Privacy policy

Last updated: 1 August 2026

This policy covers the kairostrategic.com website and the Kairos Hub application, both web and mobile. It is written to be read: if a sentence isn’t clear, that’s our fault and you can tell us at privacy@kairostrategic.com.

1. Who processes your data

The data controller is Kairos Republic SL, NIF B27578723, Avenida El Cardonal, bloque 142, 38108 San Cristóbal de La Laguna, Santa Cruz de Tenerife (Spain). For anything about your data write to privacy@kairostrategic.com: we answer within one month.

2. What we collect

We collect nothing “for later”. Every item below serves a function you can see:

When you sign up and pay — name, email, password (kept only as a cryptographic hash, never in the clear), language, time zone. If you enable two-step verification, the second-factor secret, encrypted. Your subscription identifiers at Stripe or Apple: your card details never pass through us and we do not store them.
When you use Kairos — the ideas you declare, with thesis, plan, invalidation and notes; your start- and end-of-day reflections; the journal, quick notes and any voice memos; the reasons you decided not to trade; the events you add to the calendar; your conversations with Ezra.
How you feel, when you tell us — Kairos asks you to declare your state before trading and at the end of the day (calm, tense, anxious, euphoric, tired, impulsive) and lets you attach a mood to your notes. This is information about your psychological state and we treat it as the most sensitive part of the whole archive: we collect it because it is the heart of the method — without it Kairos cannot show you the relationship between how you felt and what you did — and we use it for nothing else.
Your broker account, if you connect it — the connection is read-only: Kairos cannot trade on your behalf, cannot open, close or modify positions. We receive executed trades (instrument, direction, prices, stops, lots, times, result), balance, equity and open positions. If you connect a prop firm account, also the challenge parameters and daily progress.
What Kairos calculates about you — scores (DQS, EDS, RDS, Kairos Score), violations of the rules you declared, the history of your movements in the application, the baseline profile you fill in at signup, and the recurring patterns the system recognises in your behaviour, including emotional ones.
Technical data — IP address and the outcome of login attempts, to stop attacks. If you send feedback: the page you were on, your browser and, if you attach one, a screenshot.

3. Why, and on what legal basis

To give you the service you bought — art. 6(1)(b) GDPR. This is the basis for most of what we do: recording ideas, calculating scores, reading the account you connected, running Ezra, managing the subscription. Ezra is included in the subscription, it is not an extra: analysing your data to answer you is performance of what you bought, not an additional processing.
Because the law requires it — art. 6(1)(c). Invoices and accounting records.
For a legitimate interest of ours — art. 6(1)(f). Security, abuse prevention, fault diagnosis. In the balancing test we chose to collect the minimum: error logs are stripped of emails and tokens before they leave Kairos.
Because you asked us to — art. 6(1)(a). Only for three things: commercial communications, the third-party content described in the Cookie Policy, and appearing on the leaderboard. These consents can be withdrawn at any time from settings, with no consequence for the rest of the service.
On cognitive states and personal notes — this is information that may concern your psychological sphere. We process it because it is indispensable to the service you chose, and only for that: we do not use it to profile you towards third parties, we do not sell it, and we do not disclose it to anyone other than the technical providers listed below and within the limits described.

4. Who receives it, and what each one sees

None of these providers sells your data or passes it on. Each acts as a processor on our behalf, under a contract that requires it.

Xano — the entire archive: it is the Kairos database. EU/USA.
Vercel — web application traffic and logs. Hosts the site and the hub. EU/USA.
Stripe — name, email and payment identifiers, for subscriptions and invoices. EU/USA.
Anthropic — the context Ezra needs to answer you: ideas, scores, violations, closing notes, account status, declared cognitive states and the messages you write. We do not send your name. USA.
MetaApi and Spotware (cTrader) — read-only account authorisation and trading activity, to read trades from the broker. EU.
Resend — your email address and the message text, for service emails. EU/USA.
OpenAI — the audio file, only if you record a voice memo, to transcribe it. USA.
Google (Firebase) — the device token and the notification text, for push notifications on the app. USA.
Apple — an anonymous purchase identifier, for subscriptions bought on iPhone. USA.
Discord — only if you connect Discord: your identifier, for community roles. USA.
Cloudflare — payment and broker traffic in transit, for security and routing. Global network.
Sentry — technical errors, with emails and tokens removed before sending, for fault diagnosis. EU.

On Anthropic, the most sensitive provider: the data it receives is not used to train its models and is deleted within thirty days. The relationship is governed by their data processing agreement, which includes the European Standard Contractual Clauses.

5. Outside the European Union

Some providers have servers or offices in the United States. In those cases the transfer takes place on the basis of the Standard Contractual Clauses approved by the European Commission and, where available, the EU-US Data Privacy Framework certification.

6. How long we keep things

Conversations with Ezra — 30 days, then deleted.
Ideas, trades, journal, scores, declared states — as long as you have an account.
Invoices and accounting documents — 10 years, as Spanish tax law requires.
Login attempts (IP address) — 30 days.
Technical error logs — 90 days.

If you delete your account you have 30 days to change your mind: during that period you can write to us and everything is undone. After 30 days your data is erased — the journal, the ideas, the trades, the conversations with Ezra, the scores, the prop world. What remains is only the documents tax law obliges us to keep and the security access log, which exists precisely so we can reconstruct who did what. Anonymous statistical data also remains, not linkable to you: it is kept under a pseudonym which, once the account is deleted, can no longer be traced to any person.

7. Who sees your data inside Kairos

The Kairos team can access your account data for support and to run the service. Every administrative access to a user’s data is logged: who looked, at what, and when. Your journal and your conversations with Ezra are not accessible from the administration tools.

The leaderboard — participants are visible to other users under the nickname they chose, never their real name, together with their photo and some discipline indicators. Not your ideas, not your numbers, not your journal. Without a nickname you do not appear at all: taking part is your choice and can be undone from settings.
Teams and accountability partners — if you join a team or accept a partner, that person sees your name, your Kairos Score, your streak and your system state. They do not see ideas, notes or violations. The link can be broken at any time.

We do not sell your data, we do not pass it to third parties for commercial purposes, and we do not use it for profiled advertising.

8. Your rights

You can ask to access your data, correct it, erase it, restrict its use, receive it in a file to take elsewhere, and object to processing based on our legitimate interest. You can withdraw the consents you gave at any time. Settings already contain two tools that work on their own: export your data, which immediately downloads a file with everything we hold about you, and delete your account. For anything else write to privacy@kairostrategic.com. If you think we are getting it wrong you can contact your country’s supervisory authority: in Spain that is the Agencia Española de Protección de Datos (aepd.es), in Italy the Garante per la protezione dei dati personali (garanteprivacy.it).

9. Automated decisions

Kairos calculates scores and may tighten your operating limits when discipline worsens: that is the mechanism you chose when you signed up, and it is the point of the product. It produces no legal effects and no consequences outside Kairos — we do not decide whether you can trade on your own account, we tell no one, and it does not affect credit, employment or anything else. You can always ask us for an explanation and obtain human intervention.

10. Minors, and changes to this page

Kairos is not intended for anyone under 18 and we do not knowingly collect data from minors. Changes to this policy are published here with the date at the top; if a change is substantial we tell you by email or inside the application before it takes effect.