Privacy Policy

Effective February 13, 2026

Data Controller: Bela Varga (Tax Number: HU91627676) | Email: [email protected] | Phone: +1 (940) 603-1770

1. Introduction

Welcome to TimeToBuyBitcoin.com ("we," "us," "our," or "the Service"). We are committed to protecting your privacy and ensuring you have a positive experience on our website. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website and use our services.

Please read this Privacy Policy carefully. If you do not agree with our policies and practices, please do not use our Service. Your continued use of the Service following the posting of revised Privacy Policy means that you accept and agree to the changes.

2. Data Controller & Contact Information

The Data Controller responsible for your personal data is:

If you have questions about this Privacy Policy or our privacy practices, please contact us using the information above.

3. What Data We Collect

We collect personal data that you provide directly and data collected automatically through your use of the Service. Below is a comprehensive table of all data categories processed:

Data Category Type Purpose
Email Address Provided directly Account creation, magic link authentication, report notifications, communication
Stripe Customer ID Generated by Stripe Payment processing, subscription management, billing history
Stripe Subscription ID Generated by Stripe Track active subscription status and plan tier
Session Tokens Generated by us Maintain user sessions, authentication across requests
Magic Link Tokens Generated by us Passwordless authentication (single-use, 15-min expiry)
Theme Preference User selection Store light/dark mode preference for user experience
Preview Usage Cookie Automatic tracking Track whether free preview was accessed (enables paywall logic)
Device Fingerprint Automatic collection Session validation, fraud detection, abuse prevention
Last Login Timestamp Automatic recording Account security monitoring, session management
IP Address Automatic collection Security, abuse prevention, rate limiting, legal compliance
User Agent / Browser Info Automatic collection Device compatibility, performance optimization, security
Interaction Logs Automatic collection Error tracking, performance monitoring, service improvement

3.1 What We Do NOT Collect or Store

4. How We Collect Data

4.1 Data You Provide Directly

4.2 Data Collected Automatically

4.3 Third-Party Sources

We receive limited data from third-party processors:

5. Legal Basis for Processing (Article 6, GDPR)

We process your personal data based on the following legal grounds under GDPR Article 6:

5.1 Contractual Necessity (Article 6(1)(b))

5.2 Legitimate Interests (Article 6(1)(f))

5.3 Consent (Article 6(1)(a))

5.4 Legal Obligation (Article 6(1)(c))

6. Purpose of Processing

Your personal data is processed for the following specific purposes:

7. Data Retention Periods

We retain your personal data only as long as necessary for the purposes stated in this Privacy Policy, subject to applicable legal obligations:

If you request account deletion, we will delete your personal data except where retention is required by law (billing records, 7 years) or where we have a legitimate interest in maintaining it (fraud detection, conflict resolution).

8. Third-Party Data Processors

We use the following third-party service providers who process personal data on our behalf under Data Processing Agreements (DPAs):

8.1 Stripe Inc.

8.2 Mailgun / Sinch

8.3 Anthropic PBC

8.4 Hetzner Online GmbH

8.5 CryptoCompare Ltd

8.6 TradingView Inc

8.7 Google Fonts (Google LLC)

8.8 Cloudflare / jsDelivr

9. International Data Transfers

The European Union has not made an adequacy decision for the USA. However, we ensure that your personal data transferred outside the EU/EEA is protected through the following mechanisms:

9.1 Standard Contractual Clauses (SCCs)

We have executed Standard Contractual Clauses (EU Commission Decision 2021/915 and UK SCCs) with all third-party processors that are located outside the EU/EEA:

9.2 Data Storage Location

9.3 Your Rights Regarding International Transfers

You have the right to request information about the mechanisms protecting your data in international transfers. You may contact us for more details on the safeguards in place. You also have the right to lodge a complaint with your national Data Protection Authority if you believe your rights are not being adequately protected.

10. Cookies & Tracking Technologies

We use cookies and similar tracking technologies to provide our Service, maintain your session, and improve user experience. For a detailed explanation of all cookies used, please refer to our Cookie Policy.

10.1 Types of Cookies Used

10.2 Local Storage

We may use browser local storage for storing non-sensitive preferences (e.g., theme, notification preferences). This data is never transmitted to our servers.

10.3 Cookie Consent

Essential cookies for authentication and service delivery are placed without prior consent (lawful basis: contract performance). Non-essential analytics cookies are placed only with your explicit consent.

11. Your Rights Under GDPR

You have the following rights regarding your personal data under the EU General Data Protection Regulation (GDPR):

11.1 Right to Access (Article 15)

You have the right to request a copy of the personal data we hold about you. We will provide this in a structured, commonly used, machine-readable format within 30 days of your request.

