Privacy notice
Last updated 6 September 2026
The short version. We hold your email address, encrypted. We record when you ran a count and how long it took, but never what you counted — your price files are read once and dropped, and are never written to our disks. We never see your card. You can download everything we hold, or delete it, from your account page.
1. Who we are
Waveanism is a trading name of Machine Quotient Ltd, a company registered in England and Wales (number 17444151), whose registered office is at 71-75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom. We are the data controller for the information described here.
For anything in this notice, write to support@waveanism.com.
2. What we collect, and why
| What | Why |
|---|---|
| Your email address | To identify your account, verify it, and send password resets. Stored encrypted; we look it up by a keyed hash, so the address itself is never held in readable form in our database. |
| Your name, if you give one | Optional. Used only to address you. Also stored encrypted. |
| Your password | Stored as an argon2id hash. It cannot be reversed, and we cannot tell you what it is. |
| A record of each count | The time you ran it, how long it took, how many files and how many bars, whether it succeeded, and whether it used the trained model. Used to apply your monthly allowance, to answer support questions, and to size our servers. It does not include prices, filenames, instruments, which market you selected, or the result. |
| Your subscription | Which plan you hold, its status, and the Stripe identifiers needed to renew or cancel it. |
| Your IP address | In server logs, briefly, to apply rate limits and to investigate abuse. |
| Two-factor secret, if you set one up | Encrypted. Administrator accounts are required to have one. |
3. Your price files
This is the part most likely to concern you, so it is worth stating plainly.
When you upload a CSV, it is read once into memory to build the price series, and dropped when the count finishes. It is never written to disk, never backed up, and no copy is kept. We do not record the filename, the instrument, the prices, or the count that came out.
What survives is one row saying that an account ran a count at a particular time, over a particular number of bars. Not what the bars were.
4. Our lawful bases
- Performance of a contract — your account, your subscription, and running the counts you ask for.
- Legitimate interests — keeping the service secure, applying rate limits, preventing abuse, and understanding aggregate load so we can size our servers. We have considered your interests and consider these proportionate; none of them involve profiling you or analysing what you trade.
- Legal obligation — keeping records of transactions for tax and accounting.
- Consent — only where you join a waiting list for a product that is not yet on sale. You may withdraw it at any time.
5. Who else sees it
We do not sell your data, and we do not share it for anyone else's marketing. We use these processors:
| Who | What they see |
|---|---|
| Stripe | Payments. They hold your card details; those never reach our servers. They receive your email address and what you bought. |
| Amazon Web Services | Hosting. Our servers and database run on their infrastructure. |
| Google (reCAPTCHA) | Checks that sign-in, registration and password reset are being used by a person rather than a script. Google receives your IP address and browser information for that check. |
| Our email provider | Delivers verification and password-reset messages, and so handles your address. |
We may also disclose information where the law requires it.
6. Where it is processed
Our servers are in the United States (Amazon Web Services, Northern Virginia). Stripe and Google also process data outside the United Kingdom.
Where personal data leaves the UK, it is protected by the UK International Data Transfer Addendum to the European Commission's Standard Contractual Clauses, which forms part of our agreements with those providers. You may ask us for a copy of the safeguards that apply.
7. How long we keep it
Not "as long as necessary". Specifically:
| What | How long |
|---|---|
| Your account and subscription | Until you delete it, or three years after it lapses |
| Verification and password-reset links | 7 days, then deleted automatically |
| Record of counts | 400 days, then deleted automatically |
| Payment records | Deleted 90 days after settlement, except where tax law requires us to keep transaction records for six years |
| Your price files | Not kept at all |
These deletions run nightly and are not a matter of someone remembering.
8. Your rights
Under UK GDPR you have the right to:
- See what we hold. Your account page has a download button that gives you everything, as a JSON file, immediately.
- Take it elsewhere. The same file is structured and machine-readable.
- Correct it. Your name and email can be changed on your account page.
- Delete it. Also on your account page. Deletion is
immediate and removes your account, your sign-in tokens and your two-factor
setup.
Two things survive, and it is worth being precise about them. Transaction records we are required to keep for tax remain for six years. And the rows recording that a count happened — the time, the duration, the number of bars — are kept with the link to your account severed, so they are no longer about you and we cannot tell they were ever yours. We keep them because they are what tells us how much server capacity the service needs. They still expire after 400 days. - Object, or ask us to restrict processing. Write to us.
- Withdraw consent where that is what we relied on.
We do not make automated decisions that have legal effects on you. The wave counts are our opinion about a chart, not a decision about you.
9. How it is protected
- Email addresses and names are encrypted at rest. Passwords are hashed with argon2id and cannot be recovered.
- The site is served only over HTTPS.
- Administrator accounts must use two-factor authentication.
- Your uploaded files are never written to disk.
- Access to production systems is limited to the people who need it.
No system is perfectly secure. If a breach occurs that is likely to result in a risk to your rights, we will tell the Information Commissioner within 72 hours and tell you without undue delay.
10. Cookies
We set one cookie, which keeps you signed in. It is strictly necessary for the service to work, so it does not require consent.
We use no analytics, no advertising and no tracking cookies. We do not know which pages you visited before ours, and we do not want to.
Google's reCAPTCHA may set its own cookies when you sign in, register or reset a password. That is Google's processing, described in their privacy policy.
11. Changes, and how to complain
If we change this notice we will update the date at the top, and tell account holders by email where the change is significant.
If you are unhappy with how we have handled your data, please tell us first at support@waveanism.com — we would rather fix it. You also have the right to complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113.