01Introduction

What this policy covers, who we are, and which law applies.

This Privacy Policy describes how LogicBanker ApS (hereinafter referred to as the ‘Company’, ‘we’, ‘us’, or ‘our’) collects, uses, shares, and protects your personal data when you use the LogicBanker platform, including the website at logicbanker.com, the LogicBanker mobile applications for iOS and Android, and all related services (collectively, the ‘Platform’). We process your personal data in accordance with the General Data Protection Regulation (EU) 2016/679 (‘GDPR’), the Danish Data Protection Act, and other applicable data protection legislation.

02Data controller

LogicBanker ApS decides how your data is used. Write to [email protected] about anything data-related.

The data controller responsible for processing your personal data is: LogicBanker ApS, Slotsmarken 12, 1. th., 2970 Hørsholm, Denmark, CVR: 39409291. For questions regarding data processing, contact us at [email protected].

03Personal data we collect

Email and progress so the product works, country so the currency is right, usage data so we can fix what is broken. Ad measurement only if you say yes.

We collect personal data about you when you register, use the Platform, and interact with our services. The categories of personal data we collect include:

Account information: email address, username, display name, password (encrypted), date of birth, country of residence, and profile picture.
Identity verification data: full legal name, government-issued identification documents, and bank account or payment details (collected when required for KYC verification and prize payouts).
Authentication data: data received from third-party login providers (Google, Apple) when you choose to register or log in via their services, including your name, email address, and profile picture.
Gameplay and behavioural data: all interactions with Platform features including Pulse responses, tournament decisions, prediction submissions, portfolio trades, AI assistant conversations, chat messages, achievement progress, streak data, and competitive rankings.
Financial knowledge data: assessment results, learning progress, skill ratings (including Academy Score and Pulse Score), knowledge category mastery levels, and educational progression data.
Device and technical data: IP address, device type and model, operating system and version, browser type and version, screen resolution, language settings, unique device identifiers, and push notification tokens.
Usage data: which pages and features you use and when, while you're logged in, and campaign details about where you came from when you signed up.
Communication data: messages sent through the Platform’s chat and social features, support inquiries, and feedback submitted to the Company.
Subscription and payment data: subscription status, plan type, billing history, payment method type (we do not store full payment card details, these are handled by our payment processors).

Field	Purpose	Legal basis	Who sees it	Retention
First name	Shown on your profile and on the class roster. Used when we handle abuse.	Our agreement with you, and in cases of abuse our legitimate interest in protecting the Platform.	Your teacher and your class. Others according to your choice in Settings. Everyone can see your initials.	For as long as the account exists.
Last name	Shown on the class roster. Used when a prize is paid out and when we handle abuse.	As for first name. Statutory identity checks are described in the identity verification section.	Your teacher and your class. Others according to your choice in Settings. Everyone can see your initials.	For as long as the account exists.
Display name	The name other people see you under on the Platform.	Our agreement with you.	Everyone.	For as long as the account exists.
Date of birth	The age limit of 12 and the specific rules for users under 18.	Our agreement with you and our legitimate interest in protecting minors.	Nobody but you.	For as long as the account exists.

We do not collect location data beyond your country of residence, your contacts, microphone input, clipboard contents, or an advertising identifier, and we do not access data belonging to other applications on your device. Camera images and face data are processed only if you choose to complete identity verification.

Our primary purposes for collecting your personal data are:

To provide, operate, and maintain the Platform and deliver the services you have requested.
To identify, authenticate, and verify you as a user.
To administer competitions, register prizes, and process cash prize payouts.
To personalise your experience, including providing tailored content, recommendations, and AI-powered features.
To collect statistics and analyse how the Platform is used, with the aim of improving the user experience and developing new features.
To display relevant information, statistics, and insights about your gameplay, performance, and progress.
To monitor the Platform for abuse, cheating, fraud, or other violations of our Terms and Conditions.
To create aggregated, anonymised, and de-identified datasets for commercial purposes, including providing insights, benchmarks, analytics, and reports to third-party partners such as financial institutions, educational organisations, and research bodies.
To develop, train, and improve the Company’s AI models, algorithms, scoring systems, and analytical tools.
To communicate with you about your account, including service updates, security alerts, and administrative messages.
To market the Platform and, if you have consented, to measure and improve our ads.

