This Privacy Policy explains how Matrix Escape Ltd. ("we", "us", or "our") collects, uses, stores, and protects your personal data when you visit our website at matrix-escape.net ("Site") or use our products and services ("Services").
We are committed to protecting your privacy and complying with applicable data protection laws, including the General Data Protection Regulation (EU) 2016/679 ("GDPR") and the ePrivacy Directive 2002/58/EC. We only collect personal data that is necessary for the purposes described in this policy (data minimization principle).
1. Data Controller
The data controller responsible for your personal data is:
Matrix Escape Ltd.
Address: ul. Konarevo 30, 2770 Bansko, Bulgaria
UIC (Unified Identification Code): 208633740
Email: admin@matrix-escape.net
2. Data We Collect
2.1 Account and Authentication Data
When you sign in, we collect your email address. A valid email address is required to use the Services, as it is necessary for authentication and subscription management. We use email-based one-time verification codes for authentication. We do not use passwords. If you do not provide your email address, you will not be able to access or use the Services.
2.2 Payment Data
All payment processing is handled by Stripe, Inc. We do not collect, store, or have access to your full credit card number, CVV, or other sensitive payment credentials. The data we receive from Stripe includes:
- Stripe customer ID
- Email address associated with payment
- Name provided at checkout
- Subscription status, plan, and billing period
- Invoice amounts and payment status
- TradingView username (provided voluntarily at checkout, used solely to grant you access to the purchased indicators on the TradingView platform)
For details on how Stripe handles your payment data, please see Stripe's Privacy Policy.
2.3 Newsletter Subscription
If you voluntarily subscribe to our newsletter, we collect your email address for the sole purpose of sending you newsletter communications. Newsletter subscription is entirely optional and requires your explicit consent (opt-in). We will never automatically add you to the newsletter list through any other interaction with our Services, including purchasing a subscription or signing in to your account.
2.4 Analytics Data
We use Vercel Analytics to collect aggregated usage data such as page views, referral sources, and general geographic region. This data is designed to minimize the collection of personal data and is used solely to understand how our Site is used and to improve the Services. We also collect UTM parameters (utm_source, utm_medium, utm_campaign, utm_term, utm_content) from inbound links for marketing attribution purposes. These are stored in your browser's local storage and passed to Stripe as session metadata.
2.5 Cookies and Local Storage
We use browser local storage to maintain functionality essential to the Services. The following are stored locally:
- Authentication token (JWT): Required for your session to work - essential
- Plan selection preferences: To remember your chosen plan during checkout - essential
- UTM parameters: Used for marketing attribution and performance measurement. These are not used for profiling or cross-site tracking
- Cookie consent preference: To remember your consent choice - essential
All local storage entries listed above are strictly necessary for the Site to function correctly and do not require separate consent under the ePrivacy Directive. We do not use third-party advertising or tracking cookies. We do not use cookies for behavioral profiling or cross-site tracking.
3. How We Use Your Data
We use your personal data for the following purposes:
- Authentication: To verify your identity and provide access to your account and subscriptions
- Service delivery: To manage your subscriptions, process payments via Stripe, and grant access to purchased indicators on TradingView
- Communication: To send transactional emails (verification codes, payment confirmations) and, only if you opted in, newsletter communications
- Admin notifications: To notify our team of subscription events for operational purposes
- Analytics: To understand how our Site is used and improve our Services
- Marketing attribution: To track the effectiveness of marketing campaigns via UTM parameters
- Fraud and abuse prevention: To detect and prevent unauthorized access, fraudulent transactions, and abuse of the Services
4. Legal Basis for Processing (GDPR)
We process your personal data on the following legal bases:
- Contract performance (Art. 6(1)(b) GDPR): Processing necessary to fulfil your subscription and provide the Services you purchased, including authentication, payment processing, and granting access to indicators
- Consent (Art. 6(1)(a) GDPR): For newsletter communications. You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal
- Legitimate interest (Art. 6(1)(f) GDPR): For analytics, security, fraud and abuse prevention, and improving our Services. Our legitimate interest is balanced against your rights and does not override your fundamental privacy rights
5. Data Sharing and Processors
We share personal data only with the following categories of recipients:
- Stripe, Inc. - Payment processing. Stripe acts as an independent data controller for payment data
- Vercel, Inc. - Website hosting and analytics
- Secure third-party email delivery provider (transactional email service) - For sending verification codes and newsletter emails
All third-party processors we engage operate under GDPR-compliant data processing agreements (DPAs) or equivalent contractual safeguards. We ensure that each processor provides sufficient guarantees regarding the security and lawful processing of your personal data.
We do not sell, rent, or share your personal data with third parties for their marketing purposes. We do not engage in data brokering.
6. Data Retention
We retain your personal data as follows:
- Account and subscription data: For as long as your account is active, and for up to 5 years after account closure or subscription cancellation, as required by Bulgarian tax and accounting legislation (Accountancy Act, VATR)
- Newsletter email addresses: Until you unsubscribe or request deletion, whichever comes first
- Payment and invoice records: Up to 5 years after the transaction date, in accordance with tax and accounting requirements
- Analytics data: Aggregated and anonymized; retained indefinitely as it is treated as non-personal data due to its aggregated and anonymized nature
After the applicable retention period, personal data is securely deleted or anonymized.
7. Data Security
We implement appropriate technical and organizational measures to protect your personal data, including:
- Encrypted connections (HTTPS/TLS) for all data in transit
- Secure, tokenized payment processing via Stripe (PCI DSS compliant)
- Database access restricted to authorized personnel only
- JWT-based authentication with expiring tokens
8. Automated Decision-Making
We do not use automated decision-making or profiling that produces legal effects or similarly significantly affects you. No decisions about your access, pricing, or account status are made solely by automated means without human involvement.
9. Your Rights (GDPR)
If you are located in the European Economic Area, you have the following rights:
- Right of access (Art. 15): Request a copy of the personal data we hold about you
- Right to rectification (Art. 16): Request correction of inaccurate or incomplete data
- Right to erasure (Art. 17): Request deletion of your personal data ("right to be forgotten"), subject to legal retention obligations
- Right to restrict processing (Art. 18): Request limitation of processing in certain circumstances
- Right to data portability (Art. 20): Receive your data in a structured, commonly used, machine-readable format
- Right to object (Art. 21): Object to processing based on legitimate interest
- Right to withdraw consent (Art. 7): Withdraw newsletter consent at any time without affecting the lawfulness of prior processing
To exercise any of these rights, please contact us at admin@matrix-escape.net. We will respond within 30 days of receiving your request. We may request verification of your identity before processing your request to ensure we protect your data from unauthorized access.
You also have the right to lodge a complaint with your local data protection supervisory authority. In Bulgaria, this is the Commission for Personal Data Protection (CPDP): www.cpdp.bg.
10. International Transfers
Your data may be processed by third-party services (Stripe, Vercel) located outside the European Economic Area. Where such transfers occur, they are protected by appropriate safeguards such as Standard Contractual Clauses (SCCs) or the service provider's participation in recognized data protection frameworks (e.g., the EU-U.S. Data Privacy Framework).
11. Children's Privacy
Our Services are not directed to individuals under the age of 18. We do not knowingly collect personal data from minors. If we become aware that we have collected data from a child under 18, we will promptly delete it.
12. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page with a revised "Last updated" date. We encourage you to review this page periodically.
13. Contact
If you have any questions or concerns about this Privacy Policy or our data practices, please contact us:
Matrix Escape Ltd.
Address: ul. Konarevo 30, 2770 Bansko, Bulgaria
UIC (Unified Identification Code): 208633740
Email: admin@matrix-escape.net
