Privacy Policy

Version 23 · 26 October 2026

1. Controller

The controller within the meaning of the General Data Protection Regulation (GDPR) is:
Jonas Rösch, Hauptstraße 154, 77876 Kappelrodeck, Germany
Email: support@wavg.de

2. General Information on Data Processing

We process personal data only insofar as this is necessary to provide a functional website as well as our content and services, or where you have given your consent. Legal bases are in particular Art. 6 (1) (a) (consent), (b) (contract / pre-contractual measures) and (f) (legitimate interest) GDPR.

Whether provision is required. Providing your email address is necessary in order to create an account; without it no contract can be concluded. Name, country and phone number are optional.

Automated decision-making. Automated decision-making, including profiling, within the meaning of Art. 22 GDPR does not take place.

3. Hosting

Our website is hosted by Hetzner Online GmbH (Industriestr. 25, 91710 Gunzenhausen, Germany). The server location is Germany. A data processing agreement (Art. 28 GDPR) is in place with the provider. Legal basis: Art. 6 (1) (f) GDPR (secure, efficient provision of the service).

4. Server Log Files

When you access the website, your browser automatically transmits information such as your IP address, the date and time, the requested resource, the referrer and the browser type. We process this data for the technical provision, security and stability of the service. Legal basis: Art. 6 (1) (f) GDPR. These web server log files are deleted automatically no later than 15 days after they are written.

Our application also keeps a technical log of its own (start-up, errors and security-relevant events such as failed sign-ins or requests that exceeded a rate limit); entries of the latter kind contain the IP address concerned. We use it to find faults and to detect misuse. Legal basis: Art. 6 (1) (f) GDPR. It is deleted automatically no later than 90 days after it is written, and earlier if the journal reaches its size limit.

5. Registration & User Account

For a user account we process your email address and a securely stored (hashed) password. Optionally, you may provide a name, country and phone number. This data is used for login, authentication and providing the personalized features. Legal basis: Art. 6 (1) (b) GDPR. You can delete your account at any time in your profile settings.

If you change your account email address, we keep your previous address for 72 hours and send a link to it with which you can reverse the change if it was not you who requested it. After 72 hours the link stops working and the previous address and the link data are deleted. Legal basis: Art. 6 (1) (f) GDPR (protecting accounts against takeover).

5a. Security Log

In addition, we keep a security log of events affecting the security of your account. These are, in particular: sign-in, failed sign-in, password change, sign-out from all devices, change of email address, deletion of the account, changes we make to your account ourselves (such as your plan or access rights), and requests rejected for security reasons (for example an expired session, an invalid security token or a request that exceeded a rate limit). Each entry contains the time, the type of event and the IP address; depending on the event it may also contain your internal account identifier, the address of the interface the request was sent to, a short reason, or — for a sign-in attempt with an address we have no account for — a short value derived from that address, which anyone who knows the address can recalculate. We use this log to detect and investigate unauthorised access and to demonstrate that a deletion was carried out. Legal basis: Art. 6 (1) (f) GDPR and, for the record of deletion, Art. 6 (1) (c) GDPR in conjunction with Art. 5 (2) GDPR. Entries are deleted no later than 90 days after they are written. Entries relating to a deleted account remain until then; they contain the internal identifier and the IP address only, no email address and no name.

Deletion register. When an account is deleted, we additionally write one line to a separate register: the internal identifier, the date and time, and who triggered the deletion. This line contains no IP address, no email address and no name. It lets us demonstrate later that a deletion was carried out, for example in response to a complaint under Art. 77 GDPR, which is not bound to a deadline. Legal basis: Art. 6 (1) (c) GDPR in conjunction with Art. 5 (2) and Art. 24 GDPR. We keep it for three years, counted from the end of the year of the deletion (§§ 195, 199 BGB).