We will use the email address and push notification tokens you provide to send you the following types of messages:

Essential messages related to your account, security, and the operation of the service.
Updates about your progress, including notifications about completed achievements, leaderboard changes, performance reports, and reminders to engage with the Platform.
Social notifications such as friend requests, updates on your friends’ progress, and interactions with other players.
Educational messages to help reinforce your learning and enhance your financial knowledge, including insights on market trends and reminders to practice through in-game challenges.
Announcements about new features, competitions, updates, and promotional offers.

04Legal basis for processing

Four legal grounds under the GDPR: contract, legitimate interest, consent, and legal obligation.

We process your personal data on the following legal bases under the GDPR:

Contract (Article 6(1)(b)): Processing necessary to perform our contract with you, including providing the Platform, managing your account, administering competitions, and processing prize payouts.
Legitimate interest (Article 6(1)(f)): Processing necessary for our legitimate business interests, including improving and developing the Platform, measuring use of the Platform by account holders, counting visits and sign-ups per campaign, ensuring security and preventing fraud, creating aggregated and anonymised datasets for commercial use, developing and improving AI models using anonymised interaction data, providing aggregated insights and analytics to third-party partners, and marketing the Platform. We have conducted balancing tests to ensure our legitimate interests do not override your fundamental rights.
Consent (Article 6(1)(a)): Processing based on your explicit consent, including sending marketing communications and ad measurement (see Ad measurement). You may withdraw your consent at any time under Settings, Privacy, without affecting the lawfulness of processing carried out before withdrawal.
Legal obligation (Article 6(1)(c)): Processing necessary to comply with legal obligations, including KYC requirements, tax reporting obligations, and responding to lawful requests from public authorities.

05Profiling

We build a skill profile from how you play, to personalise your learning. You can object to it.

We engage in profiling as defined under GDPR Article 4(4). Specifically, we create and maintain profiles about you based on your use of the Platform, including: skill ratings and scores (such as Pulse Score, Academy Score, and category mastery levels) derived from your gameplay performance; behavioural analytics reflecting your engagement patterns, learning progression, and competitive performance; and personalised content recommendations based on your interests and activity. These profiles are used to provide you with a personalised educational experience and to improve our services. We do not currently create broker suitability reports or share profiles through broker-referral accounts. You have the right to object to profiling under Article 21 GDPR. See 'Your rights' below.

06Product measurement

When you're logged in, we record how you use the Platform, for example which pages and features you use and which version of a new feature you see. With it we store technical information such as IP address, browser or device type and country.

The purpose is to improve and develop the Platform, and the legal basis is our legitimate interest (Article 6(1)(f)). Without a login we record nothing and store nothing on your device for measurement. What is shared with ad platforms, if you said yes, is described under Ad measurement.

You can object at any time under Settings, Privacy. Recording then stops, and we delete which versions of new features you have seen.

07AI and automated processing

AI features send your prompts to third-party providers. Automated scores affect rankings, and you can ask a person to review one.

The Platform uses AI and automated decision-making systems for several purposes, including: generating personalised responses through the W.I.L.L. AI assistant, calculating skill ratings (Pulse Score, Academy Score), matchmaking in tournaments and competitions, generating personalised learning recommendations, detecting fraudulent or suspicious behaviour, and creating performance analytics and insights.

Your interactions with AI features, including prompts and conversation history with the W.I.L.L. AI assistant, are processed by third-party AI service providers (including Anthropic, Google, and OpenAI) for the purpose of generating responses. These providers process data as data processors under agreements that include appropriate data protection safeguards. We store information from your conversations with W.I.L.L., including details about your finances, so he can use it in future conversations; we delete it when your account is deleted, and you can request earlier deletion by emailing [email protected].

