Privacy policy

Xavier Gisbert Blanquer (natural person; Backtest Evidence is a trading name)
Carrer Enginyer Vilaplana, 22, 03803 Alcoi, Alicante, Spain
Email: hello@backtestevidence.com (Proton Mail)
Tax ID (NIF): 21693925A

• Handling your request and contract — name, email, summary you send; performance of pre-contractual steps and contract (Art. 6(1)(b) GDPR where applicable).
• Delivering the review — strategy materials you submit after payment; performance of contract.
• Payment — billing data processed by Stripe; see recipients below.
• Legal obligations — tax and accounting retention where required by law.

Contact data; content of emails and forms; files you submit (CSV, documents, code fragments); payment references (not full card numbers, which Stripe processes).

• Stripe — payment processing (Payment Links / invoicing).
• Proton Mail — business email (`hello@backtestevidence.com`). Ordinary email to/from non-Proton addresses is not automatically end-to-end encrypted.
• Proton Drive — per-client empty folder shared temporarily with an Editor link for evidence uploads (CSV, code, notebooks). Link revoked when files are received. Root folder is never shared. No permanent public link.
• Cloudflare — domain/DNS (Registrar) and static site hosting (Pages).

No OneDrive, Dropbox, Tresorit, or similar for client evidence. No sale of personal data. Client strategy files are not uploaded to public AI training services by default.

• Working copies of review materials (Proton Drive folder + local): deleted within 14 days after final report unless earlier deletion requested.
• Contract, invoice, and accounting records are retained for six years after the last relevant accounting entry, or longer where another mandatory legal period applies. Access is restricted to legal, tax, and accounting purposes.
• Request emails that do not result in a contract are deleted within 12 months after the last interaction, unless earlier deletion is requested or retention is required to establish, exercise, or defend legal claims.

Where GDPR applies, you may have rights of access, rectification, erasure, restriction, portability, and objection. Contact hello@backtestevidence.com. You may lodge a complaint with the Spanish Data Protection Agency (AEPD), https://www.aepd.es/.

Some service providers may process personal data outside the European Economic Area. Proton AG is established in Switzerland. Under Proton’s current Data Processing Agreement, transfers are limited where possible to Switzerland, the EU, and countries covered by an adequacy decision; where necessary, Proton relies on applicable EU, Swiss, or UK standard contractual clauses or another lawful transfer mechanism. Cloudflare may process personal data outside the EEA, Switzerland, and the UK; its Data Processing Addendum incorporates the EU Standard Contractual Clauses and corresponding safeguards where applicable. Stripe may process data internationally; its Data Transfers Addendum provides for the EU–US Data Privacy Framework where applicable and the EU Standard Contractual Clauses as an alternative mechanism. Contact hello@backtestevidence.com if you require information about the safeguards applicable to your data.

• Proton Data Processing Agreement
• Cloudflare Customer DPA
• Stripe Data Transfers Addendum

See also commercial/LEGAL_SOURCES.md (consultation dates and source list for operators).

Evidence files (CSV, code, notebooks) are not accepted by email. After verified payment you receive a temporary Proton Drive Editor link to an empty folder created for your engagement only. That share is revoked when files arrive. Proton Mail is for correspondence and links only. Do not send API keys or exchange passwords.