Privacy Policy
Version 1.0 · Effective 26 October 2026 · Last revised 26 October 2026
How Symfonite collects, uses, shares and keeps personal data, and the rights you have over it.
Key points
- SYMFONITE LTD in Cyprus is responsible for your data. EU data protection law (the GDPR) applies to every user, wherever you live.
- We collect only what we need to run your Account, keep the Services safe and meet the law.
- We never ask for your broker password.
- Signals are part of the Services you sign up for: they are on from the start and you can switch each channel off at any time.
- Marketing needs your separate consent. You can withdraw it at any time.
- We do not sell your data. We share it only with the providers and parties listed in this Policy.
- You can ask to see, correct, delete or move your data. We answer within one month.
- You can complain to the Cyprus data protection authority at any time.
1 Who we are
1.1This Privacy Policy explains how we collect and use Personal Data when you use the Services, contact us, or work with us as a Partner. Words defined in the Terms of Use have the same meaning here.
1.2The Controller of your Personal Data is SYMFONITE LTD, a private limited company registered in Cyprus with registration number ΗΕ 499698, whose registered office is at Morfo Court, Block A, Office 7, Kimonos 58, 3095 Limassol, Cyprus.
1.3For any question or request about your Personal Data, email info@
1.4This Policy is information we must give you under the GDPR. It is not part of our contract with you, as Terms of Use, section 1 explains.
2 Words with special meanings
- Personal Data
- any information about an identified or identifiable living person, such as a name or an email address.
- Processing
- anything done with Personal Data, such as collecting, storing, using, sharing or deleting it.
- Controller
- the organisation that decides why and how Personal Data is processed.
- Processor
- an organisation that processes Personal Data for a Controller, on its instructions.
- GDPR
- the EU General Data Protection Regulation (Regulation (EU) 2016/679).
3 The data we collect, and where it comes from
3.1The table below lists the Personal Data we collect, by where it comes from.
| Source | What we collect |
|---|---|
| You, when you sign up | Name, email address, phone number, declared country, preferred language, password (stored only as a secure hash), and your consent choices. |
| You, when you use the Members Area or the App | Two-factor authentication settings and messages you send us. |
| You, if you apply to be a Partner or are one | Business name and contact details, what you tell us when you apply, and the promotional materials you use. |
| Your device and your use of the Services | IP address, device and browser type, app version, push notification token, pages and screens viewed, log and security events, and Cookie identifiers (see the Cookie Policy). |
| Partners | The fact that you signed up through a Partner's link, and which Partner it was. |
| Messaging platforms | If you connect Telegram, your Telegram user ID and username. If you message us on WhatsApp, your phone number and the messages you send. |
| Records we create | Consent records and complaint records. |
3.2We do not ask for or keep your broker password.
3.3We use your IP address for security and fraud prevention. We do not use it to decide your country, which is the country you declare (see Terms of Use, clause 4.2).
3.4Some data is needed to provide the Services. If you do not give it, we cannot open your Account. We tell you which data is needed when we ask for it.
4 Why we use your data, and our legal basis
4.1We use Personal Data only for the purposes below. For each one, the GDPR requires a legal basis under Article 6(1); the table names it.
| Purpose | Data used | Legal basis |
|---|---|---|
| Create and run your Account, and provide the Services you ask for | Account data, device data | Performing our contract with you (Article 6(1)(b)) |
| Send Signals by email and push notification, and on Telegram once you join, until you switch a channel off | Contact details, channel identifiers, delivery records | Performing our contract with you (Article 6(1)(b)): Signals are part of the Services you sign up for |
| Send you marketing about our Services | Contact details, preferences | Your consent (Article 6(1)(a)) |
| Keep the Services secure and detect fraud and abuse, such as multiple accounts | Device data, logs, account data | Our legitimate interests in protecting the Services, our users and our business (Article 6(1)(f)) |
| Answer support requests and complaints | Messages, account data | Performing our contract with you (Article 6(1)(b)), and our legitimate interests (Article 6(1)(f)) |
| Measure and improve the Services | Usage data, analytics Cookies | Your consent for analytics Cookies (Article 6(1)(a)); our legitimate interests for statistics that do not identify you (Article 6(1)(f)) |
| Consider your application to be a Partner, and run the Partner programme | Partner data | Steps you ask us to take before a contract, and performing our contract with the Partner (Article 6(1)(b)) |
| Establish, exercise or defend legal claims, and answer lawful requests from authorities | The data relevant to the claim or request | Our legitimate interests (Article 6(1)(f)); a legal obligation (Article 6(1)(c)) |
4.2Where we rely on legitimate interests, we have weighed them against your interests and rights. You can ask us for details of that assessment, and you can object (see section 10).