5b. Sign in with Google

You can register and sign in with your Google account instead of a password. If you choose this, you are redirected to Google (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland). After you confirm there, Google sends us your email address, whether Google has verified it, and a permanent identifier of your Google account. We do not receive your Google password, your name or your profile picture. We store the identifier with your account so that your next sign-in finds it. If an account with the same email address already exists, it is linked to your Google account. Apart from the sign-in itself, we do not send Google any information about your use of WAVG. Legal basis: Art. 6 (1) (b) GDPR. The identifier is deleted together with your account.

Google processes the sign-in as an independent controller under its own privacy policy (policies.google.com/privacy). Google may transfer data to Google LLC in the USA; Google LLC is certified under the EU-US Data Privacy Framework.

6. Support Requests

If you contact us (e.g. via our support function or by email), we process the content of your message together with your email address and account data in order to handle and respond to your request. Legal basis: Art. 6 (1) (b) and (f) GDPR.

Contact form. You can also reach us without an account via our contact form. We process the email address you enter, your message and optionally your name and a subject line in order to reply, and we store the time of receipt and the IP address the message was sent from to limit abuse of the form. Legal basis: Art. 6 (1) (b) GDPR where the request concerns a contract, otherwise Art. 6 (1) (f) GDPR. Messages are stored on our own server in Germany and deleted automatically 90 days after receipt. They are not forwarded to our support mailbox, which only receives a notification with a reference number and your subject line.

The address support@wavg.de is hosted by Hetzner Online GmbH (Gunzenhausen, Germany), the provider that also hosts this website (see section 3). A data processing agreement under Art. 28 GDPR is in place and no transfer to a third country takes place.

7. Email Delivery

For transactional emails (e.g. password reset, email confirmation, support transcript) we use the service Resend (Resend, Inc., USA). Your email address is transmitted to the provider. A data processing agreement is in place; transfer to the USA takes place on the basis of the EU Standard Contractual Clauses. Legal basis: Art. 6 (1) (b) and (f) GDPR.

COT report notifications. If — and only if — you switch this on yourself in your profile, we send you one email per week when the CFTC publishes a new Commitments of Traders report. This setting is off by default. Legal basis: Art. 6 (1) (a) GDPR (your consent). You can withdraw your consent at any time with future effect, either via the unsubscribe link in every one of these emails (no login required) or by unticking the box in your profile. Withdrawing does not affect the lawfulness of processing carried out beforehand. These emails are also delivered via Resend.

Congressional trading alerts. If — and only if — you switch this on yourself and select the members of Congress you wish to follow, we send you an email when a newly published disclosure shows a purchase by one of them. This setting is off by default and is part of a paid plan. We record the time at which you gave this consent in order to document it. Legal basis: Art. 6 (1) (a) GDPR (your consent). You can withdraw your consent at any time with future effect, either via the unsubscribe link in every one of these emails (no login required) or by switching the alerts off in your profile. Withdrawing does not affect the lawfulness of processing carried out beforehand. These emails are also delivered via Resend.

8. Payment Processing

For paid subscriptions, payment processing is carried out via Stripe (Stripe Payments Europe, Ltd., Ireland). The data required for payment is processed directly by Stripe; we do not store complete payment data (e.g. card numbers) ourselves. Stripe's privacy notices apply. Legal basis: Art. 6 (1) (b) GDPR.

If you choose PayPal at checkout, you are redirected to PayPal (PayPal (Europe) S.à r.l. et Cie, S.C.A., 22–24 Boulevard Royal, L-2449 Luxembourg), which processes the payment as an independent controller under its own privacy notice. Stripe passes the result of the payment to us. We do not receive your PayPal login details. Legal basis: Art. 6 (1) (b) GDPR.

Stripe processes the payment data as an independent controller under its own privacy notices. A transfer to Stripe, LLC (USA) takes place. Stripe is certified under the EU-US Data Privacy Framework. Under Stripe's Data Transfers Addendum exactly one mechanism governs the transfer, in this order: first the Data Privacy Framework, and — if it does not apply — the EU Standard Contractual Clauses, which are contractually incorporated as a fallback. We additionally use Stripe Tax to calculate value-added tax. Invoice and payment data is retained in accordance with § 14b UStG and § 147 AO for the periods prescribed there; the legal basis for this is Art. 6 (1) (c) GDPR.

