Privacy Policy

Data processing, cookies, retention periods, and rights for the whale-e.com website and Whale-E software.

Version: 1.0

1. Data controller

The data controller is ALMAGESTE, 195 Route des 3 Lucs, 13011 Marseille, France.
Contact: support@whale-e.com.

2. Scope

This policy applies to:

• the whale-e.com website
• the Whale‑E software for update checks and related technical logs
• support requests sent by e-mail.

Whale‑E does not send your strategies, backtests, or trading application data to third parties.

3. Personal data processed

We only process the following categories:

• website technical logs (for example: IP address, date/time, HTTP request, requested URL, user-agent, response status)
• software update service technical logs
• pseudonymized client identifier (client_id) during update checks, only when enabled
• support e-mail exchanges (e-mail address, message content, and optional attachments).

The client_id is optional. You can disable it with --no-update-client-id or WHALEE_UPDATE_CLIENT_ID=0.

4. Purposes and legal bases

We do not sell personal data and we do not use personal data for behavioral advertising.

5. Recipients

Data is accessible only:

• to authorized persons at ALMAGESTE
• to our hosting and cloud infrastructure processor: Amazon Web Services (AWS), to the extent required for hosting, security, and technical operations.

6. Hosting and location

Data is hosted on AWS, primarily in the Paris region (France).
We do not intentionally organize transfers of personal data outside the EU/EEA. If a transfer outside the EU/EEA is required, it is framed in accordance with Chapter V of the GDPR (notably an adequacy decision under Article 45 or appropriate safeguards under Article 46, including the European Commission’s standard contractual clauses).

7. Retention periods

• Website technical logs: up to 6 months.
• Update technical logs (including client_id when enabled): up to 6 months.
• Support e-mails: up to 6 months after the last exchange.

After these periods, data is deleted. By exception, some data may be retained beyond the above periods where strictly necessary to comply with a legal obligation or for the establishment, exercise, or defense of legal claims.

8. Cookies and audience measurement

The website sets technical cookies that are strictly necessary for proper operation. These cookies, limited to service operation, do not require prior consent under applicable cookie and tracker rules.
With your consent, the website may also use Google Analytics to measure audience and improve content.
We do not use advertising trackers.

You can accept or refuse audience measurement and change your choice at any time via the Manage cookies link in the footer.

You can configure your browser to block technical cookies, with the risk that some features may no longer work properly.

9. Security

We implement reasonable technical and organizational measures adapted to these processing activities (access control, monitoring, network security, technical logging).
The client_id is pseudonymized; raw hardware values used to compute it are not transmitted.

For network/TLS/proxy technical details, see Network and security.

10. Your rights

Under the GDPR and the French Data Protection Act, you have rights of access, rectification, erasure, objection, and restriction. Where processing is based on legitimate interest, you may object at any time on grounds relating to your particular situation; we will then stop the processing unless we demonstrate compelling legitimate grounds, or where processing is required for the establishment, exercise, or defense of legal claims. The right to data portability applies only to data you provided, processed by automated means, and only where processing is based on your consent or on a contract; for the processing described in this policy (based on legitimate interest), this right is therefore generally not applicable. We do not use your personal data to make solely automated individual decisions that produce legal effects or similarly significant effects on you (Article 22 GDPR).

You can exercise your rights at any time via: support@whale-e.com.
We may request additional information to verify your identity when needed. We respond within a maximum of one month from receipt of your request. This period may be extended by two additional months where requests are complex or numerous; in that case, we inform you of the extension and its reasons within one month of receipt. Requests are handled free of charge, unless they are manifestly unfounded or excessive (in particular repetitive), in which case we may charge a reasonable fee or refuse to act on the request.

You may also lodge a complaint with an EU/EEA supervisory authority, in particular in the Member State of your habitual residence, place of work, or place of the alleged infringement; in France, the competent authority is the CNIL: https://www.cnil.fr.

11. Policy changes

This policy may be updated to reflect legal, technical, or operational changes.
The online version indicates its latest update date.