5 Switching Signals off, and your consents
5.1Signals are part of the Services you sign up for, so we send them without asking for a separate consent: by email and push notification from the start, and on Telegram once you join our channel or bot. You can switch any channel off at any time, and every Signal email and Telegram message says how:
- email: with the Unsubscribe link in every Signal email, on the Your signals page in the Members Area, or in the App's settings;
- push notifications: in the App's settings, or on the Your signals page;
- push notifications: also by turning off notifications for the App in your device settings;
- Telegram: on the Your signals page, by sending /stop to our bot, or by leaving our channel.
5.2Switching Signals off does not affect your Account or anything else you use.
5.3We ask for one separate consent. It is optional. You can give or withdraw it at any time:
- Marketing: news and offers about our Services. Without it, we send you only Signals (unless you have switched them off) and messages about your Account, security and changes to our terms.
5.4You can withdraw a consent:
- on the Consent settings page in the Members Area, or in the App's settings;
- with the unsubscribe link in any marketing email; or
- by emailing info@
symfonite.com.
5.5We act on a withdrawal promptly. It does not affect what we did with your consent before you withdrew it.
5.6We keep a record of each consent and each withdrawal (what you agreed to, when, and the wording you saw), so that we can show what you chose.
5.7Cookies have their own consent, described in the Cookie Policy.
6 Who we share data with
6.1We share Personal Data only with the recipients below, and only as much as each one needs.
| Provider category | What they do for us | Provider and location |
|---|---|---|
| Email delivery | Sends account, security and Signals emails, and marketing emails with your consent | Resend (USA) |
| Push notifications | Delivers notifications to the App on your device | Expo (USA), which passes each notification to Apple or Google for delivery to your device |
| Cloud hosting and database | Runs the Services and stores our data | Amazon Web Services, Frankfurt, Germany, for our servers; MongoDB Atlas, Frankfurt, Germany, for our database; Vercel Inc. (USA), for the Website and the Members Area; Cloudflare, Inc. (USA), for app.symfonite.com |
| Cache | Keeps short-lived technical data that keeps the Services fast and safe | Upstash, Inc. (USA), a managed Redis cache; data stored in Frankfurt, Germany |
| CRM | Keeps our customer records: your contact details, the choices you make with us, how you found us, and our conversations with you and with Partners | HubSpot, Inc. (USA) |
| Analytics | With your consent, measures how the Services are used | Google Analytics, by Google Ireland Limited (Ireland), on the Website and in the Members Area; PostHog, with data stored in the EU, in the App |
| Cookie-free statistics | Counts page visits on the Website and in the Members Area without Cookies and without identifying you | Vercel Inc. (USA) |
| Error monitoring | Collects error and crash reports from our servers and the App so that we can fix problems | Sentry (USA) |
| Network and security | Protects the Services against attacks, and checks that sign-ups and other forms come from a person, not a bot | Cloudflare, Inc. (USA), including Turnstile on the Website and in the Members Area; Google reCAPTCHA, by Google Ireland Limited (Ireland), in the App |
| Email and team messaging | Hosts our mailboxes, including support emails you send us, and carries alerts within our team | Our email hosting provider; Slack (USA) |
6.2Each Processor works under a written contract that requires it to act only on our instructions and to keep the data secure (GDPR Article 28).
| Recipient | What they receive, and why | Who and where |
|---|---|---|
| Telegram | If you connect Telegram, the Signals we send you there. Telegram handles your data under its own privacy policy. | Telegram, as its own controller. Its companies are outside the European Economic Area. |
| If you chat with our sales team on WhatsApp, your messages and phone number. WhatsApp handles your data under its own privacy policy. | WhatsApp, through the WhatsApp Business app on our own devices (no Business API provider). Which WhatsApp company handles your data depends on where you live, as WhatsApp's privacy policy explains. | |
| Professional advisers, auditors and insurers | What they need to advise us, audit our accounts or insure us. | Under duties of confidentiality |
| Authorities, courts and law enforcement | What the law requires us to give, including reports to the Cyprus financial intelligence unit. | In Cyprus, or elsewhere where the law requires |
| A buyer or successor | If our business, or part of it, is sold or reorganised, the data the new owner needs to continue the Services. We will tell you before this happens. | The new owner |
6.3We do not sell your Personal Data.
