cseason is run by one private individual, who is the controller of the personal data described here. This page says what is held, why, who else sees it, and what you can ask to have done with it. Requests come to one person and are answered by that person.
Only what the service needs to work:
We never receive your card number, and no payment credential of yours is stored on our systems. Card details go directly to Stripe. We run no advertising trackers and no third-party analytics; the only thing this site keeps in your browser besides your sign-in session is your language choice.
To provide the service you asked for and to take payment for it (performance of a contract); to keep the service secure and to meet accounting and tax obligations (legal obligation and our legitimate interest); and, where you have asked for them, to send notifications (consent, which you can withdraw at any time in Settings).
We keep this list short on purpose. Each of these has a defined job:
There is no cookie banner because there is nothing to consent to. This site sets no analytics, no advertising and no third-party tracking of any kind — there is no Google Analytics, no Plausible, no Sentry, no embedded widget. Browser storage is used for exactly two things: the session that keeps you signed in, and which of the three languages you chose.
Both are strictly necessary for a service you asked for, which is the one case where European law requires no consent. If that ever stops being true — if anything is added that watches what you read — you will be asked first, and this paragraph will say so.
Data is held on servers in the European Union. Account and subscription records are kept for as long as your account exists, and go when you delete it.
Server logs — the web server’s access and error logs, and the application’s own journal — are kept for 14 days and then deleted automatically. They contain IP addresses. This used to say "a short operational period", which was true of the intention and of nothing else: no rotation was configured and the logs were kept indefinitely. It is configured now, and 14 days is what it is set to.
You can ask for a copy of what we hold, ask us to correct it, ask us to delete it, object to processing, or ask for it in a portable form.
Deletion is a button, not a request: Settings has one, it runs immediately, and it removes everything this site holds against you — profile, subscription record, saved trades, notification route, AI settings, delivery history. It tells you how many rows went. What it cannot reach in the same moment is the sign-in identity itself, which lives with the identity provider: removing that is a manual step, we are told to do it the moment you press the button, and you can write to us to confirm it is done.
Your payment records are not ours to delete. Stripe is the merchant of record for every payment made here, so the invoice with your name on it is held by Stripe under its own retention obligation, not by us. We keep no copy of it after your account goes.
Write to contact@cseason.com and we will answer within 30 days. If you are in the EU or UK and you think we have handled your data badly, you can also complain to your local data protection authority.
If this policy changes materially we will say so before the change takes effect. The date at the top of this page shows the current version.