Last updated: 04 October 2026
This policy explains what personal data StrategyProof (“we”) collects on strategyproof.net, why, and what rights you have.
It applies the EU General Data Protection Regulation (GDPR).
1. Who is responsible
Data controller: Daniel Brooks, Italy. Contact for any privacy question:
analysis@strategyproof.net.
2. What we collect
- Account data: username, email address, password (stored only as a one-way hash), account tier, research credits,
email verification status. - Research data: the strategy settings you submit in the Strategy Lab and the results we compute for you.
- Payment data: if you become a Supporter, the payment is processed by PayPal. We receive the transaction reference,
amount, date and the email linked to the payment. We never see or store your card or bank details. - Waitlist: if you join the waitlist, we store your email address, the date and your consent, only to tell you when StrategyProof opens.
- Technical data: IP address and browser information in server logs, used for security, to block automated sign-ups
and to keep the service running. - Uploaded reports: files you analyse with the Validator are processed in your browser or for the analysis only and are
not used for any other purpose.
3. Why we use it (legal basis)
- To create and run your account and your research: performance of the contract (Art. 6(1)(b) GDPR).
- To process Supporter payments and keep accounting records: contract and legal obligation (Art. 6(1)(b) and (c)).
- To protect the site from abuse, spam and attacks: legitimate interest (Art. 6(1)(f)).
- To send service emails (verification, password reset, important changes): contract. We do not send marketing emails
without your consent.
4. Who receives the data
We do not sell personal data. We share it only with the providers needed to run the service: the hosting provider of our
server, the email delivery provider used for service emails, and PayPal for payments. PayPal acts as an independent
controller under its own privacy policy. Some providers may process data outside the EU; in that case the transfer is
covered by the safeguards required by the GDPR (such as Standard Contractual Clauses).
5. Cookies
We use only technical cookies that are necessary for the site to work: the WordPress login cookies that keep you signed in
and a test cookie that checks your browser accepts cookies. We do not use advertising or profiling cookies.
For this reason no cookie consent banner is required. If this changes, we will update this policy and ask for consent first.
6. How long we keep it
- Account and research data: as long as your account exists. When you delete the account, they are deleted within 30 days.
- Payment and accounting records: for the period required by tax law.
- Waitlist emails: until we send the launch email, and in any case no longer than 12 months. You can ask to be removed at any time.
- Server logs: for a short period, normally no longer than 90 days.
- Unverified accounts may be deleted automatically.
7. Your rights
You can ask to access, correct, delete or export your data, to restrict or object to its processing, and you can withdraw
any consent at any time. Write to analysis@strategyproof.net; we reply within one
month. You also have the right to lodge a complaint with your data protection authority (in Italy: Garante per la protezione dei dati personali, garanteprivacy.it).
8. Age
StrategyProof is intended for adults. You must be at least 18 years old to create an account.
9. Changes
We may update this policy. The date at the top shows the latest version. Important changes will be announced on the site or
by email.
Email updates. If you tick the optional box at registration or click “Email me the updates”, we store your consent (date and wording) in your account and add your email address to our mailing list hosted by Brevo (Sendinblue SAS, France), which sends our research notes and quarterly EA updates on our behalf. We do not sell or share your address with anyone else. Every email contains a one-click unsubscribe link; you can also ask us to delete your data at any time.