STANCEL · PRIVACY
Privacy
This is the English version of the Spanish «Privacidad». Both describe the same processing under the same law. If the two ever disagree, the Spanish one governs — the controller is established in Spain and that is the text a Spanish authority would read.
GDPR (EU 2016/679) and LOPDGDD (3/2018). Required from the first email address collected.
Scope. This policy covers
stancel.netand all its subdomains, including the partner portal (socios.stancel.net) and the customer portal (cuenta.stancel.net). Deliberately one policy and not several: two policies are two that drift apart, and the one that goes stale is always the one nobody reads.
1. Controller
Eduardo Rodríguez · hola@stancel.net
2. What is collected, what for, and on what basis
| Data | What for | Legal basis | How long |
|---|---|---|---|
| Your email, when you subscribe (what used to be the «waiting list») | To tell you when the product launches and send product news, and also to identify you: that same email is the one you use to get into your account at cuenta.stancel.net, through a link we send there. There is no password — security rests on your own email, which is the safest thing we can offer you without holding passwords | Consent (Art. 6(1)(a)) for the emails. Performance of a contract (Art. 6(1)(b)) to identify you and give you access to your account | The emails, until you unsubscribe. Your email as your identity, for as long as you have an account with us — and those two are not the same thing: see the note right below this table |
| Email and name (support) | To reply to you | Consent / performance of a contract | For as long as the query lasts, plus statutory periods |
| Purchase data | Invoicing and tax obligations | Legal obligation (Art. 6(1)(c)) | The applicable tax retention periods |
| Site technical logs | Security and operation | Legitimate interest (Art. 6(1)(f)) | The minimum necessary |
| The licence check (only if you paste a key into Stancel): the key, the machine code, the program version and the trial days used | Activating your licence on that machine and keeping it current: applying a purchase, an extension, a renewal or a refund | Performance of a contract (Art. 6(1)(b)): it is the licence you asked for or bought | For as long as your licence exists |
| A digest of the IP address the check comes from (never the IP itself) | Detecting a key that is shared or used from many places at once | Legitimate interest (Art. 6(1)(f)) in a licence not being resold | 90 days, then deleted automatically |
| Your email, for your licence: the key, the trial reminders, the email the day after you buy and the end-of-service notice | Delivering your licence and telling you what happens to it | Performance of a contract (Art. 6(1)(b)) for the key and the purchase. The trial reminders, the day-after email and the end-of-service notice, legitimate interest in informing someone who already uses the product (Art. 6(1)(f) and Art. 21.2 of the Spanish LSSI), with one-click unsubscribe in each | For as long as your licence exists. If you unsubscribe from those notices they stop; the emails with your key or about a payment still arrive. Of the unsubscribe, only your email and the date are kept, with no end date, unless you ask otherwise: that is what stops us writing to you again if you ever buy again |
The customer portal (cuenta.stancel.net): the email you sign in with, your session and a log of what you do there (viewing the key, releasing or naming a computer, downloading a permit), with a digest of the IP and never the IP itself | Letting you manage your licence without writing to anyone, and being able to tell you what was done and when if you ask | Performance of a contract (Art. 6(1)(b)) and legitimate interest in security (Art. 6(1)(f)) | Sign-in links, 24 hours (they work for 15 minutes); the session, until you sign out or after 7 days unused; the anti-abuse brake, 24 hours; the log of what you do, 12 months |
The Telegram support bot (@stancel_bot), when you write to us: your Telegram chat ID and username, what you send us, and — as the bot is completed — the buttons you press and what it replies (today only your last message is kept), the licence key tied to that chat — the one the bot issues you, or the one you quote when you ask about it — and which page of the site you came from (language, and a partner's code if you arrived through one) | Answering you, issuing your free key, managing your licence — releasing a computer, renewing — and telling you about a new version. The key is tied to your chat so we can do that without asking for your email every time. When the bot cannot answer you, the question goes to the person who handles support — by Telegram or by email —; and as the bot is completed the whole conversation will go with it, so you do not have to repeat what you already said. The link origin, only to know which pages raise questions | Consent (Art. 6(1)(a)): you give it by writing to us. Performance of a contract (Art. 6(1)(b)) if you already hold a licence and the question is about it | 12 months from your last message, then the whole conversation is deleted, the link to your licence included. Your licence itself is untouched: it keeps the period in its own row. Sooner if you ask |
