Privacy Policy

How MAISNER collects, uses, stores, and shares personal data — and what you can do about it. This is the privacy notice required by Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR).

1. Who we are

MAISNER is a quantitative portfolio-analytics platform operated from Estonia. For the personal data described in this notice, the operator of MAISNER is the data controller within the meaning of Art. 4(7) GDPR.

2. Scope of this notice

This notice covers the public website (maisner.eu), the application at /app, the documentation pages (/methodology, /validation, /security), the analytics instance at analytics.maisner.eu, and email correspondence with the operator.

It does not cover third-party websites you reach from links on our pages, nor the internal data handling of your own firm.

3. What we collect, why, and for how long

Every category below is listed with its purpose, its legal basis under Art. 6(1) GDPR, and its retention period. We do not collect special-category data (Art. 9 GDPR) and we do not ask for it — do not upload it.

Where processing rests on legitimate interests (Art. 6(1)(f)), we have weighed those interests against your rights and concluded that keeping a secure, auditable platform does not override the reasonable expectations of a professional user of a financial analytics tool. You may object at any time — see §11.

4. Where the data comes from

• Directly from you — the access-request form, your account profile, everything you enter or upload in the application.
• Automatically from your device when you use the platform — IP address, request metadata, browser characteristics.
• We do not buy personal data, scrape it, enrich it from data brokers, or receive it from advertising networks.
• Market data (prices, fundamentals, index levels) is retrieved from data providers and contains no personal data about you. Those requests are made server-side — the providers see our server, not you.

5. Who we share it with

We do not sell personal data and we do not share it for advertising. The recipients below are the complete list of parties that can come into contact with personal data, and what each one gets.

Deliberately not on this list: the analytics tool is self-hosted on our own server, so no analytics vendor receives anything (§8). Web fonts are served from our own domain, not from a font CDN. There is no payment processor in the loop today — subscriptions are invoiced manually; if that changes, this list and the notice will be updated before any processor goes live. Market data providers (Financial Modeling Prep, Polygon, Yahoo Finance) receive ticker symbols from our server and no personal data.

6. International transfers

Your account data, portfolios, results, and logs are stored on a server in Amsterdam, in the European Union, and are not routinely transferred out of it.

Two of the recipients in §5 can involve processing outside the EEA: content delivery networks answer your browser from whichever edge node is closest to you, which may be outside the EEA, and the operator's email is a Google service. Where a transfer to a third country occurs, it is covered either by an adequacy decision under Art. 45 GDPR (including the EU–US Data Privacy Framework, where the recipient is certified) or by the European Commission's Standard Contractual Clauses under Art. 46(2)(c) GDPR. The data involved is limited to what the table in §5 states — connection metadata for the CDNs, and the content of your own email for Gmail.

7. Cookies and browser storage

MAISNER sets no cookies. Not for sessions, not for analytics, not for anything else. There is no consent banner because there is nothing to consent to.

The application does keep a small amount of data in your browser's own localStorage, which never leaves your device except where the value is your session token being sent back to our own server:

All of these are strictly necessary to deliver the service you explicitly requested, and are therefore exempt from prior consent under Art. 5(3) of Directive 2002/58/EC (ePrivacy) as transposed nationally. Clearing your browser storage logs you out and resets these preferences; it does not delete anything on the server.

8. Analytics

We use Umami, a privacy-preserving analytics tool that we host ourselves on the same server as the platform. It sets no cookies, assigns no persistent visitor identifier, does not track you across sites, and does not build a profile. It records aggregate page views, referrers, approximate country, and browser type. No third party receives this data, because there is no third party involved. Blocking the analytics script has no effect on how the platform works.

9. Automated decision-making and profiling

MAISNER computes a great deal — optimal weights, risk metrics, stop levels, stress outcomes. None of it is a decision about you. There is no automated decision-making producing legal or similarly significant effects on a data subject within the meaning of Art. 22 GDPR, and no profiling of users. Every output is a computation on the portfolio data you supplied, presented for you to evaluate. The investment decision is always yours.