8a. Data from Public Disclosure Registers

We evaluate publicly accessible mandatory disclosures (including disclosures by members of the US Congress under the STOCK Act, filings by corporate officers and major shareholders to the US Securities and Exchange Commission, and lobbying registers). We process name, function, the reported transaction, the amount range and the filing and publication dates. The purpose is to prepare and present publicly known market information. The legal basis is Art. 6 (1) (f) GDPR; our legitimate interest lies in informing about publicly disclosed market events. The sources are exclusively the public registers named above. Individual notification of the data subjects does not take place pursuant to Art. 14 (5) (b) GDPR, as it would involve disproportionate effort; this information takes its place. Data subjects may object to the processing under Art. 21 GDPR at support@wavg.de.

8b. Record of Your Order

When you place an order we record your email address, the plan chosen, the date and time, the IP address the order was sent from, the language your browser requested, and which versions of the Terms and the withdrawal instructions were displayed to you. We do this to be able to prove what was agreed and what you declared (Art. 7 (1) GDPR and our legitimate interest in securing evidence, Art. 6 (1) (f) GDPR), and to document the place of supply for VAT purposes, for which we also record the country of your billing address and the country in which your card was issued or, if you pay with PayPal, the country of your PayPal account (Art. 6 (1) (c) GDPR). This record is not deleted when you delete your account, because it is subject to statutory retention periods — see section 13.

9. Error Monitoring & Web Analytics

To detect and fix technical faults we use the error-monitoring service Sentry (Functional Software, Inc., USA) with its EU data region, so error data is stored on servers within the European Union. When an error occurs (on the server or in your browser), technical data such as your IP address, browser/device information and the technical error context is processed; it is not used for tracking. A data processing agreement is in place. Should data nevertheless be transferred to the USA, the transfer is governed, in this order, by the EU-US Data Privacy Framework, under which Sentry is certified, and otherwise by the EU Standard Contractual Clauses as a fallback. Legal basis: Art. 6 (1) (f) GDPR.

To understand how our service is used and to improve it, we use the web-analytics tool Umami. Umami runs self-hosted on our own server (no data is shared with third parties), sets no cookies and does not create cross-site or cross-device profiles. It processes aggregate usage data such as page views, referring source, approximate region, browser and device type, the section of the app being used and whether a paywall was shown. For logged-in users, the subscription plan (free, Pro or Elite) is additionally recorded as a group label; it is not linked to your name, email address or account ID, but with very small groups attribution to an individual cannot be ruled out in every case. Legal basis: Art. 6 (1) (f) GDPR. You may object to this analysis at any time under Art. 21 GDPR. Usage data is retained for twelve months and is then deleted automatically; the deletion job runs once a week. You can exclude your browser from these statistics yourself by enabling Umami’s opt-out setting, the local-storage entry umami.disabled. If this setting is enabled, we respect it and keep it in place when you sign in; for this we additionally store the marker wavg_intern in your browser. Both entries remain on your device until you delete them.

10. Cookies & Local Storage

We use the following cookies:

Both cookies are strictly necessary for the operation of the service within the meaning of § 25 (2) no. 2 TDDDG: without them you could not stay logged in, and requests could not be protected against cross-site request forgery. We therefore do not ask for consent for them, and we set no cookies that would require it. We do not use advertising, tracking or profiling cookies.

We also use local storage and session storage in your browser for technical purposes:

• maintaining your sign-in state and keeping it in step between open browser tabs (including a short note when you confirm an email change or the deletion of your account in another tab); this includes a local copy of your account details, including your name and email address, which is removed when you log out;
• remembering preferences such as your display theme and alert settings;
• remembering which notices, alerts and reports you have already seen;
• temporarily storing the plan you selected before creating your account, for at most 48 hours or until you sign in; and
• keeping the search lists and the market last selected in the trend view for the current browser session (session storage, deleted when you close the tab).

