacy@stochastic-systems.com / support@cot-bias-terminal.com.
We will respond within 30 days of receiving your request. We may need to verify your identity before processing the request.
You also have the right to lodge a complaint with your national data protection authority. In Germany, this is the Berliner Beauftragte für Datenschutz und Informationsfreiheit (Berlin Commissioner for Data Protection and Freedom of Information).
Depending on your jurisdiction, you may have additional or equivalent privacy rights under local law (e.g. CCPA for California residents, PIPEDA for Canadian residents, PDPA for Singapore residents). We will honour equivalent requests from users in these jurisdictions to the extent required by applicable law. Contact us at privacy@stochastic-systems.com to submit a request.
We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, disclosure, alteration, or destruction. These include:
No method of transmission over the internet is 100% secure. While we take all reasonable precautions, we cannot guarantee absolute security. If you suspect unauthorised access to your account, contact us immediately at security@stochastic-systems.com or support@cot-bias-terminal.com.
In the event of a personal data breach that poses a high risk to your rights and freedoms, we will notify affected users without undue delay and report to the relevant supervisory authority within 72 hours as required by GDPR Article 33.
COT Bias Terminal is based in Berlin, Germany (EU). When your data is transferred to service providers outside the EU/EEA (e.g. cloud hosting or analytics providers based in the US), we ensure adequate protection through:
You may request further information about our transfer safeguards by contacting privacy@stochastic-systems.com.
The Platform is not directed at individuals under the age of 18. We do not knowingly collect personal data from minors. If you believe a minor has provided us with personal data, please contact us at privacy@stochastic-systems.com and we will delete it promptly.
We reserve the right to update this Privacy Policy at any time. Material changes will be communicated via email or a prominent notice on the Platform. The "Last Updated" date at the top of this document reflects the most recent revision.
We encourage you to review this policy periodically. Continued use of the Platform after changes take effect constitutes acceptance.
Data Controller:
Stochastic Systems UG (haftungsbeschränkt) i.G.
Gelfertstraße 52
14195 Berlin, Germany
Represented by: Siddeshkanth Logonathan (Geschäftsführer)
Email: privacy@stochastic-systems.com / legal@stochastic-systems.com
Support: support@cot-bias-terminal.com
For GDPR-related requests, data subject rights, or privacy complaints, contact our Data Protection Officer at the above email address.
This Privacy Policy was last reviewed and updated in June 2026.
© 2026 Stochastic Systems UG (haftungsbeschränkt) i.G. All rights reserved.