Privacy policy

1. Who is responsible

The controller is Frank Herrmann, Unterer Mühlenweg 73, 79114 Freiburg, Germany. For privacy questions and to exercise your rights, contact him at info@marqora.de.

2. Visiting the homepage and member area

When you visit, technically necessary connection data is processed, including your IP address, the time, the requested address and technical information transmitted by your browser. This is used to deliver the pages, resolve errors and protect against misuse. The legal basis is Article 6(1)(f) GDPR; our legitimate interest is secure and reliable operation.

The homepage and email inboxes are hosted by ALL-INKL.COM – Neue Medien Münnich, proprietor René Münnich, Hauptstraße 68, 02742 Friedersdorf, Germany. The member area runs on a server managed by the operator. Technical service providers may process the data necessary for their respective tasks.

The customer reading service does not have a regular HTTP access log enabled. Technical errors and security events may nevertheless be logged. IP addresses are also processed to briefly limit abusive requests; the application keeps derived values in working memory for a limited time for this purpose.

3. Account, sign-in and contract administration

For your account, we process your username, email address, a verification value derived from your password, and your confirmation and access status. Your password is checked when you sign in; we store a calculated verification value known as a password hash. Your password itself is not stored there in plain text.

For current free access, we store your verification and access status and, where applicable, access permissions set by the operator and their duration. Records of earlier agreements may still be stored, including activation, duration, the accepted offer version, acceptance time, cancellation and cancellation receipts. Necessary account events are logged for secure processing and traceability. The legal bases are Article 6(1)(b) GDPR for the account and agreement, and Article 6(1)(f) for security and necessary record-keeping. Where a legal retention obligation applies, Article 6(1)(c) applies.

A username, email address and password are required for the registration offered. Without them, we cannot provide such an account. Payment details are not collected for the current free service with no subscription.

4. Watchlist and change notifications

The companies you save, their associated change states and read markers are stored in association with your account. This lets you access the same watchlist and progress on the web and in the Windows app. The legal basis is Article 6(1)(b) GDPR for the account functions you use.

Saving a stock alone does not order a paid AI analysis. The customer view reads research results created for all users. In normal operation, customer accounts, passwords and watchlists remain separate from the creation of stock analyses. They are not sent to OpenAI or the price data provider for this purpose.

Optional watchlist emails · added October 18, 2026

Watchlist email notifications are currently paused.

Only if you enable email notifications do we use your confirmed email address, username, saved companies and their new material changes for grouped notifications. This setting is initially off. You can turn it off at any time in your watchlist, in My account or through the unsubscribe link in every email. Doing so does not affect your access or your watchlist.

We store your chosen setting and its time, together with the change state already processed, to avoid sending old or duplicate notifications. The configured email service at ALL-INKL.COM processes the recipient address and message content for delivery. After confirmed handover, the message content is removed from our outgoing queue; delivery records are deleted after 90 days. If delivery status is uncertain, we keep the content for no more than 24 hours for technical clarification. These emails contain no open or click tracking.

5. Emails and personal inquiries

We send necessary messages for email confirmation, password resets and cancellations through the configured email service at ALL-INKL.COM. The recipient address and the content necessary for the message are processed for this purpose. The legal basis is Article 6(1)(b) GDPR and, additionally, point (f) for securing these processes.

If you write to us, we process your contact details and message content to handle your inquiry. Contract-related inquiries are based on Article 6(1)(b) GDPR; other inquiries are based on our legitimate interest in responding under point (f). Please do not send us passwords or unnecessary confidential information.

The beta service described here does not send newsletters or use your account information for personalized advertising.

6. Sessions and storage on your device

The web customer area stores its sign-in in local browser storage (localStorage), only for the customer area’s address. This preserves it when reloading or opening further tabs. The access token is valid for no more than one hour after sign-in; changing pages does not extend this period. Signing out removes the stored access, and expired entries are cleared on the next visit. On the server, only the token hash, account association, expiry time and a binding to account status are stored in the protected sign-in area, so valid sessions survive a restart. No sign-in cookie is used for this. If localStorage is unavailable, the individual tab’s session storage is used where possible.