Automated scoring and ranking systems may affect your position in competitions and leaderboards. You have the right to request human review of significant automated decisions that affect you. Contact us at [email protected] to exercise this right.

08Identity verification and payouts

We only ask for an identity document when you want a cash payout or a verified feature. We store the result, never photographs of you or your document.

Identity verification runs through our verification provider Didit. The flow checks a government-issued identity document, performs a face match and runs a liveness check. From the result we store your verified name, date of birth, nationality, document type, the last four digits of the document number, a hashed document number, and the face match and liveness scores. We do not store photographs of you or of your document. Where a step requires your address, we validate it using Google Address Validation and store the submitted address together with the validation verdict.

To confirm non-professional access to live market data, we also screen your verified name against public registers of financial professionals (FINRA BrokerCheck and SEC IAPD). A possible match is always reviewed by a person and never leads to automatic rejection.

Verification data is used for verification, payouts and legal compliance, and never for marketing. Cash prizes are paid out through Tremendous, which receives the information needed to deliver your redemption link. Verification data is deleted together with your account. We keep only the hashed document number, which cannot be traced back to you and which prevents a deleted account from verifying again with the same document.

09Third-party providers

A short list of vendors, each bound by a data processing agreement. We do not sell your data.

We share your personal data with the following categories of third-party service providers, who process data on our behalf as data processors:

Cloud infrastructure and hosting: Hetzner Cloud (primary servers and databases, located in Falkenstein, Germany) and Cloudflare (CDN, DDoS protection, web application firewall).
Payment processing: Stripe (web and subscription payments), Apple (App Store payments), and Google (Play Store payments).
AI service providers: Anthropic, Google AI, and OpenAI (for AI-powered features including the W.I.L.L. AI assistant and market analysis).
Email delivery: SendGrid (transactional and marketing emails).
Error monitoring and performance: Sentry (application error tracking and performance monitoring, without IP addresses).
Financial data providers: Third-party providers supplying market data, financial information, and economic indicators displayed on the Platform.
Identity verification: Didit (identity and age verification for prize payouts, including document check, face match and liveness check) and Google Address Validation (address validation where a step requires an address).
Educational organizations: When you explicitly join a classroom or organization, we may share the educational progress and gameplay information required to operate that group. The Class Cup is a competition between school classes. When a class joins, anyone can see the school's registered name on the Class Cup pages. The class name appears too if the whole name follows a format such as “2.b”, “3x” or “HHX 2A”. Otherwise only the school is shown. Teachers' and students' names never appear on these pages. A school can have its name removed from the pages by emailing [email protected]. The school's classes stay in the cup and are still included in the number of classes taking part. We do not currently offer broker-linked accounts or broker-referral data sharing.
Prize payouts: Tremendous (delivery of cash prize redemption links).

We do not sell your personal data and we have never done so. We do not share your personal data with data brokers.

10Named subprocessors

Every company that touches your data, what they do with it, and where they process it.

The following named subprocessors process personal data on our behalf. Each is bound by a data processing agreement, and transfers outside the European Economic Area are covered by the safeguards described under International data transfers.

Subprocessor	Purpose	Processing region
Hetzner Cloud	Server hosting and primary infrastructure	European Union (Falkenstein, Germany)
Cloudflare	Content delivery network and DDoS protection	European Union and global edge locations
SendGrid	Transactional and service email	United States (data processing agreement in place)
Stripe	Payments and subscriptions	European Union and United States (Standard Contractual Clauses)
Sentry	Error reporting and performance monitoring. Does not store IP addresses.	European Union (Frankfurt, Germany)
Tremendous	Cash prize payout fulfilment	United States (Standard Contractual Clauses)

11Ad measurement

Only if you say yes. No cookies or pixels: the information is sent from our own servers.

If you say yes to analytics and ad measurement, we share information with ad platforms so we can measure and improve our ads.