These entries remain on your device and are not transmitted to us automatically. They serve the operation of the service and are not used for advertising, cross-site tracking or profiling. Separately, we use the self-hosted web-analytics tool Umami for aggregated usage statistics, as described in section 9; it sets no cookies. The legal basis for the associated data processing is Art. 6 (1) (b) and (f) GDPR. You can delete cookies and stored entries at any time through your browser settings; deleting technically necessary data may affect certain functions of the website.

11. Browser Notifications

If you allow notifications for this website, we show alerts — for example on a new COT report or an upcoming calendar event — through your browser’s own notification function, using data the page has already retrieved. This happens only while a WAVG tab is open. We do not store a push address (endpoint), we do not use the push service of your browser vendor, and no data is transferred to third parties for this purpose. The permission is managed by your browser and can be withdrawn there at any time. Which alert types you have switched on is stored in your user account and mirrored locally in your browser (see section 10). The legal basis is your consent, Art. 6 (1) (a) GDPR.

12. External Content (CDN, Fonts)

All fonts and program libraries used to render this site are hosted on our own servers. No resources are loaded from third-party CDNs or font services, and no IP address is transmitted to such providers when you visit this site.

13. Retention Periods

• Web server log files: no later than 15 days
• Application log (errors and security-relevant events, see section 4): 90 days
• Security log (see section 5a): 90 days
• Record that an account was deleted: part of the security log, retained for the same 90 days (see section 5a)
• Deletion register: three years, counted from the end of the year of the deletion (see section 5a). It contains no IP address, no email address and no name
• Account data and content linked to the account (including support requests and settings): until the account is deleted; support requests are deleted together with it — with the exception of the order records described in section 8b
• Messages sent through the contact form: 90 days on our own server; the support mailbox only receives a notification (see section 6)
• Backups: our own daily backup keeps seven states, none older than a week. Our hosting provider keeps a small number of additional server images for a short period set by the provider. A backup can bring back data that had already been deleted; if a backup is ever restored, we re-apply account deletions and the other deletion rules immediately
• Invoice and payment data: eight years for invoices and accounting vouchers, calculated from the end of the calendar year in which the invoice was issued (§ 14b (1) UStG, § 147 (3) AO). Ten years for records and annual accounts (§ 147 (3) sentence 1 in conjunction with (1) no. 1 AO). The period is extended for as long as the assessment period for the relevant tax has not yet expired (§ 147 (3) sentence 5 AO). Data is deleted once the applicable retention period has expired and no other retention obligation stands in the way. Deletion is carried out on the basis of an annual review documented in our internal records.
• Records of the order and the declarations you made when ordering (email address, plan, date and time, the language your browser requested, and which versions of the Terms and the withdrawal instructions applied — see section 8b): retained for the same period as the invoice data, i.e. eight years from the end of the calendar year in which the order was placed. The IP address recorded with the order is deleted after three years from the end of that calendar year; the record itself remains

Otherwise, personal data is deleted as soon as the purpose of processing no longer applies and no statutory retention obligations conflict with deletion.

14. Your Rights

Under the GDPR you have, in particular, the following rights:

• Access (Art. 15), rectification (Art. 16), erasure (Art. 17)
• Restriction of processing (Art. 18) and data portability (Art. 20)
• Objection to processing (Art. 21)
• Withdrawal of consent given, with effect for the future (Art. 7 (3))

To exercise these rights, an email to support@wavg.de is sufficient.

15. Right to Lodge a Complaint

You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is:
Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Baden-Württemberg, Lautenschlagerstraße 20, 70173 Stuttgart, Germany.

16. Changes

We will adapt this privacy policy if the legal situation or our processing changes. The version published on this page at any given time applies.