Legal
Privacy policy
What we collect, why, how long we keep it, and what we do not do with it.
Last updated: 25 October 2026
1. Who we are
Witan Way, LLC, a limited liability company formed in Delaware, United States, is responsible for determining the purposes and means of the processing of personal data through the Service. For any privacy or data protection matter, you may contact us at privacy@witanway.com.
2. What we collect
We collect what the service needs, and no more. When you create an account we collect your email address and your first name; a last name is optional. In your account settings you may add a country and a phone number, both optional, and choose an interface language. In your member area we store the index instruments you pick, so that the Allocation Calculator and the Instruments page agree on which product you would use. Five features that once personalised that area have been retired and now collect nothing further: the short questionnaire that tailored lesson suggestions, the strategy versions you saved, the strategies you followed, your alert preferences, and, as historical data only, your lesson progress. Rows recorded before those features were withdrawn are retained until your account is deleted, and nothing new is added to them. We record which published allocation you last opened, so that the member area can show what changed since your last visit, and the date on which your account was last active. Payment card details are handled end to end by Stripe and never reach our servers; we do store the Stripe customer and subscription identifiers that let us show your billing status and let you manage your subscription. We keep technical records needed to run and secure the service: error reports, email delivery outcomes such as bounces and complaints, and the anonymous visit records described in section 8. Your IP address is never stored; where we need it to limit abuse, we use a truncated one-way hash of it and nothing else.
3. What we never collect
We never ask for or receive your brokerage credentials or account numbers. We never connect to a brokerage account, we never import your real holdings, and we never place an order on your behalf. The Allocation Calculator in your member area is an arithmetic illustration: the portfolio figure you type, the quantities it works out from it, the values those represent and the cash left over are used to draw the page and are not stored, and a fresh visit starts again from the default figure. The instrument you pick for each index is stored, because the calculator and the Instruments page have to agree on it, and it is stored as a preference and nothing more: no quantity, no purchase price and no purchase date is ever attached to it, so it records which product you would use, never that you own any. We never ask about your finances, your income, your net worth, your risk tolerance or your objectives, and no part of the service changes according to who you are. We do not run advertising trackers, we do not build advertising profiles of you, and we do not sell, rent, or trade your data.
4. Why we process it, and our lawful bases
We process your account and billing data to provide the membership you asked for, which is performance of a contract. We process minimal technical data to keep the service secure and working, which is our legitimate interest. We measure how the site is used on the same basis, and that measurement is anonymous and aggregate: it counts visits and pages, it is never attached to your account, and signing in does not turn it into a record about you. That is why we do not ask you to accept trackers. We send the free Charter and other marketing messages only with your consent, which you can withdraw at any time by unsubscribing.
5. Who we share it with
We use a small set of processors, each receiving only the data its function needs: Stripe for payments and invoicing, which also receives your email address at checkout; Supabase for accounts and the database; Resend for email; Sentry for error monitoring; Mux for hosting and streaming the course videos; and Vercel and Railway for hosting. Our own usage measurement is first-party and is shared with no one. Some pages embed a third-party player: public lessons that include a video embed it from YouTube in its no-cookie mode, so opening such a page discloses your IP address and browser to Google, and the course videos inside the member area are served by Mux. Market data comes from EODHD and contains no personal data. Several of these providers are established in the United States. Where personal data leaves the European Economic Area, we rely on the EU-US Data Privacy Framework for a recipient certified under it, and otherwise on the European Commission's standard contractual clauses adopted by Decision 2021/914, together with the United Kingdom international data transfer addendum and the equivalent Swiss provisions.
6. How long we keep it
Account data is kept for as long as you are a member, and afterwards for as long as we are required to keep it. Billing records, meaning what you paid, when, in which currency and the Stripe identifiers that connect them, are kept for seven years, because accounting and tax law requires it; if you ask us to delete your account we keep those records, delete everything else, and tell you which is which. An address that has rejected our mail stays on a do-not-contact list with no end date, held as a one-way fingerprint instead of as the address itself, so that we can honour the objection without keeping the address. Visit records are deleted after thirteen months, and so is the single summary record per browser, counted from that browser's last visit. We keep no error log of our own: technical errors go to our hosting provider's log stream and, where error monitoring is enabled, to Sentry, and both are deleted on those providers' own schedules, which we do not lengthen. When you ask us to delete your account we remove your records as described in section 7; copies may persist for a short period in routine encrypted backups before they are overwritten.
7. Your rights
You may ask us to access, correct, export, or delete your personal data, and to restrict or object to certain processing; where processing is based on consent, you may withdraw it. You also have the right to complain to a data-protection supervisory authority. Some of this is immediate and self-service: you can change your name, country, phone, language, and currency in your account settings at any time, and every marketing email carries a one-click unsubscribe. Export and deletion are handled by people, not by a button: email privacy@witanway.com from the address on your account and we will verify that it is you, tell you what we hold, and carry out the request. We answer within one month of receiving your request. For a request that is complex or where several are received together, we may take up to two further months, and we will tell you within that first month that we are doing so and why. We keep a register of the requests we receive, holding a reference, the date it arrived, the date it was carried out, which categories of records were exported or deleted, and a one-way fingerprint of the address that asked. It holds no copy of anything we deleted, which is the point of it: it shows that a deletion happened without reconstructing what was deleted.
8. Cookies and usage measurement
We use the cookies the service needs to work, for your sign-in session and to remember your language, plus one first-party identifier, stored for one year, that lets us count visits and see which pages are read. We do not use advertising cookies and we do not follow you across other websites. Our measurement is first-party and anonymous: the records stay with us, they are never sold or shared, no IP address is stored, and they are deleted after thirteen months. They are not attached to your account, and they are not attached to it when you sign in either: a visit is counted against that first-party identifier and nothing in the record says who was holding it. What we read from it is how many people came, from where, and which pages they read, never who read what. If you prefer not to be counted at all, the measurement can be switched off for your browser, which is a setting on your side rather than a request to us: write to privacy@witanway.com and we will tell you how. Pages that embed a YouTube or Mux player are subject to those providers' own cookie behaviour, as described in section 5.
9. Children
The service is intended for adults and is not directed at anyone under 18. We do not knowingly collect data from children.
10. Changes and contact
We may update this policy and will change the 'last updated' date above when we do. For anything concerning your data, contact privacy@witanway.com.