Privacy Policy
We sell a desktop application that runs on your machine, so there is remarkably little to say here — but what there is, we say exactly. This notice covers the website and the MarketData Hub Client, and it describes what the software in fact does, not what a template says it might.
The short version
- We never see what you download. The application fetches from Dukascopy Bank SA directly, machine-to-source. Which instruments, date ranges and timeframes you choose are never transmitted to us — this is structural, not a promise: the licence protocol has no field to carry them.
- We do not store your IP address. Our visitor analytics discard it entirely; nothing is sent to a geolocation provider.
- We set no tracking cookies, run no advertising or cross-site tracking, and embed nothing from a third-party domain — the typeface included.
- We never see your card details. Payment is handled entirely by Stripe.
- We do not sell, rent or share personal data with anyone beyond the processors listed below.
Controller
The controller for the processing described here, within the meaning of Art. 4(7) GDPR, is:
| Controller | Martin Buessler, Einzelunternehmen (registered sole proprietorship) |
|---|---|
| Address | Geblergasse 63/9, 1170 Vienna, Austria |
| team@marketdata-hub.com | |
| Trade register | GISA 38748820 — see the Impressum |
We are not required to appoint a data protection officer (Art. 37 GDPR) and have not appointed one voluntarily. Write to the address above for anything concerning your data; it reaches the owner directly.
What we process, why, and on what basis
1. Visiting the website
Our host, Google (Firebase Hosting), records standard server request logs including your IP address, to deliver the site and defend it from abuse. Those logs are Google's; we do not query them and do not build profiles from them. Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in operating and securing the site.
Beyond that, this website loads nothing from anyone else. There is no content delivery network, no embedded video, no social widget, no tag manager. Even the typeface is served from our own domain rather than from Google Fonts — precisely so that reading a page discloses your IP address to no third party.
2. Our own visitor analytics
To know whether the site works — which pages are read, where visitors arrive from, whether anyone reaches the pricing section — we run a small first-party counter rather than a commercial analytics suite. It records:
| Random visitor / session id | Generated in your browser, kept in localStorage / sessionStorage. Not derived from anything about you and not linkable to any other site. |
|---|---|
| Page path, referrer, landing page | What was read, and which link or search led here. |
| Browser language, timezone, screen size, user-agent string | Sent by your browser. The timezone is mapped to a country — that is the only location data we hold, and it is coarser than the city-level lookup this site used to perform. |
| Interaction counts | Which instrument, category or search term was opened, and which buttons were used. |
| Your email address if you are signed in | So we can tell an account's activity apart from anonymous traffic (see the note below). |
Your IP address is not stored, not logged by us and not sent to anyone. Earlier versions of this site did store it and did submit it to a third-party geolocation service; that has been removed, and the historic records were purged.
These records are deleted automatically 180 days after your last activity, by a server-side retention rule. Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in understanding, at aggregate level, whether a product nobody has bought yet is being found and understood. We consider the impact minimal: no cookies, no IP, no cross-site tracking, no profiling, and a hard expiry. You may object at any time under Art. 21 (see Your rights).
3. Your account
Creating an account stores your email address, a Firebase user id, the registration timestamp, and whether a licence has been purchased. If you sign in with Google, Google confirms your identity to us and we receive your email address; we never receive your Google password. If you register with a password, the password is stored only as a hash, by Google Firebase Authentication, and is never visible to us. Legal basis: Art. 6(1)(b) GDPR — performance of the contract you enter into by creating an account.
4. Purchases
Checkout runs entirely on Stripe's own hosted pages. Card numbers never reach our servers — we cannot see them at any point. Stripe reports back to us the payment status, the amount, the currency, the purchased licence tier and the email address you gave at checkout, and we store those against your account together with the Stripe session id. Legal basis: Art. 6(1)(b) GDPR for supplying what you bought, and Art. 6(1)(c) for the records tax law requires us to keep. Stripe is a separate controller for its own payment and fraud-prevention processing; see Stripe's privacy policy.
5. Licence activation on your devices
When you activate the application on a computer, it sends us a sign-in token, the application version, and a machine identifier: a one-way hash derived from an installation id your operating system already holds. It is not your hardware serial, not your hostname and not your username, and it cannot be reversed into any of them. We store one entry per activated machine, with the activation and last-seen timestamps, so that a licence can be tied to the machines it was actually activated on and so we can help you if activation fails. Legal basis: Art. 6(1)(b) GDPR — delivering the licence you bought — and Art. 6(1)(f) for preventing wholesale licence sharing.
