Last updated: 5 November 2026.
1. Who is responsible
Justin Jaeger (controller). Email: contact@backtestatlas.com.
2. Visiting the website
Hostinger hosts the site. To deliver it and to block attacks, its servers process technical request data such as your IP address, browser type and time of access, and keep them in server logs for a short time. We use no analytics or advertising services. The font is served from our own domain, so no third party sees your visit.
Your browser stores two settings locally, not as cookies: your light or dark mode choice and your personal MCP token. The token is a random number that does not identify you. Both stay on your device, and you can delete them in your browser.
Legal basis: our legitimate interest in a secure, working website (Art. 6(1)(f) GDPR). The local settings are strictly necessary for features you use.
3. MCP server and HTTP API
- Limits: To enforce the daily limits we count calls per personal URL or key and per one-way hash of the IP address. These counters are kept in memory only and reset every day.
- Usage log: For each call we store the time, the plan, a shortened one-way hash of your personal URL or key, the tool and its arguments, for example the idea text. We do not store IP addresses. For paid plans the hash can be linked to your account, so the log is pseudonymous, not anonymous.
- Why: to run the service, prevent abuse and learn which questions people ask, so we can improve the register.
- How long: 12 months. After that, entries are deleted automatically.
Legal basis: our legitimate interest in operating and improving the service (Art. 6(1)(f) GDPR), and for paid plans the contract (Art. 6(1)(b) GDPR). Please do not put personal data into your queries.
4. Anonymous sharing
Only if you switch it on in check_backtest, we additionally store the numbers you send (Sharpe ratio, trades, years, variants, market, timeframe and an optional short description) without your hash or any identity, to build aggregated statistics. No code is stored. Please keep personal data out of the description.
5. Paid plans
Stripe processes your payment. We never see your full card details. From Stripe we receive your name, email address, billing country, plan and the token of the URL you upgraded. We store your key only as a hash, together with your email address.
Legal basis: the contract (Art. 6(1)(b) GDPR) and our legal duty to keep invoices (Art. 6(1)(c) GDPR). Invoices are kept for as long as tax law requires, usually up to 10 years. Stripe also processes data for its own purposes, such as fraud prevention; see the Stripe privacy policy.
6. Email
If you write to us, we use your message and address to answer you and keep them for up to 3 years, unless the law requires longer.
7. Service providers
- Hostinger: website, domain and email
- Fly.io: MCP server and API, region US East
- Stripe: payments
These providers process data on our behalf under data processing agreements. Some are based in the USA. Transfers outside the EU rely on the EU–US Data Privacy Framework where the provider is certified, otherwise on the EU standard contractual clauses.
8. What we do not do
We do not sell or rent personal data, do not use it for advertising and do not make automated decisions about you that have legal or similar effects.
9. Your rights
You can ask for access to your data, correction, deletion, restriction or a copy in a common format. You can object to processing based on legitimate interest and withdraw consent at any time. Write to contact@backtestatlas.com; we answer within one month. You can also complain to a data protection authority, for example the one where you live.
10. Security
All connections use HTTPS. Keys are stored only as hashes, and we keep as little data as possible.
11. Children
The service is meant for adults and not directed at people under 18.
12. Changes
We update this policy when the service changes. The date at the top shows the current version.