Paralex Privacy Policy: Waitlist and Beta
Version: 2026-10-13 Effective: 2026-10-13
1. Who is responsible
Paralex is currently operated by Tianyu Zhang as an individual, who is the data controller under this policy. Address: c/o Adressgeber #2247, An der Alten Ziegelei 38, 48157 Münster, Germany Email: privacy@paralex.net
Once a company is set up, it will become the controller. We will notify you by email and on this page before that change.
2. Scope
This policy covers:
- the paralex.net landing page;
- the waitlist and the screening survey;
- accounts of invited beta users and their use of Paralex.
3. What data we process
| Category | Data | When |
|---|---|---|
| A. Access logs | IP address, time, requested page, browser identifier (User-Agent) | When you visit the landing page or the product (server logs) |
| B. Sign-up | Email address; consent record (time of ticking the box and of clicking the confirmation link, version of the consent text); page language; sign-up route (landing page or direct invitation) | When you sign up and confirm |
| C. Screening survey | Your answers | When you pass the first screening and choose to answer |
| D. Beta account | Email; password (stored only as a one-way hash); team membership; invitation and trial status | When you accept an invitation and use the product |
| E. Research content | Topics, nodes, strategy code, parameters, backtest results, reports, conversations with the Agent, uploaded files | When you use the product |
| F. Usage and security records | Sign-in and security events; audit records of key actions; usage counts such as number of topics, backtests and their outcome, active days, model tokens used | Automatically, while you use the product |
| G. Correspondence | Emails you send us and our replies | When you contact us |
We do not collect your name, phone number, country, exchange accounts or account size. Please do not include them in survey answers or research content.
Usage statistics record counts and times only. They do not read your strategy code, parameters or metric values. Our admin console shows account and team metadata only, not research content, except support requests you send us.
4. Purposes and legal bases
| Purpose | Data | Legal basis (GDPR Art. 6(1)) |
|---|---|---|
| Keep you on the waitlist; send the screening survey, beta invitations and product updates (about one or two emails a month) | B, C | Your consent (a) |
| Plan beta batches from survey answers. Invitations are decided by a person, not by automated decision-making | B, C | Your consent (a) |
| Provide the beta service: account, backtests and trial node, Agent, expiry reminders | D, E, F | Performance of the beta terms (b) |
| Security and abuse prevention: server logs, rate limits, the sign-up captcha | A, B, F | Our legitimate interest in protecting the service and its users (f) |
| Improve the beta using aggregate figures only | F (aggregated) | Our legitimate interest in improving the product (f) |
| Keep consent records and answer your requests | B, G | Legitimate interest and legal obligation (c, f) |
5. The Agent and model providers
The built-in AI Agent is optional. When you use the Agent, AI explanations or model labelling, we send the following to the model provider:
- your conversation;
- the topic brief and research-tree outline;
- node cards, strategy code and code changes;
- conclusions and report summaries;
- excerpts of run logs and error messages;
- the research log, and the titles and goals of your team's other topics.
We do not send market data, keys or any other team's content.
During the beta, the platform configures the model centrally. It is currently Z.ai's GLM. Z.ai is operated from Singapore, outside the EU. Z.ai's terms for the service used during the beta do not state whether this content may be used to train models. Z.ai has not published how long it keeps caches and logs.
If you do not want certain content sent to a model provider, do not include it in the conversation and do not let the Agent read that topic. We may change or add model providers. We will update this section and notify you before we do.
6. Who receives your data
We share data only with providers that run the service for us. We do not sell your data or give it to advertisers.
| Provider | Purpose | Location |
|---|---|---|
| Hetzner Online GmbH | Servers, database, backups and file storage | Germany |
| Brevo (Sendinblue SAS) | Sign-up form, waitlist, sending all email (including system email); email open and click statistics (section 10) | France; some sub-processors in the US and India |
| Cloudflare, Inc. | Sign-up captcha (Turnstile) to detect bots: processes IP address, browser identifier and connection signals | USA |
| Migadu-Mail GmbH | Company mailbox for your emails to us | Swiss company, servers in France |
| Z.ai (JINGSHENG HENGXING TECHNOLOGY PTE. LTD.) | AI model service during the beta (see section 5) | Singapore |
Cloudflare also uses signals collected by the captcha to improve its own bot detection. Cloudflare is responsible for that part, under its Turnstile privacy policy: https://www.cloudflare.com/turnstile-privacy-policy/
7. Transfers outside the EU
Our servers and database are in the EU (Germany). Data is accessed or processed outside the EU/EEA in the following cases:
- Brevo's sub-processors (USA, India), for support, infrastructure and maintenance;
- Cloudflare (USA), for the captcha;
- Z.ai (Singapore), for the Agent (see section 5);
- Migadu: a Swiss company. The European Commission recognises Switzerland as providing adequate protection.