| The questions the bot does not yet know how to answer: your question exactly as you wrote it, which chat and which page it came from, and how often we have been asked something similar | Learning to answer them. The literal text is kept rather than a summary because working out what repeats from a summary is guesswork | Legitimate interest (Art. 6(1)(f)) in support answering better next time | With the conversation: deleted when it is, 12 months after your last message or sooner if you ask |
| And, in future, the analysis of those questions by artificial intelligence (this does not happen yet): the text of the stored questions would be sent, in batches, to an artificial-intelligence provider located outside the EU | Grouping what repeats and drafting replies. 🔒 The artificial intelligence answers nobody: no reply of its reaches you without a person reading and approving it | Legitimate interest (Art. 6(1)(f)) in better support. You can object, and then your messages are not sent | The drafts, until they are approved or discarded. Your question, with the conversation |
| Your acceptance of these documents, when you register through the bot: your chat identifier, your email, the fingerprint of the exact text you accepted (and how many characters it had) and the date and time | To be able to show what you accepted and when —and to tell you if you ask—. We keep the fingerprint and not the text: it identifies the exact version you read, so if the document changes later we still know which one was yours. It is recorded when you accept, which is before you confirm your email: if we waited for the confirmation we would have written to you without having recorded that you accepted | Legal obligation (Art. 7(1): we must be able to demonstrate consent) and performance of a contract (Art. 6(1)(b)) for the licence you are asking for next | For as long as your licence exists. If you accept and never confirm your email, what we kept is deleted after 30 days. That is by design: without confirming your email you never get a licence, and then there is nothing holding it |
⚠️ Unsubscribing and deleting your account are NOT the same thing, and we say so here because it is easy to assume otherwise.
Now that subscribing is also your registration, unsubscribing stops us writing to you, but it does not delete your account or your licence if you have one — the same as already happened with the trial emails. Your email is still the one you get in with.
If what you want is for nothing to be left, ask and it gets deleted. That is the right to erasure in §6, it is handled just as quickly, and you do not have to explain why.
We write it separately because an unsubscribe button that looked like it deleted everything would leave you believing nothing of yours remains when it does — and that belief is exactly what this document exists to prevent.
3. Site measurement — no cookies, no third parties
To know which pages are read and where people arrive from, visits are counted with an in-house counter hosted on this same site. Google Analytics is not involved, and neither is any other external service.
| Cookies | On the public site, none. It does not set a single cookie, its own or anyone else's; that is why there is no cookie banner. The portals — the partner one (socios.stancel.net) and the customer one (cuenta.stancel.net) — use one technical session cookie, strictly necessary to keep you signed in: it measures nothing, is not third-party, needs no consent and is deleted when you sign out or after 7 days |
| What is stored | The page visited, the domain you came from (not the full address), the campaign parameters in the link, whether you are on mobile or desktop, and your browser language |
| Your IP address | Not stored. It is used for an instant to compute a code that expires on its own at midnight and cannot be reversed. It exists so you are not counted six times for looking at six pages, and for nothing else |
| Who sees it | Only the controller. This data does not leave the controller's servers — this site's hosting and the controller's own server at netcup (Germany, EU) — and is not shared with anyone |
| How long it is kept | 13 months; then deleted, both on the hosting and on our own server |
| Legal basis | Legitimate interest (Art. 6(1)(f)): measuring one's own site with data that does not identify you |
Because the code that would identify you expires every day and no IP is stored, this measurement cannot recognise you or follow you between sessions — neither here nor on any other site.
The one call this site makes to a third party, and where
The payment gateway needs to load its own script in your browser. It loads on a single page — the payment one — and you only reach it after pressing "buy", with a purchase already under way.
No other page on the site calls anyone outside it: not the home page, not pricing, not the manual, not the partner portal. Not even the fonts, which are served from here precisely so this doesn't have to be said about ten other pages.
3-bis. If you are a partner in the affiliate programme
This section only applies if you apply to the partner programme (socios.stancel.net). If you are a customer or a visitor, none of it concerns you.