6. Email we send you
We send a short welcome message when an account is created and a receipt when a purchase completes. Both go out through Resend, our email processor, which receives your address and the message. We run no newsletter and send no marketing campaigns. Mail you send to our published address is forwarded to the owner's mailbox, again via Resend, so we can answer it. Legal basis: Art. 6(1)(b) GDPR for transactional messages, Art. 6(1)(f) for replying to your correspondence.
7. The launch notification list
If you ask to be told when the application is downloadable, we store your email address, when you asked, and the page you asked from. You get exactly one message, at launch. It is not a newsletter, the address is not shared, and you can have it deleted at any time by writing to us. Legal basis: Art. 6(1)(a) GDPR — your consent, withdrawable at any time with effect for the future.
8. The desktop application
The application talks to us three times, and never about your data: to activate or check your licence, to read a small public configuration file that is identical for every user, and to open this website in your browser so you can sign in. It contains no telemetry, no crash reporting and no analytics. Your instrument selections, date ranges, destination folders and downloaded files stay on your computer. Application binaries are hosted on GitHub, so downloading one discloses your IP address to GitHub in the ordinary way.
A note on the signed-in email in analytics
Because the analytics endpoint is open (it has to be — it is called by browsers before anyone signs in), the email address it receives is asserted by the browser and is not independently verified. We use it only to connect an account's own visits, never to identify third parties, and it disappears with the rest of the record after 180 days.
Who else processes your data
We keep the list as short as the product allows. Each of these acts on our instructions under a data processing agreement, except where noted:
| Google Ireland / Google LLC | Web hosting, database, authentication and serverless functions. Accounts, licences and analytics are stored in Google's US multi-region (Firestore location nam5); the application server runs in us-central1 (Iowa, USA). Web pages themselves are served from Google's global edge network, so the file you receive comes from a server near you. |
|---|---|
| Stripe | Payment processing. Separate controller for its own payment data. US / Ireland. |
| Resend | Sending and forwarding email. United States. |
| GitHub (Microsoft) | Hosting the downloadable application binaries. United States. |
Transfers to the United States are made under the EU–US Data Privacy Framework where the recipient is certified, and otherwise on the European Commission's Standard Contractual Clauses. We do not sell personal data, and nothing here is used for advertising.
How long we keep things
| Visitor analytics | 180 days after the last activity, then deleted automatically. |
|---|---|
| Account and licence data | For as long as the account exists; deleted on request, subject to the tax records below. |
| Payment records | Seven years, as Austrian tax law requires (§132 BAO). |
| Launch notification list | Until the launch message has been sent, or until you ask to be removed. |
| Support correspondence | As long as needed to deal with the matter and any follow-up. |
Cookies and local storage
We set no cookies of our own, and no advertising or cross-site tracking cookies are used anywhere on this site. What we do use is your browser's local storage, which never leaves your device unless listed above:
mdh_visitor_id, mdh_session_id | Random ids for the analytics described above. |
|---|---|
marketdata-theme, marketdata-currency | Your dark/light and currency preferences. |
pendingStripeSession | Holds a checkout reference just long enough to confirm your payment. |
| Firebase Authentication | Keeps you signed in between visits. |
Clearing your browser storage removes all of them.
Automated decision-making
None. We do not profile you and make no automated decisions producing legal or similarly significant effects (Art. 22 GDPR).
Your rights
Under the GDPR you have the right to access your data (Art. 15), to have it corrected (Art. 16) or erased (Art. 17), to restrict processing (Art. 18), to receive it in a portable form (Art. 20), to object to processing based on legitimate interests including our analytics (Art. 21), and to withdraw consent at any time with effect for the future (Art. 7(3)).
To exercise any of them, write to team@marketdata-hub.com. There is no form and no fee; it reaches one person and we will answer within a month. Providing data is not a statutory requirement — but an account cannot exist without an email address, and a licence cannot be activated without a machine identifier.
You also have the right to complain to a supervisory authority. Ours is the Austrian Data Protection Authority (Österreichische Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, dsb.gv.at — and you may equally complain to the authority where you live.
Changes
If what the software collects changes, this page changes in the same release. Material changes will be noted here with a new date.
Last updated: 2026-07-21. See also the Impressum, the Terms of Use and our data methodology.