10. Security

• All traffic is served over TLS (Let's Encrypt); plain HTTP is redirected.
• Passwords are stored as bcrypt hashes — never in plain text, never recoverable by us.
• Sessions use signed JWT tokens; roles are read from the server-side user record, not from the token.
• Login is rate-limited with an IP lockout after 5 failures, and runs a constant-time verification even for unknown usernames so the response cannot be used to enumerate accounts.
• Public self-registration is disabled. Accounts exist only where an administrator created one.
• Each user's portfolios, monitors, results, and support threads are stored under a per-user path, and every endpoint checks ownership before returning data.
• Application files are permission-restricted on the server so no platform user can read another's data through the filesystem.
• The codebase is scanned with Bandit; the current result and the full architecture are published at /security.

No system is perfectly secure. If a personal data breach occurs and is likely to result in a risk to your rights, we will notify the Estonian Data Protection Inspectorate within 72 hours under Art. 33 GDPR, and notify you directly under Art. 34 where the risk is high.

11. Your rights

Under Arts. 15–22 GDPR you have the right to:

• Access (Art. 15) — get a copy of the personal data we hold about you, and this information about how it is processed.
• Rectification (Art. 16) — have inaccurate data corrected; most profile fields you can edit yourself in the app.
• Erasure (Art. 17) — have your data deleted, subject to §12 below.
• Restriction (Art. 18) — have processing frozen while a dispute about accuracy or legitimate interests is resolved.
• Portability (Art. 20) — receive the data you provided in a structured, machine-readable format. Portfolios and results are exportable as JSON, XLSX, and PDF from within the app at any time.
• Object (Art. 21) — object to processing based on legitimate interests, on grounds relating to your situation. We will stop unless we can demonstrate compelling legitimate grounds that override your interests.
• Complain (Art. 77) — lodge a complaint with the Estonian Data Protection Inspectorate (aki.ee) or with the supervisory authority in your country of residence or work.

To exercise any of these, email maisnerplatform@gmail.com from the address on your account. We respond within 30 days (Art. 12(3)), extendable by two further months for complex requests, in which case we will tell you within the first month and explain why. There is no charge unless a request is manifestly unfounded or excessive. If we cannot identify you from the request, we may ask for information to confirm it is really your data you are asking about — we will not demand ID documents where a simpler check will do.

12. Deletion and backups

When you close your account, or when we act on an erasure request, the live records — account, profile, portfolios, monitors, results, notes, alerts, support threads — are deleted from the production system within 30 days.

Encrypted-at-rest server backups are taken daily and rotated on a 7 daily / 8 weekly / 12 monthly schedule, so a copy of deleted data can persist in a backup archive for up to 12 months. We do not restore deleted personal data from backups except to recover from an incident, and where a restore does bring it back, the deletion is re-applied. Backups are never used for analysis, profiling, or any other purpose.

Some records survive an erasure request where the law requires it — for example accounting documents subject to statutory retention, or a minimal record of a deletion request itself so we can demonstrate compliance.

13. Your clients' data — where we act as processor

If you are a wealth manager, RIA, or family office and you enter personal data about your own clients into the platform, the roles shift: you are the controller for that data and MAISNER is the processor (Arts. 4(8) and 28 GDPR). In that capacity the operator processes such data only on your documented instructions, keeps it confidential, applies the security measures in §10, assists you with data subject requests, engages no sub-processor beyond those listed in §5 without prior authorisation, and deletes or returns the data when the service ends.

A written Data Processing Agreement must be in place before you upload client personal data. The standard DPA is available on request at maisnerplatform@gmail.com. The list in §5 is the current sub-processor list; controllers will be notified of intended additions in advance, with the opportunity to object.

You do not need to upload client personal data to use MAISNER. Portfolios can be identified by label or reference alone, and we recommend that they are.

14. Children

MAISNER is a professional tool sold to businesses and experienced investors. It is not directed at children, and we do not knowingly process the personal data of anyone under 18. If you believe a minor's data has reached us, write to the contact address and it will be deleted.

15. Changes to this notice

We may update this notice as the platform changes — a new sub-processor, a new data category, a change of legal entity. The version number and effective date at the top of the page always reflect the current text. Material changes will be announced in the application or by email before they take effect. Superseded versions are available on request.