Information: about your sign-up and your use of LogicBanker, for example that you signed up or completed a lesson; technical information such as IP address and browser or device type; and the ad's click id and campaign details, also from the app store, if you came via an ad.
Email address: Your email address is sent as a hash: a code that cannot be turned back into the address. The platform can only use it to recognise you if you already have an account with it.
Recipients: ad platforms such as Meta, TikTok and Google. They are independent controllers for their part and may process the information outside the EU (see International data transfers). Older versions of the app used AppsFlyer; it has been switched off.
Limits: The platforms may use the information to measure our ads and improve who sees them, but not to build audiences that follow you, and not for personalised ads.
Your choice: You answer when you sign up, and a yes only counts from age 15. You can withdraw it at any time under Settings, Privacy on the website and in the app. We then share nothing more, but we can't call back what has already been sent.

12Visit counts without cookies

We count visits to our public pages without cookies and without storing anything on your device.

On our public pages we count visits and taps on the app store buttons, split by things such as page, campaign and type of device.

We use no cookies and store nothing on your device. To count each visitor once, we turn your IP address and browser type into a daily one-way code, which is deleted again. After that we keep only totals, which aren't linked to any account and aren't shared with ad platforms.

The legal basis is our legitimate interest (Article 6(1)(f)) in measuring whether our pages and campaigns work.

Because we cannot identify anyone from the totals afterwards, we cannot act on an individual objection or access request for these figures (Article 11).

13International data transfers

Your data lives in the EU. Anything that leaves is covered by Standard Contractual Clauses.

Your personal data is primarily stored in the European Union, on infrastructure operated by Hetzner Cloud in Falkenstein, Germany. Backups are encrypted at rest and replicated to a second location within the European Union.

Your personal data may be transferred to and processed in countries outside the European Economic Area (EEA), including the United States, where some of our third-party service providers are located. When we transfer data outside the EEA, we ensure appropriate safeguards are in place, including: EU Standard Contractual Clauses (SCCs) approved by the European Commission, adequacy decisions by the European Commission for the recipient country, or the service provider’s participation in recognised certification mechanisms.

For more information about the specific safeguards applied to your data transfers, you may contact us at [email protected].

14Data retention

We keep data while your account is active, then delete it. Some records the law makes us keep longer.

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected. Specific retention periods include:

Your name, display name and date of birth follow the account-data periods below. If you confirm an age under 12, we do not store the date. We keep only the time of the refusal so that support can correct a mistake.

Account data: Retained for the duration of your account. On account deletion it is deleted or anonymised within 30 days from our primary systems and within 90 days from encrypted backups, unless longer retention is required by law.
Gameplay and behavioural data: Retained for the duration of your account. Upon account deletion, personally identifiable gameplay data is deleted or anonymised. Aggregated and anonymised data derived from your gameplay may be retained indefinitely for statistical, analytical, and commercial purposes.
Financial and transaction data: Retained for a minimum of 5 years after the relevant transaction, as required by Danish bookkeeping legislation.
KYC and identity verification data: Identity documents are handled under the verification provider's published retention terms and applicable law. LogicBanker retains only the verification result and payout-audit data for as long as necessary for compliance and dispute handling.
Marketing consent records: Retained for 2 years after consent withdrawal, as evidence of prior consent.
Server logs and technical data: Retained for up to 12 months for security and troubleshooting purposes.
Inactive accounts: We contact you by email after 24 months of inactivity and delete the account after 36 months of inactivity.
Visit counts: The daily one-way codes are deleted within 48 hours. After that we keep only totals.
Ad measurement: Information waiting to be sent to an ad platform is deleted after 7 days at the latest.
Product measurement: Deleted after 13 months.
Unfinished sign-ups: Deleted after 7 days if the sign-up isn't completed.

15Cookies and local storage

Only necessary cookies. No cookies or pixels for analytics or ads.

We only use cookies needed to deliver the service you ask for, for example for login, language, security and taking you to the right place. Danish cookie rules let us set them without asking, and the processing is based on our legitimate interest in a service that works and is secure.

The website also keeps functional details in your browser's local storage, and the login and sign-up pages load Google's and Apple's sign-in scripts so you can log in with them. Ad measurement and visit counts work without cookies (see the two sections above).