Transfers to the US rely on the EU–US Data Privacy Framework or Standard Contractual Clauses. Transfers to India rely on Standard Contractual Clauses. Transfers to Singapore: Z.ai currently provides us with no safeguards such as Standard Contractual Clauses, and Singapore has no EU adequacy decision, so your data may not be protected there to the same standard as in the EU. If you do not accept this, please do not use the Agent. To request a copy of these safeguards, email privacy@paralex.net.
8. How long we keep data
Records are deleted automatically at the first daily clean-up after their retention period ends.
| Data | Retention |
|---|---|
| Server logs (occasionally containing a visitor IP) | 14 days |
| Sign-up records and survey answers (including people not yet invited) | Deleted 12 months after sign-up. If you ask us to delete them, we do so promptly |
| Consent records (held at our email provider Brevo) | 3 years after you unsubscribe or are deleted, to prove consent; then deleted |
| Obvious spam sign-ups | Deleted when found |
| Security logs (IP, email and browser identifier for sign-in, sign-up and rate-limit events); daily activity records | 90 days |
| Sign-in sessions (IP and browser identifier at sign-in) | 30 days after the session ends (expiry, sign-out or idle timeout, whichever is earliest) |
| Admin console audit (administrator actions and IP) | 1 year |
| Agent tool-call audit | 90 days |
| Model usage records (model and token counts, no conversation content) | 400 days (about 13 months) |
| In-app notifications | 90 days |
| Beta research content | Kept during the trial. If you have not moved to a paid plan, content is kept for 90 days after the trial node expires, then deleted; we remind you before deletion. If you delete a team, it is permanently deleted within 30 days |
| The beta account itself (email, sign-in method) | Until you ask us to delete it |
| Correspondence | 1 year after the matter is closed |
| Database backups | Deleted data may remain in backups for up to about 17 days before being purged |
| Email sending logs and previews (at Brevo) | Kept by Brevo, currently without a time limit. We plan to set a retention period before public sign-up opens and will update this page |
Aggregate statistics contain no personal data and may be kept.
9. Your rights
You have the right to:
- access, correct and delete your data;
- restrict processing;
- object to processing based on legitimate interests;
- receive your data in a portable format;
- withdraw consent at any time. Withdrawal does not affect processing that took place before it.
How to exercise these rights:
- To unsubscribe, use the link at the bottom of the sign-up confirmation email, or simply reply to any email we send you directly (survey, invitation, system emails).
- For any other request, email privacy@paralex.net. We reply within one month.
- Beta users can also download code, export trade records, or delete a team in the product.
Complaints: You may lodge a complaint with a data protection authority, for example in your place of residence or the Bavarian Data Protection Authority (Bayerisches Landesamt für Datenschutzaufsicht, BayLDA, Promenade 18, 91522 Ansbach, Germany).
10. Other points
- Joining the waitlist and answering the survey are voluntary. Without an email address we cannot invite you. If you do not answer the survey, you may not be selected for a batch.
- The landing page sets no cookies. It only stores three settings locally in your browser: your display theme (light or dark), your language, and whether you have already signed up on this device (so we do not ask again). They stay in your browser and are not sent to us. The product uses only cookies strictly needed for sign-in and security (session, CSRF protection). It uses no advertising or cross-site tracking cookies.
- Our emails are sent via Brevo, which counts email opens and link clicks: each email contains a hidden image that registers an open, and links first pass through a Brevo redirect address before reaching the destination page. For this, Brevo processes your IP address and email client information and records when an email was opened and which link was clicked. We have enabled Brevo's anonymous tracking option. To avoid open tracking, turn off automatic image loading in your email client.
- When we update this policy, we change the version and date at the top. We notify you by email of material changes.