NORDSIGHT
Privacy policy

How we handle your data.

Last updated: 10 June 2026

1. Who's responsible

Nordsight is operated by Gereon Viktor Seifert (private individual, Cologne, Germany) — a non-commercial pre-launch project. For all privacy questions: gereon.seifert@gmail.com. See also the Impressum at /impressum.

2. What we collect

We hold the minimum data needed to run the service. Specifically:

  • Account data: email, name, password (stored as a bcrypt hash, never plaintext).
  • Verification timestamps: when you verified your email, when your last session was created.
  • Plan data: the portfolio plans you build or import — bucket weights, example tickers, optional cash and total values.
  • Profile snapshot: your onboarding answers (goal, time horizon, risk behaviour, tax residency, capital range, investing experience and confidence).
  • Position data: tickers, units, buy prices, current values for any positions you import or enter.
  • Lesson progress: which lessons in the Learn course you've completed and your quiz scores.
  • Session cookies: an httpOnly cookie with a random token, valid 30 days, used only to keep you signed in.

We do not collect: IP-based location, device fingerprints, your real-money broker credentials (we never ask), or any third-party tracking data.

3. Why we collect it (lawful basis)

  • Performance of a contract (GDPR Art. 6(1)(b)): account data, plan data, position data, session cookies — without these, the service can't deliver what you signed up for.
  • Consent (Art. 6(1)(a)): optional emails (if any are ever sent).
  • Legitimate interest (Art. 6(1)(f)): minimal security logging to detect abuse.

4. Who we share it with

Limited third-party processors, used only to run the service:

  • Vercel — application hosting (serves the app; processes requests).
  • Neon — the PostgreSQL database, hosted in the EU (Frankfurt). This is where your account, plan and progress data live.
  • Resend — sends verification, magic-link and password-reset emails. Sees your email address and the message contents.
  • Anthropic / LangDock — only when you actively use an AI feature (e.g. screenshot import of a portfolio): the image/text you submit is sent to the model to extract the data. No account data is sent unless you trigger such a feature.

We do not sell your data, share it with advertisers, or share it with brokers. There are currently no paid services and therefore no payment processor.

5. How long we keep it

  • Account data: until you delete your account, then immediately erased.
  • Sessions: 30 days from last activity, then auto-expired.
  • Verification tokens: auto-consumed; expired tokens are pruned.
  • Backups: short-term database backups are managed by our database host (Neon); old backups roll off automatically per their retention.
  • Aggregated, anonymous metrics: may be kept indefinitely (e.g. "X plans created last month" — no personal data).

6. Your rights

Under GDPR Articles 15-22, you can:

  • Access (Art. 15) — request a copy of everything we hold. Download it as JSON from your account page.
  • Rectify (Art. 16) — edit your profile via the onboarding redo flow or your plans directly.
  • Erase (Art. 17) — delete your account immediately from /account. Cascades through every record.
  • Restrict / object (Arts. 18, 21) — email us.
  • Portability (Art. 20) — the JSON export is machine-readable.
  • Lodge a complaint with your data protection authority (in Germany: BfDI or your state DPA).

7. Cookies

Nordsight sets a single essential cookie: axon_session, used to keep you signed in. It's httpOnly (not accessible to JavaScript) and SameSite=Lax (not sent on cross-site requests). No analytics, marketing, or third-party cookies.

8. International transfers

Your account and plan data live in the EU (Neon, Frankfurt). Application hosting (Vercel) and the AI features (Anthropic via LangDock) may process some requests outside the EU/EEA; where that happens we rely on Standard Contractual Clauses (SCCs).

9. Children

Nordsight is not directed at children under 16 and we don't knowingly collect data from them. If you're a parent and believe your child has signed up, contact us and we'll delete the account.

10. Changes to this policy

We'll post material changes before they take effect. The "last updated" date at the top tracks the version.