7 International transfers
7.1We are based in Cyprus, in the European Union. Some of our providers process data outside the European Economic Area (EEA). The provider tables in section 6 show where.
7.2When we transfer Personal Data outside the EEA, we use one of the safeguards the GDPR allows:
- a decision by the European Commission that the country protects data adequately (including, for a company certified under it, the EU–US Data Privacy Framework); or
- the standard contractual clauses approved by the European Commission, with extra measures where they are needed.
7.3Some transfers happen because you ask for them: for example, when we deliver Signals to you on Telegram.
7.4You can ask for a copy of the safeguards we use by emailing info@
8 How long we keep data
8.1We keep Personal Data only as long as we need it for the purposes in this Policy, or as long as the law requires.
| Data | How long we keep it | Why |
|---|---|---|
| Account and profile data | While your Account is open, then up to 2 years after it closes | To answer questions and deal with claims after closure |
| Accounting and tax records | As long as Cyprus accounting and tax law requires | Cyprus accounting and tax law |
| Consent records | While the consent is active, then up to 6 years after you withdraw it | To show what you agreed to |
| Signals delivery logs | Up to 90 days after each delivery is settled; records of your Telegram membership while your Account is open | To investigate delivery problems |
| Support messages and sales-chat records | Up to 2 years after our last message with you | To answer follow-up questions |
| Complaint records | Up to 6 years after the Complaint is closed | To handle complaints and learn from them |
| Security and access logs | Up to 12 months | To detect and investigate security incidents |
| Backups | Deleted data drops out of backups when those backups expire under our backup schedule | Recovery after a failure |
| Cookies | As set out in the Cookie Policy, section 6 | As described there |
8.2When a period ends, we delete the data or make it anonymous. If we need data for a legal claim, an investigation or an authority's request, we keep it until that matter ends.
8.3When you delete your Account (see Terms of Use, section 15), we delete the data we no longer need, and keep the rest only for the periods above.
9 Security
9.1We protect Personal Data with measures suited to the risk. They include encryption in transit, access limited to the people who need it, two-factor authentication for our staff, records of who accessed sensitive data, and regular review.
9.2We do not store broker passwords, which reduces what could be exposed.
9.3No system is completely secure. If a personal data breach is likely to put people's rights at risk, we report it to the data protection authority within 72 hours of becoming aware of it. If the breach is likely to put your rights at high risk, we also tell you without undue delay.
9.4You can help by keeping your login details and two-factor device safe, as Terms of Use, section 5 asks.
10 Your rights
10.1You have these rights over your Personal Data:
- Access: to get a copy of your data and information about how we use it.
- Rectification: to have inaccurate or incomplete data corrected.
- Erasure: to have your data deleted when we no longer have a reason to keep it.
- Restriction: to have us pause using your data while a question about it is resolved.
- Portability: to receive data you gave us, in a common machine-readable format, or have it sent to another organisation, where we use it based on your consent or our contract.
- Objection: to object to our use of your data based on legitimate interests. You can always object to direct marketing, and we will then stop.
- Withdrawing consent: at any time, as section 5 explains.
- Human review: of a decision made only by automated means, as section 13 explains.
10.2To use a right, email info@
10.3We answer within one month of receiving your request. If a request is complex, or you send many, we may take up to two further months; if so, we will tell you why within the first month.
10.4Using your rights is free. If a request is clearly unfounded or excessive, we may charge a reasonable fee or refuse it, and we will explain why.
10.5Some rights have limits set by law. For example, the law may stop us telling you about a report we made to an authority.
12 Children
12.1The Services are not for anyone under 18. We do not knowingly collect data about children. If we learn that we have, we will delete it. If you think a child has given us data, please contact info@
13 Automated checks and decisions
13.1Some of our checks are automated. When you sign up or sign in, automatic checks stop bots, disposable email addresses, sign-ups from Restricted Countries and repeated failed attempts, and can refuse a sign-up or pause sign-in for a while. Other rules flag possible fraud or abuse.
13.2No automated check closes an Account. A person reviews every flag before we close an Account or refuse to work with a Partner.
13.3You can ask for any such decision to be reviewed again by a person, give us your point of view, and challenge the decision, by emailing info@
13.4We do not use automated decision-making for marketing.
14 Changes to this Policy
14.1We update this Policy when our handling of Personal Data changes. Each version shows its version number and effective date, and it takes effect when we publish it on the Website. If we start to use your Personal Data for a new purpose, we tell you before we do. If a change needs your consent, we will ask for it.
14.2Earlier versions are available on request.
15 Contact
15.1Email info@