The Windows app stores your username, device identifier and encrypted access tokens locally in your Windows user profile. The encryption is tied to this Windows user; your account password is not stored for this purpose. Device access expires after 30 days without use, or after no more than 180 days. Depending on usage, you may need to sign in again. This storage provides the secure access you expressly requested and is governed by Section 25(2)(2) TDDDG.

The pages use local system fonts; images and the explainer video are provided by MARQORA. The reviewed homepage and customer application contain no advertising or visitor analytics script. When you open an external source link, you leave MARQORA; the respective provider then receives the connection data for your visit.

7. How long data is kept

Account data, watchlist and read flags are used for as long as the account exists. Canceling an earlier agreement does not automatically delete the account. No active subscription is required for the current free account service. You can request deletion by email: info@marqora.de. We check your authorization and remove data no longer needed; statutory requirements or justified recordkeeping obligations are considered separately.

Confirmation links are valid for one hour; password reset and cancellation links for 30 minutes. They can no longer be used after expiry. Technical remnants of expired processes are removed during the relevant cleanup. An expired link is already unusable even if its stored entry is deleted later.

Further retention of contract and security records depends on outstanding processing, a specific incident and applicable statutory periods. We limit such retention to the information needed for that purpose. It does not justify continuing to use the entire watchlist or all account information indiscriminately.

Technical error logs in the customer application are replaced when their configured size limits are reached; this does not produce a fixed number of days. An extract required for a particular error or security incident is retained only as long as needed to handle it and provide necessary records. Independently of size-based rotation, the manual closing and retention process checks whether log data is still needed for troubleshooting or security. Data no longer required is deleted. Specific incident records are retained only with a reason and for the stated purpose.

Operational backups and copies made before changes may contain older data. They are used for recovery and kept separate from normal customer access. We also consider these copies when handling a deletion request. Where required backups must temporarily be retained, deleted accounts must not be restored from them for normal use. General account and backup cleanup is handled by the operator during the current beta; no automatic daily deletion is promised.

Contact inquiries are deleted once resolved unless further processing, legal defense or statutory retention is required. The respective purposes and necessary retention periods are reviewed when handling the inquiry.

8. Recipients and external processing

The operator and appointed technical service providers receive access only as necessary for operation, message delivery, support and security. Data is disclosed to authorities or other parties where legally required. ALL-INKL.COM states that its hosting services use server locations in Germany. This is not an assurance about providers of external links or your own email provider.

Normal customer access does not trigger the transfer of your account or watchlist to an AI service. General company analyses are created separately from your account functions. No personal advertising or investment profile is created from your usage behavior.

9. Your rights

Subject to the legal requirements, you may request access, correction, deletion, restriction of processing and data portability. Where processing is based on consent, you may withdraw it for the future. Consent is not the blanket basis for the necessary account processing described here.

Where processing is based on legitimate interests, you may object for reasons relating to your particular situation. We will then assess whether compelling legitimate grounds or the establishment, exercise or defense of legal claims require continued processing.

To do so, write to info@marqora.de. You may also lodge a complaint with a data protection supervisory authority, particularly where you live, work or believe an infringement has occurred. For the operator in Freiburg, one contact is the State Commissioner for Data Protection and Freedom of Information Baden-Württemberg: https://www.baden-wuerttemberg.datenschutz.de/beschwerde/.

10. Changes

If additional services, payment functions or processing purposes are introduced, we will update this information. This does not replace any separate consent that may be required.

Sign-in statistics in the customer area

From October 29, 2026, we record the username and time of each successful sign-in. This allows the operator to assess usage and returning sign-ins during beta operation and investigate account-access questions. These statistics are visible only in the protected operator administration. Passwords, access tokens, IP addresses and stock pages visited are not stored for this purpose. Page changes and automatic session restoration are not counted again.

The report covers the last 90 days. Older entries are deleted at the next sign-in, statistics request or server start; deleting an account removes all associated statistics entries. The operator can download the overview for their own analysis. Data are not shared with an analytics service. The basis is our legitimate interest in limited evaluation and support of beta operation (Article 6(1)(f) GDPR). You may object on grounds relating to your particular situation by emailing info@marqora.de. The rights described above remain in place.