11.2 Right to Rectification (Article 16)

You have the right to correct inaccurate personal data or complete incomplete information. You can update your email address by logging into your account or by contacting us directly.

11.3 Right to Erasure / "Right to be Forgotten" (Article 17)

You have the right to request deletion of your personal data, except where we have a legal obligation to retain it. Note: We must retain billing records for 7 years for tax compliance purposes. After account deletion, personal data (except billing records) will be permanently deleted within 30 days.

11.4 Right to Restrict Processing (Article 18)

You may request that we restrict how we process your personal data in certain circumstances (e.g., while you dispute accuracy). During this period, we will only store your data but not actively process it for other purposes.

11.5 Right to Data Portability (Article 20)

You have the right to receive your personal data in a structured, commonly used, machine-readable format (e.g., JSON, CSV) and to transmit it to another service provider without hindrance.

11.6 Right to Object (Article 21)

You may object to processing based on legitimate interests. You can opt-out of non-essential communications and analytics at any time.

11.7 Right to Withdraw Consent (Article 7)

If you have given consent for specific processing (e.g., report notifications, analytics), you can withdraw it at any time. Withdrawal will not affect the lawfulness of processing before withdrawal.

11.8 Right to Lodge a Complaint (Article 77)

You have the right to lodge a complaint with your national Data Protection Authority. For users in Hungary, you may contact the National Data Protection Authority (Nemzeti Adatvédelmi Hivatal, NAIH):

11.9 Exercising Your Rights

To exercise any of the above rights, please send a request to [email protected] with:

We will respond to your request within 30 days of receipt. If your request is complex, we may extend this period by two additional months and will notify you of the extension.

12. Email Communications & Notifications

12.1 Report Notifications

When you enable report notifications in your account settings, we send you email digests containing power law analysis reports. These are transactional communications related to your subscription.

12.2 Magic Link Authentication Emails

For security and authentication purposes, we always send magic link emails when you attempt to log in. These cannot be unsubscribed as they are essential for account access.

12.3 Service & Security Notices

We may send important security notices (e.g., suspicious login attempts, password changes, subscription updates) that cannot be opted out of, as they are necessary for account protection.

12.4 Opt-Out Mechanism

All non-essential emails include an unsubscribe link. You can also manage communication preferences in your account settings or email us at [email protected].

13. Data Security Measures

We implement comprehensive security measures to protect your personal data from unauthorized access, alteration, disclosure, or destruction:

13.1 Transport Security

13.2 Storage Security

13.3 Authentication & Session Management

13.4 Application Security

13.5 Data Access Policies

13.6 Fraud & Abuse Prevention

13.7 Third-Party Security

13.8 Regular Security Reviews

We conduct periodic security audits and testing to identify and address vulnerabilities. We stay current with security best practices and update our infrastructure regularly.

Important: While we implement robust security measures, no online system is 100% secure. If you suspect a security breach, please contact us immediately at [email protected].

14. Children's Privacy

Our Service is not directed to individuals under the age of 16. We do not knowingly collect personal data from children under 16. If we become aware that a child under 16 has provided us with personal data, we will promptly delete such information and terminate the child's account.

For users between 16 and 18, parental consent is recommended for account creation. If you are under 18 and have created an account without parental consent, please inform us immediately.

If you believe we have collected personal data from a child under 16, please contact us at [email protected].

15. Data Breach Notification

In the event of a personal data breach that poses a risk to your rights and freedoms, we will:

You will be notified via email to the address associated with your account. If you suspect a security breach, please contact us immediately at [email protected].

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of material changes by posting the revised Privacy Policy on this page and updating the "Effective" date.

If the changes materially affect how we use your personal data, we will provide at least 30 days' notice and may seek your explicit consent, depending on the nature of the changes.

Your continued use of the Service following the posting of changes means you accept the updated Privacy Policy. We encourage you to review this policy regularly to stay informed about how we protect your information.

17. Contact & Data Protection Authority

17.1 Contact the Data Controller

For questions about this Privacy Policy, to exercise your privacy rights, or to report a concern about our data handling practices:

17.2 Contact Your Data Protection Authority

You have the right to lodge a complaint with the Data Protection Authority in your country. For users in Hungary or if we are subject to Hungarian law:

For users in other EU member states, you can find contact information for your local Data Protection Authority on the European Data Protection Board website.

18. Additional Resources

19. Summary of Key Points

Last Updated: February 13, 2026
Version: 1.0
Language: English