CornerScope privacy notice

The controller is José Carlos Aguilar Suárez, a natural person and sole trader operating under the business name The Assets Corner. CornerScope is the name of the service. Address:
c/o POSTFLEX PFX-923-738
Emsdettener Straße 10, 48268 Greven, Germany.

Send privacy requests to support@cornerscope.app. The German version of this notice controls.

Purposes and legal bases

For accounts, sign-in and the analysis features you use, we process your email address, credentials, preferences, portfolios, holdings, transactions and strategies. If you import a broker file or set up a broker connection, we process the data and credentials you provide for that purpose. The legal basis is GDPR Article 6(1)(b). Without information needed for sign-in and the service, we cannot provide the relevant function. We process technical access and security data to protect the service and prevent misuse on the basis of our legitimate interest (Article 6(1)(f)).

The app does not use cookies for sign-in. It stores access tokens and account information in your browser's local storage for sign-in and session management. It also stores display and operating choices you make, such as language and color theme, locally on your device. The public website in its current form uses no analytics or advertising services, stores nothing in your browser merely because you visit it, and loads no third-party content. Submitting the waiting-list form is a request you initiate to our own API.

If you send feedback or a support request, we process your message, account link, selected diagnostics and optional attachments to handle the matter and improve the service (Article 6(1)(b) or (f), depending on the matter; legitimate interest: fixing faults and improving the product). Selected diagnostics can include values displayed on the Import, Portfolio, Performance, Insights or security page you report from, such as amounts, returns, scores, currencies, dates and security identifiers. You see each item before sending and can remove any of them. Free text, screenshots and broker files can contain financial information. For feature requests, we show only the intended information and aggregated interest publicly; we do not publish identifying raw reports.

If you write to us through the contact form, no account is required. We process the optional name, your reply email address and your message to answer your enquiry. The legal basis is Article 6(1)(b) where your message concerns a contract or its initiation, and otherwise Article 6(1)(f), based on our legitimate interest in answering an enquiry addressed to us. To protect against misuse, we also process for one hour a secret-keyed digest of your IP address and of your normalized email address, never the addresses themselves. The legal basis is our legitimate interest in protecting the service under Article 6(1)(f).

If you join the CornerScope waiting list, we process your email address, locale, submission and confirmation times, a temporary confirmation token, the IP address at confirmation and the consent-text version. We first send a confirmation message. Only after you open the link and submit the confirmation will you receive the public-access announcement and occasional product updates, no more than twice a month. The legal basis is your consent under Article 6(1)(a). The confirmation procedure and record also document your consent under section 7 of the German Unfair Competition Act (UWG).

We send necessary service and security emails to provide or protect the service (Article 6(1)(b) or (f)). We send product news by email only with separate consent (Article 6(1)(a)); you can withdraw it prospectively at any time using the unsubscribe link. If you send us a letter, we process sender details, contents and enclosures to handle your matter (Article 6(1)(b), (c) or (f), depending on the circumstances).

Before first access to an invited free beta, we may ask you to accept the displayed beta terms. We then record the account link, version, language, content hash and acceptance time to evidence your agreement (Article 6(1)(b)). This acceptance is not consent to product emails or other optional processing.

If we invite you to the beta by email, we process the address we send the invitation to, the invitation's expiry and whether and when it was used, so that the link works for you alone and can be withdrawn. The legal basis is Article 6(1)(b) where you asked to take part, and otherwise Article 6(1)(f), based on our legitimate interest in keeping a record of who was invited and in being able to revoke an invitation. The invitation is a single message and does not place you on any mailing list.

Recipients and transfers

We use Render in Frankfurt for hosting and the database, Google Cloud Storage for private file storage, Google Cloud Vertex for user-initiated AI-supported imports, and Resend for outgoing email. We currently review feedback ourselves and do not send live tester feedback to an external AI triage service. Resend relays contact-form messages by email to our support address; the message is not stored in our application database. Messages to our support addresses are forwarded through NameSilo/EMAILOWL to a personal Gmail inbox. Resend sends waiting-list mail from a sender address separate from account and security messages. Resend's suppression list nevertheless applies to the entire provider account, so a delivery failure recorded there may also affect a later transactional message to the same address. Postflex receives letters at our c/o address and may digitise them at our request. These providers receive data for their respective tasks. Resend also processes email content and logs in the US; EU standard contractual clauses apply to this transfer under the data processing agreement with Resend. Other providers may permit access or transfers outside the European Economic Area. For such transfers, ask us at support@cornerscope.app about the applicable adequacy decision or safeguards under GDPR Articles 44 et seq. and how to obtain a copy. We do not claim that all storage or processing occurs only in the EU.

If we activate a YouTube help video later, we will update this notice and check the display and legal basis before activation; loading it may then transfer data to Google/YouTube.

Retention and your rights

We generally keep accounts and content you create while you use the service. We handle valid erasure requests individually; statutory retention duties or a specifically justified exception may require us to keep certain data longer. Raw feedback and attachments are selected for deletion 30 days after a case is completed or from day 330 at the latest. A daily job processes that selection; an outage can delay actual deletion. Deleted attachments may remain recoverable in private Google Cloud storage for seven days. Limited case status and the reply may remain for up to twelve months after completion. We aim to resolve and delete ordinary support correspondence within 24 months after the last substantive exchange; this mailbox process is not currently automated. Contact-form messages follow the same rule. The contact form's technical digest values expire after one hour and are physically removed by the cache's next culling operation. We delete unconfirmed waiting-list entries 30 days after submission. When you unsubscribe, we reduce the entry to the details required as proof of consent and delete that proof after 31 December of the third year following the unsubscribe. We delete an invitation 90 days after it was used, withdrawn or expired; an invitation that is still valid is not deleted. Security logs, backups and remaining provider copies are kept for the periods required by their respective purposes and provider arrangements. Account closure alone deactivates access but does not automatically erase all personal data or recoverable copies. Confirmed account erasure also deletes the account-linked record of your beta-terms acceptance; no separate legal-claims retention for that record is currently implemented.

Subject to the GDPR, you may request access, rectification, erasure, restriction and portability. You may object on grounds relating to your particular situation to processing based on legitimate interests. You can withdraw consent prospectively at any time. Every waiting-list message contains an unsubscribe link that takes effect immediately. Send requests to support@cornerscope.app; we verify your identity proportionately. We handle requests concerning contact-form messages in the support mailbox because the application has no corresponding record. For a waiting-list request, we check and delete both the subscriber entry and any pending outbound-mail row. You may also complain to a data protection supervisory authority.

Last updated: 2026-09-21.