Privacy policy

Who is responsible

Crowie s. r. o. is the controller for the personal data described here. BenchAlgo is a product of Crowie s. r. o., Lipovník 187, 049 42 Lipovník, Slovakia. Company ID 53098391. VAT ID SK2121269051. Commercial Register of Mestský súd Košice, section Sro, entry 55334/V.

Contact: support@benchalgo.com

Your account

We store your name, your email address, a one-way Argon2id hash of your password (never the password itself), your role and when the account was created and last active. We use them to provide your account, which is the contract between us (Art. 6(1)(b) GDPR).

Sign-in and security

When you sign in, we set one session cookie and store a one-way hash of its token together with the IP address, the browser’s user agent (its first 256 characters) and when the session started, was last used and expires. A session ends when you log out and after 30 days at the latest, and its record is then deleted.

A security log records sign-ups, sign-ins, failed sign-ins and sign-outs, and every time our staff open another user’s data, with the time and the IP address. Sign-in and sign-up attempts are rate limited by IP address and email address. Our web servers record the IP address, the time, the requested path without its query string, the status and a coarse label for crawlers.

We use this to protect your account and the service and to investigate misuse, which is our legitimate interest (Art. 6(1)(f) GDPR), and to provide the account you asked for (Art. 6(1)(b) GDPR).

Your research

We store your campaigns, ideas, chats, strategy code, reports, results and credit usage to provide BenchAlgo (Art. 6(1)(b) GDPR). Chat messages are stored encrypted. Tool tokens for st-mcp are stored only as a one-way hash.

This content is private to your account. Our staff open it only to help you, to keep the service secure or because the law requires it, and each access is written to the security log. We do not sell it and we do not use it to train AI models.

AI providers

When you chat with an OpenRouter model on our server, your messages, the public strategy API, your strategy code and the short feedback on your runs are sent to OpenRouter, Inc. in the United States, which passes them to the provider of the model you chose. They process this under their own terms. They never receive market data, trades or equity curves from us.

When you connect your own Claude Code or Codex, the same kind of prompt is sent to your computer, and your tool sends it to its provider under your own account and terms.

Payments

Stripe handles card entry and payments. We keep Stripe’s customer, subscription and checkout references, your plan and its status, and a ledger of the credits you receive and use. We do not store card details. We keep invoices and accounting records as Slovak law requires (Art. 6(1)(c) GDPR).

While BenchAlgo is in preview, payments run in Stripe test mode and no real money moves.

Email to us

When you write to us, we use your message and address to answer you and to handle any related complaint or legal claim (Art. 6(1)(b) and (f) GDPR).

No analytics, advertising or tracking

The public website sets no cookies, stores nothing in your browser and loads nothing from other websites by itself. We use no analytics, advertising or social media tools, and no tracking pixels. The web app sets one essential cookie that keeps you signed in. See the cookie page.

The one exception is a test you start yourself: the broker latency test on the home page. When you press its button, your browser sends a few small requests without cookies to api.topstepx.com (Topstep) and live.tradovateapi.com (Tradovate) and times them. Like any website you open, those servers receive your IP address, your browser’s details and our website’s address. The result stays in your browser; we do not receive or keep it.

Where your data is processed

• Hetzner Online GmbH hosts the service and its database in Falkenstein, Germany.
• Stripe processes payments and may process data outside the EEA, including in the United States.
• OpenRouter, Inc. (United States) and the model provider you choose receive the prompts described above, only when you use an OpenRouter model.

Transfers outside the EEA rely on an adequacy decision, such as the EU-US Data Privacy Framework for certified companies, or on standard contractual clauses. Our market data providers receive nothing about you. Ask us for details about a particular recipient.

How long we keep data

• Account and research content: until you delete them or your account.
• Sessions: until you log out or for 30 days at the most.
• Security log and web server logs: as long as they are needed to protect the service and investigate incidents.
• Invoices and accounting records: ten years after the year they concern, as Slovak law requires.
• Email to us: while we handle your request and any related complaint or legal claim.

Your rights

You can ask for access to your data, a copy, correction, deletion, restriction, or object to processing based on our legitimate interest. Write to support@benchalgo.com. We may need to confirm that the request comes from you, and we normally answer within one month.

You can also complain to the Office for Personal Data Protection of the Slovak Republic (Úrad na ochranu osobných údajov Slovenskej republiky) or to the authority where you live. You do not need to contact us first.

Changes

Every version is dated at the top of this page. We will tell account holders about material changes before they apply.