More is collected from you than from anyone else, and the reason is worth stating plainly: to pay you we must invoice, and to invoice we must identify you for tax purposes. That is not a preference of ours — it is how being paid for a service works.
| Data | What for | Legal basis | How long |
|---|---|---|---|
| Tax name, tax identification (national ID, EU VAT number or TIN) and tax address | Issuing and receiving invoices and meeting tax obligations | Legal obligation (art. 6(1)(c)) and performance of the contract (art. 6(1)(b)) | The periods imposed by tax and commercial law, even after you leave the programme |
| Bank account (IBAN and holder; SWIFT/BIC outside SEPA) | Paying your commissions | Performance of the contract (art. 6(1)(b)) | While the relationship lasts, plus those same periods |
| The invoices you send us | Justifying the payment to the tax authority | Legal obligation (art. 6(1)(c)) | The tax periods |
| The channel where you promote and its approximate audience | Deciding on your application | Pre-contractual measures (art. 6(1)(b)) | While the relationship lasts |
| Your second-factor secret and your backup codes | Protecting your account | Performance of the contract and legitimate interest in security (art. 6(1)(f)) | While the relationship lasts |
| Which version of the contract you accepted, when, and from what IP | Being able to prove what you accepted if it is ever disputed | Legitimate interest (art. 6(1)(f)) and legal obligation | The limitation periods |
| Who has looked at your bank details, and when | Protecting you | Legitimate interest in security (art. 6(1)(f)) | While the relationship lasts |
What happens to your bank details, specifically
| Encrypted | The IBAN is not stored in the clear. Anyone who took the database would not take away readable bank accounts |
| With an access log | Every time someone looks at them it is recorded, including when it is me. That is not a promise: it is another row in the database, which is why it can be checked |
| No documents are asked for | We ask for the data, not the scan. No ID card, no passport: keeping copies of identity documents is an obligation with no benefit to anyone |
And what you will NOT see of other people
Your partner panel shows how many sign-ups and how many sales you brought, when, and how much you have generated. Never who. No emails, no names, not even masked.
Whoever buys through your link is our customer and did not agree to a third party seeing them. That it would be convenient for you does not change that.
Payments outside the SEPA area
Within SEPA the transfer is an ordinary bank transfer and nobody else is involved.
Outside SEPA an international payments provider will be needed, which will process your bank details to execute it and may involve an international transfer of data. Today it is Wise (see the table in §5), and if that changed it would be named here before anything is paid to you: saying we send data to a company we have no contract with would be as false as staying quiet about one we do.
4. What the program sends, and what it NEVER sends
The program runs entirely on your own computer. The controller does not receive your trades, your positions, your balance, your account credentials, or any data about your broker or your funding firm. Ever.
The only thing Stancel sends to us is the licence check, and only if you paste a key into its properties:
| What travels | What it is |
|---|---|
| Your key | The one you received by email |
| The machine code | A code Stancel computes on your computer to tell it apart from others. It is not a serial number, a network address or anything from your hardware |
| The program version | To know who needs an update |
| Trial days used | So the 30-day trial cannot be restarted by deleting a file |
It is sent at start-up and then every few hours. The answer is a signed permit valid for 3 days: that way a purchase, an extension or a refund reaches your computer by itself, and a few hours of server downtime do not affect you. The connection is encrypted and goes only to Stancel's licence server.
It is optional and can be switched off: the free version without a key connects to nothing, not even once. If you remove the key, Stancel stops checking and keeps working as the free version.
Of the IP address the check comes from, the address itself is not stored: a digest is kept, encrypted with a key that changes every month, from which the address cannot be recovered, and it is deleted after 90 days. It serves one purpose only: seeing whether a key is being used from many places at once.
Telegram: your bot and ours are not the same thing
There are two uses of Telegram in Stancel and they are opposites. Do not mix them up.
Our support bot — here we DO read you
Once the Telegram button is on the site, writing to us there is writing to us: those messages come to us and we read them, exactly as if you had emailed. That is what it is for.
We receive your Telegram chat ID and username — not your phone number, which Telegram does not give us —, whatever you write, and which page you came from: the button carries a short label with the page, the language and, if you arrived through a partner's link, their code. It tells us which pages raise questions; it does not identify you.
The licence key is also tied to that chat: the one the bot issues you, or the one you quote when you ask about it. It is what lets us answer you without asking for your email every time. We say so here because it is also what links this conversation to your licence: without it, this chat does not know who you are. Deleting the conversation deletes that link; your licence is untouched.
If the bot issues you the free key, you do not need to give us an email address: Telegram identifies you. That licence exists with no address attached, unless you give us one later.
When the bot cannot answer you, the question goes to the person who handles support — by Telegram or by email. As the bot is completed, the whole conversation will travel with it: what you wrote, the buttons you pressed, which page you came from and which licence you hold, if any. That is deliberate: the alternative is that you have to tell it all over again.
