Privacy policy

Last updated: 24 October 2026

1. Controller

Email: dertriebpy@gmail.com

MeinStier is run from Paraguay. Because the website and app are offered to people in the European Union, the EU General Data Protection Regulation (GDPR) applies to their data, and this policy follows it.

2. Visiting the website (hosting)

The website is hosted by Vercel Inc., 440 N Barranca Ave #4133, Covina, CA 91723, USA. When you visit, Vercel processes technically necessary data: IP address, date and time, page requested, referrer, browser and operating system (server log files), to deliver the site and protect it against attacks. Legal basis: our legitimate interest in a secure, working website (Art. 6(1)(f) GDPR). Vercel deletes these logs after a short time.

3. Beta waiting list

When you join the private beta we store your email address, your name and the holding companies you follow (if you enter them) and the time of sign-up. To protect the list from automated sign-ups we also store a shortened, salted hash of your IP address for at most 24 hours.

Purpose: to send you a beta invite and allocate places. No newsletter, no advertising, no sharing with third parties.

Legal basis: your consent (Art. 6(1)(a) GDPR), given when you submit the form. You can withdraw it at any time by emailing dertriebpy@gmail.com; we then delete your entry. Spam protection: our legitimate interest (Art. 6(1)(f) GDPR).

Retention: until your invite is sent or the beta ends, at most 12 months, or until you withdraw your consent.

Where it is stored: in a database run for us by Supabase Inc. (processor), with servers in São Paulo, Brazil. Invitation and service emails are sent from meinstier.com through Resend, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA, as our processor.

Spam check (Cloudflare Turnstile)

When you click into the form we load Cloudflare Turnstile from Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. Turnstile checks technical characteristics of your browser and your IP address to tell people from bots; it sets no advertising or tracking cookies. Legal basis: our legitimate interest in protecting the list from automated sign-ups (Art. 6(1)(f) GDPR). See the Turnstile privacy policy. If you don't use the form, your browser never contacts Cloudflare.

4. Transfers outside the EU

Your data is processed outside the EU/EEA: by us in Paraguay, in our database in Brazil, and by Vercel, Cloudflare and Resend in the USA. There is no EU adequacy decision for Paraguay. Our service providers are bound by the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR); Vercel and Cloudflare are also certified under the EU-US Data Privacy Framework (Art. 45 GDPR).

5. Fonts and images

Fonts (IBM Plex) and images are served from our own website; nothing is sent to Google or other third parties.

6. Cookies and tracking

We set no cookies and use no analytics, tracking or advertising services.

7. Your rights

You have the right to access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20) and to object to processing based on legitimate interests (Art. 21). You can withdraw consent at any time with effect for the future (Art. 7(3)). Just email dertriebpy@gmail.com.

You can also lodge a complaint with a data protection supervisory authority, in particular in the EU member state where you live or work or where the alleged infringement took place (Art. 77 GDPR).

8. The MeinStier app

What we store: your email address and a securely hashed password (your account); the portfolio holdings, targets, budgets and trade plans you enter; and bank transactions you import or add (date, amount, payee, description, category). Bank statements are read on your phone — only the transaction lines you import are stored, not the file.

Purpose and legal basis: to provide the app you signed up for (Art. 6(1)(b) GDPR). Your data is only visible to your own account (enforced by row-level security in the database) and is never sold, shared or used for advertising.

Where: the database run by Supabase Inc. (servers in São Paulo, Brazil); account and service emails (confirmation, password reset, reports you request) are sent through Resend, Inc. (USA). Both are processors bound by the EU Standard Contractual Clauses.

Retention: while your account exists. Ask us at dertriebpy@gmail.com to delete your account and all its data; we do so within 30 days. You can delete single transactions in the app at any time.

9. Changes

We update this policy when the website or the law changes. The version published here applies.