OptWheel ("OptWheel", "we", "us") is operated by Compass Innovation Limited, a company registered in England and Wales (company number 17126026) with its registered office at 5 Argyle Street, Bath, BA2 4BA, United Kingdom. We are the data controller for the personal data described in this policy.
Contact for privacy matters: support@compassinnovation.co.uk.
| Data | Where it lives | Purpose | Lawful basis |
|---|---|---|---|
| Email address, hashed authentication credentials, sign-in method | Supabase (our authentication provider) | Creating and securing your account; sign-in; service emails (e.g. magic links, receipts) | Performance of a contract |
| Subscription plan and status, billing period end | Supabase profile record, driven by Stripe events | Knowing which features you can access | Performance of a contract |
| Payment details (card number, billing address) | Stripe only — never on our systems | Taking payment, invoicing, fraud prevention | Performance of a contract; legal obligation (tax/accounting) |
| Data-service request logs (IP address, requested ticker symbols, timestamps) | Cloudflare (our data proxy) | Operating the market-data relay; preventing abuse; capacity planning | Legitimate interests (running and protecting the service) |
| Support correspondence | Our email provider | Answering your questions | Legitimate interests |
| Positions, paper trades, watchlists, monitors, preferences, observed IV history | Your device only (local storage) | Making the app work | Not transmitted to us |
We do not collect special-category data, and we do not use automated decision-making that produces legal or similarly significant effects.
Each processor acts under contract terms that meet UK GDPR Article 28 requirements. Market data itself (quotes, option chains) is fetched from third-party public sources via our proxy; those sources receive the requested ticker symbols from our servers, not your identity.
Some processors store data outside the UK/EEA (for example, in the United States). Where that happens, transfers are safeguarded by the UK International Data Transfer Agreement/Addendum or EU Standard Contractual Clauses, and by the processors' own certifications where applicable (e.g. the EU–US / UK–US Data Privacy Framework).
Under UK GDPR (and EU GDPR where it applies) you have the right to access, rectify, erase, restrict, object to and port your personal data, and to withdraw consent where processing is based on consent. To exercise any right, email support@compassinnovation.co.uk — we respond within one month.
You also have the right to complain to the Information Commissioner's Office (ico.org.uk) or, if you are in the EEA, to your local supervisory authority.
This website sets no advertising or analytics cookies. The OptWheel application uses:
| Item | Type | Purpose | Duration |
|---|---|---|---|
| Supabase auth token | Strictly necessary (local storage) | Keeping you signed in | Until sign-out / expiry |
| wheel:* keys | Functional (local storage) | Your settings, positions, watchlists, monitors and observed IV history — on your device only | Until you clear saved data |
| Stripe checkout cookies | Strictly necessary (on Stripe's domain) | Secure payment session and fraud prevention | Per Stripe's policy |
Because we use only strictly-necessary and functional storage, no cookie consent banner is required; if we ever add analytics or marketing cookies, we will ask for consent first.
Traffic is encrypted in transit (TLS). Account data is held by Supabase with access restricted to the operator. Payment data is handled entirely by Stripe, a PCI-DSS Level 1 provider. No method of transmission or storage is completely secure; we will notify you and the ICO of any breach where legally required.
OptWheel is not intended for, and may not be used by, anyone under 18. We do not knowingly collect data from children.
We will post any changes to this policy on this page and update the date above. Material changes will be notified by email or in-app notice.