Old cookies from when we used analytics and ad cookies are deleted on your next visit. You can always delete cookies in your browser. See the full overview on our Cookies page.

16Children’s privacy

You must be at least 12 to use LogicBanker.

The Platform is not intended for children under 12, and we do not knowingly collect personal data from them. If we become aware of an account belonging to a child under 12, we close the account. Pupils in the classroom programme use their own account under these terms. When you join a class yourself, your teacher can see the progress needed to run the class, and nothing else. Write to [email protected] if you believe a child under 12 has created an account.

17Protection of personal data

Encrypted in transit and at rest, passwords hashed, access controlled. No system is perfect, and we will tell you if something goes wrong.

We are committed to ensuring that the personal data we collect and process is and remains secure and confidential at all times. We have implemented appropriate technical and organizational measures to protect your data, including encryption of data in transit and at rest, password hashing using Argon2id so that we never hold your password in a readable form, access controls and authentication mechanisms, regular security assessments and monitoring, incident response procedures, and employee training on data protection. Where you sign in through a third-party provider we store only that provider’s identifier, never a password. Despite these measures, no method of transmission over the Internet or electronic storage is completely secure. We cannot guarantee absolute security but will notify you and the relevant supervisory authority of any personal data breach as required by applicable law.

18Your rights

Access, correct, delete, restrict, port, object, complain. Most of it is self-serve in your settings.

Under the GDPR and applicable data protection legislation, you have the following rights regarding our processing of your personal data:

These include:

Right of access (Article 15): You have the right to obtain confirmation of whether we process your personal data and, if so, to access that data along with information about the processing.
Right to rectification (Article 16): You have the right to have inaccurate personal data corrected and incomplete data completed.
Right to erasure (Article 17): You have the right to have your personal data deleted when it is no longer necessary for the purpose for which it was collected, subject to legal retention requirements.
Right to restriction of processing (Article 18): You have the right to restrict the processing of your personal data in certain circumstances, such as when you contest the accuracy of the data.
Right to data portability (Article 20): You have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to transmit that data to another controller.
Right to object (Article 21): You have the right to object to processing based on legitimate interests, including profiling. You also have the right to object to processing for direct marketing purposes at any time. You object to our own product measurement under Settings, Privacy.
Right regarding automated decision-making (Article 22): You have the right not to be subject to decisions based solely on automated processing that produce legal effects or similarly significantly affect you, and to request human intervention.

Many of these rights are self-serve on the Platform: you can export your data, correct your profile details, and delete your account from your account settings. Data exports are provided in a structured, machine-readable format (JSON). To exercise any other right, or if you prefer to write to us, contact us at [email protected]. We will respond to your request within 30 days, and usually within 7. You can find more information about your rights on the Danish Data Protection Agency's website, www.datatilsynet.dk.

19Changes to this privacy policy

If we change something that matters, we tell you before it takes effect.

We may update this Privacy Policy from time to time to reflect changes in our practices, services, or applicable law. If we make material changes, we will notify you through the Platform or via email before the changes take effect. The updated Privacy Policy will always be available on the Platform with the effective date indicated. We recommend that you review this policy regularly.

20Inquiries and complaints

Write to us first. If we do not resolve it, you can complain to the Danish Data Protection Agency.

If you have questions regarding this Privacy Policy, wish to exercise your data protection rights, or have concerns about how we process your personal data, please contact us at [email protected] or at the postal address listed below.

You have the right to file a complaint with the Danish Data Protection Agency (Datatilsynet) if you are dissatisfied with how we process your personal data. Contact information: Datatilsynet, Carl Jacobsens Vej 35, 2500 Valby, Denmark, www.datatilsynet.dk. If you reside in another EU/EEA country, you may also file a complaint with your local supervisory authority.

21Contact Information

How to reach us about anything in this policy.

LogicBanker ApS, Slotsmarken 12, 1. th., 2970 Hørsholm, Denmark. CVR: 39409291. Email: [email protected].

Privacy policy