1. Data controller
The data controller is TRADR GROUP LLC, Limited Liability Company registered in the State of New Mexico (United States of America), whose details appear in the legal notice.
Data protection contact: hello@getfundy.ai
2. Data collected
We collect only the data necessary for the purposes described below:
- Identification data: first name, last name, email address.
- Account data: login credentials, subscription status, products purchased, progress through the training.
- Transaction data: amount, date, order reference, purchase history. We neither collect nor store any bank card data : it is processed directly by our payment provider.
- Communication data: messages sent to support, exchanges with the conversational assistant.
- Technical data: IP address, browser type, operating system, pages viewed, timestamps, connection logs.
- Linking identifier with a third-party service (for example a community account), where the Customer chooses to make that link.
No special category data within the meaning of article 9 GDPR is collected. The services are not directed at minors under 18.
3. Purposes and legal bases
| Purpose | Legal basis (art. 6 GDPR) | Retention |
|---|---|---|
| Managing the order, payment and access to the products | Performance of the contract (art. 6(1)(b)) | Duration of the contractual relationship |
| Accounting and tax obligations (invoices) | Legal obligation (art. 6(1)(c)) | 10 years |
| Support and customer service | Performance of the contract / legitimate interest (art. 6(1)(b) and (f)) | 3 years after the last contact |
| Site security, fraud prevention, technical logs | Legitimate interest (art. 6(1)(f)) | 12 months |
| Sending commercial information | Consent, or legitimate interest for existing customers on similar products (art. 6(1)(a) and (f)) | 3 years after the last contact, or until consent is withdrawn |
| Audience measurement and site improvement | Consent for non-exempt trackers (art. 6(1)(a)) | 13 months maximum |
4. Recipients and processors
The data is accessible to authorised staff within Fundy and to its processors, who act only on documented instructions and are bound by a processing agreement compliant with article 28 GDPR:
| Provider | Role | Location |
|---|---|---|
| Netlify, Inc. | Site hosting | United States |
| Stripe (payment) | Payment processing | United States and Ireland |
| Memberstack (authentication) | Account and access management | United States |
| Supabase (database) | Storage of account and purchase data | Ireland (European Union) |
| Cloudflare (application infrastructure) | Running server-side processing | Global network, processed at the nearest point of presence |
| Discord (community) | Community space, if voluntarily linked | United States |
The data is not sold, rented or exchanged for commercial purposes. It may be disclosed to administrative or judicial authorities upon lawful request.
5. Location and international transfers
As the Company is established in the United States, the data of people residing in the European Union, the EEA, the United Kingdom or Switzerland is transferred outside their home territory, as is data processed by our US-based processors.
These transfers are governed by the appropriate safeguards provided for in Chapter V GDPR (and the equivalent UK and Swiss texts), namely:
- standard contractual clauses adopted by the European Commission (Implementing Decision (EU) 2021/914), supplemented where applicable by the ICO’s UK addendum;
- where the provider is certified under it, the EU–US Data Privacy Framework (EU–US Data Privacy Framework) and its UK and Swiss extensions;
- transfer impact assessment and, where necessary, supplementary measures (encryption, minimisation, access segregation).
6. Retention periods
The periods are set out in the table in article 3. On expiry, the data is irreversibly deleted or anonymised, subject to retention periods required by law (in particular for accounting and evidential purposes).
7. Your rights
The rights available to you depend on where you live. Wherever that is, we apply the GDPR level of protection to all our customers, which is the highest — so you can exercise the rights below wherever you are.
European Union, EEA, United Kingdom and Switzerland
- Access (art. 15): obtain a copy of your data.
- Rectification (art. 16): correct inaccurate data.
- Erasure (art. 17), within the limits of our legal obligations.
- Restriction of processing (art. 18).
- Portability (art. 20): receive your data in a machine-readable format.
- Objection (art. 21), in particular to direct marketing, at any time and without reason.
- Withdrawal of consent at any time, without retroactive effect on the lawfulness of processing already carried out.
- Post-mortem directives on what happens to your data (French law).
California and other US states
Residents of California (CCPA/CPRA) and of states with comparable legislation may request to know the categories of data collected, obtain their deletion or correction, and opt out of their “sale” or “sharing”. We do not sell or share your data for advertising purposes. No discrimination will result from exercising these rights.
Other countries
Residents of Canada (PIPEDA, Law 25 in Quebec), Brazil (LGPD), Australia, Japan or any other jurisdiction have the rights provided by their local legislation, as well as those listed above.
How to exercise your rights
Write to hello@getfundy.ai, from the email address used for the order. Proof of identity may be requested in the event of reasonable doubt. We reply within one month, extendable by two months where the request is complex.
Complaint to an authority
You may lodge a complaint with the supervisory authority of your country of residence, in particular:
- France — CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, cnil.fr ;
- Other EU Member States — the data protection authority of your country;
- United Kingdom — Information Commissioner’s Office (ICO);
- Switzerland — Federal Data Protection and Information Commissioner (FDPIC).
8. Cookies and trackers
A cookie is a file placed on your device when you visit a site.
Strictly necessary trackers
These make the site work (session, authentication, security, remembering the basket). They are exempt from consent under article 82 of the French Data Protection Act and the equivalent provisions of the ePrivacy Directive.
Trackers requiring consent
Non-exempt audience measurement, advertising and social sharing trackers are placed onlyafter your prior consent, obtained through a banner that lets you accept, refuse as easily as accept, and customise your choices. Your choice is kept for a maximum of six months and can be changed at any time.
9. Security
We implement appropriate technical and organisational measures to protect data against unauthorised destruction, loss, alteration, disclosure or access: encrypted transport (HTTPS), access segregation, authentication of server requests, time-limited signed download links, and logging.
In the event of a data breach likely to result in a high risk to your rights and freedoms, you will be informed in accordance with article 34 GDPR.
10. Changes
This policy may be amended to reflect legal, technical or functional changes. The date of the last update appears at the top of the page. In the event of a substantial change, you will be informed by appropriate means.