If you ask something the bot does not yet know how to answer, your question is stored exactly as you wrote it, along with which chat and which page it came from, so that we learn to answer it. The literal text is kept rather than a summary, because working out what repeats from a summary is guesswork. It is deleted when the conversation is.
And later those questions may be analysed using artificial intelligence — this does not happen today — to group what repeats and draft replies. That would mean sending the text of those questions to a provider located outside the EU, which appears as such in the table in §5. 🔒 The artificial intelligence answers nobody: no reply of its reaches you without a person reading and approving it. If you would rather your messages were not analysed that way, say so and they are not sent.
What already happens, and what does not. Today the bot keeps your last message, issues your free key and ties it to your chat, and passes on to a person whatever it cannot answer. The button history, the handover with the whole conversation, the store of unanswered questions and the analysis by artificial intelligence do not exist yet. They are described here because they are planned: we would rather tell you once, now, than change the rules on you every week.
It is kept for 12 months from your last message and then deleted — the conversation, the link to your licence and the stored question. If you would rather it went sooner, ask and it goes.
Telegram is the channel, and handles those messages under its own policy: it is outside the EU and appears as such in the table in §5. If you would rather Telegram were not involved, write to hola@stancel.net: the same things can be sorted by email, and no part of managing your licence depends on having Telegram.
And if you turn Telegram on in the program — here we do NOT read you
If you set up Stancel's Telegram service with your own bot, Stancel sends your alerts — and the panel photo, if you ask for it — from your computer straight to Telegram, to that bot of yours. They do not go through us and we do not see them: Telegram processes them under its own policy. Bear in mind that the photo shows what your panel shows, balance and positions included. Without the bot token nothing is sent to Telegram.
5. Processors and disclosures
Third-party services are used, each under its own data processing agreement:
- Email provider — to send the waiting-list messages.
- Site hosting.
- Payment gateway (merchant of record) — it is the seller of record to you and processes your payment data under its own policy. The controller neither sees nor stores your card.
No data is sold or disclosed to anyone else, except where the law requires it.
They are:
| Who | What they process | Where |
|---|---|---|
| Brevo (Sendinblue SAS, Francia — UE) | The list emails and the notices | EU |
| Hostinger (Hostinger International Ltd, Lituania — UE) | This website | EU |
| netcup GmbH (Germany — EU) | The licence server and the partner and customer portals: keys, activations, the licence checks, unsubscribes from the notices, the customer portal log, the site measurement (no IP addresses or cookies) and, if you are a partner, your tax and bank details | EU |
| Wise | Only if you are a partner and are paid outside SEPA. It executes the transfer | See §3-bis |
| Paddle.com Market Limited (no. 08172165, 30 Old Bailey, London EC4M 7AU, United Kingdom) | It is the seller of record to you: it charges you, issues your invoice and processes your payment data under its own policy | United Kingdom, covered by the European Commission adequacy decision renewed on 2025-12-19 and in force until 2031-12-27 |
| Telegram (Telegram Messenger Inc.) | Only if you write to us through the support bot: it is the channel those messages travel through, and it handles them under its own policy | Outside the EU. If you would rather it were not involved, write to hola@stancel.net |
| An artificial-intelligence provider | Only in future and only with the questions the bot could not answer (nothing is sent today): grouping what repeats and drafting replies that a person approves | Outside the EU. You can object, and then your messages are not sent |
The controller neither sees nor stores your card at any point: Paddle.com Market Limited (no. 08172165, 30 Old Bailey, London EC4M 7AU, United Kingdom) handles it.
Our order process is conducted by our online reseller Paddle.com. Paddle.com is the Merchant of Record for all our orders: the data you give when buying is collected and processed by Paddle under its own privacy policy, and all that reaches us is what is needed to deliver your licence — your email, what you bought and when.
6. Your rights
Access, rectification, erasure, objection, restriction and portability. Exercise them by writing to hola@stancel.net — and unsubscribing is one click — from the list, or from the trial reminders, the day-after email and the end-of-service notice — in any of those emails, with no reason given.
You may also lodge a complaint with the Spanish Data Protection Agency (aepd.es), which is the supervisory authority for this controller.
If you are outside the EU: the controller is established in Spain, so your data is processed there and this policy applies to you in the same terms. That is a statement of where the data lives — not a way of giving you less.
7. Minors
Neither the site nor the program is directed at minors, and their data is not knowingly collected.
8. Changes
If this policy changes in any material way, you will be told through the same email address you signed up with, before the change takes effect.
Last updated: 2026-10-08