Privacy Notice
Version 2026-10-18 · Last updated 18 October 2026
In brief
- We collect what we need to run your account: your email address, your plan, your watchlist, which version of the Terms you accepted, and a short record of how the app is used.
- We do not sell data, show ads, use tracking cookies or tailor research to you.
- Our app and database are hosted in Switzerland. Some providers process data in other countries (section 7).
- Vera’s questions go to Google’s Gemini AI to be answered.
- Email us to see, correct or delete your data (section 10).
1 Who is responsible
The company below runs OrderSendAI. It is responsible for your personal data (the “controller”) under the Swiss Federal Act on Data Protection and, where they apply, the EU and UK General Data Protection Regulation.
Tickles Trading Technologies GmbHBaarerstrasse 826300 ZugSwitzerlandEmail: Info@ticklestrading.comFor anything about your personal data, email us at Info@ticklestrading.com.
2 What we collect and why
Your account and sign-in
Your email address and password. Our sign-in provider, Supabase, keeps your password only in scrambled form (a hash), and we never see it. Supabase also records when you signed up and last signed in. We send you an email to confirm your address.
If you choose “Continue with Google”, Google sends Supabase your name, email address and profile picture. We use only your email address.
- Why
- To create your account and sign you in.
- Legal basis
- Needed to provide OrderSendAI to you under our contract with you.
- How long
- Until your account is deleted.
Your customer record
Your account id, email address and plan, any limits we set for your account, and when you signed up, last signed in and last used the app (to within 5 minutes). We write it when you use the app signed in.
- Why
- To run your account and apply your plan.
- Legal basis
- Needed to provide OrderSendAI to you under our contract with you.
- How long
- Until your account is deleted.
Your acceptance of the Terms
Which version of the Terms and Conditions you accepted, when, and whether you accepted it when you signed up or later in the app.
- Why
- To show that you accepted the Terms and Conditions.
- Legal basis
- Our legitimate interest in being able to prove our agreement with you.
- How long
- Until your account is deleted.
Your watchlist
The stocks you add and when you added them. If a browser saved a watchlist before you signed in, a random id for that browser (osa_device_id, section 5) joins that list to your account once, and the id stays with the list in our database.
- Why
- To keep your watchlist.
- Legal basis
- Needed to provide OrderSendAI to you under our contract with you.
- How long
- Until your account is deleted.
Your messages to Vera
To answer, we send your recent messages, with research from our database, to Google’s Gemini AI, which writes the answer. For questions about stocks, Gemini may also run a Google Search.
Your messages are not saved with your account or in our usage records, and your browser holds the conversation only while the tab is open. To save cost, Vera’s answers are kept in a short-term cache in our database for 24 hours to 7 days. The cache is keyed by a fingerprint of the conversation and is not linked to your account. An answer can repeat what you asked.
Under Google’s terms for paid use of the Gemini API, Google does not use these requests to improve its products. It keeps them for a limited time to detect abuse, and keeps requests that used Google Search for 30 days.
Please do not type personal information into Vera.
- Why
- To answer your questions.
- Legal basis
- Needed to provide OrderSendAI to you under our contract with you.
- How long
- Answers in our cache: 24 hours to 7 days. At Google: as described above.
Usage records
A short record of what is done in the app: the kind of action, the type of page or the stock’s ticker, whether a phone, tablet or computer was used (worked out from the browser’s details, which we do not keep), and the time. Records of what you do signed in are linked to your account. The kinds are:
- Sign-ups, sign-ins and visits to the app
- Pages and stocks you view
- Analyses brought up to date while you view a stock, or when you ask
- Messages Vera answered and whether the answer worked, never what was said
- PDF reports made and downloaded
- Share links made
- Changes to your watchlist, including an add refused because the list was full (with its limit and size) and a list from before sign-in joining your account
- Changes we make to your plan or limits
- Your acceptance of the Terms and Conditions
- Visits to our home page and views of a shared report, counted with no identifier
A usage record never holds your IP address, your browser’s details, your email address, or anything you search for or ask Vera.
A share link does not itself record who made it; the usage record of making it does. Anyone with the link can read that report for 7 days.
- Why
- To understand how the app is used, manage its cost and capacity, and fix problems.
- Legal basis
- Our legitimate interest in running and improving OrderSendAI. You can object (section 10).
- How long
- 180 days, then deleted.
Technical logs
Our app logs each request’s type, the route it reached, its result and how long it took. Log lines can carry your account id and the stocks involved, never your email address. Our app logs no IP address and no search or chat text.
To answer a repeated search quickly, we keep its results (a list of companies, not linked to you) for about a minute, under a code made from the search words that does not contain them. They are deleted within the hour.
Our hosting provider (Microsoft Azure) and our sign-in provider (Supabase) keep their own security logs, which include IP addresses.
- Why
- To keep OrderSendAI secure and working, and to fix problems.
- Legal basis
- Our legitimate interest in security and reliability.
- How long
- Under our providers’ log settings.
Changes we make to your account
When we change your plan or your limits, we keep a record: your account id, what changed, when, which of our administrators made the change, and their note.
- Why
- To keep an accurate record of changes we make to accounts.
- Legal basis
- Our legitimate interest in an accurate record of our own changes.
- How long
- No fixed deletion date yet.
Emails you send us
Your message and our reply.
- Why
- To answer you.
- Legal basis
- Our legitimate interest in answering you, or our contract with you.
- How long
- As long as we need to deal with your request.
3 AI and how the research is made
- Scores and ratings come from fixed formulas, not from AI.
- Much of the research text is written by Google’s Gemini AI from company and market data. It uses no personal data and is the same for every reader.
- Vera is an AI assistant that uses Google’s Gemini AI. Section 2 explains what happens to your messages.
- We make no decisions about you by automated means that have legal or similarly significant effects on you.
4 What we do not do
- We do not sell or rent personal data.
- We show no ads, and we use no advertising or third-party analytics tools and no tracking cookies.
- We do not tailor research to you: every reader gets the same research, and your data never feeds it.
- We do not use your data to train AI.
5 Cookies and browser storage
OrderSendAI keeps these few items in your browser. None of them tracks you across other websites.
sb-…-auth-tokenCookie- Keeps you signed in. Needed for the app to work. The middle part is our sign-in project’s id; a long one is split into parts ending .0, .1.How long: Until you sign out, or up to 400 days, renewed when you use the app
sb-…-auth-token-code-verifierCookie- Completes a Google sign-in or an email confirmation link safely.How long: Removed once you are signed in
themeLocal storage- Remembers whether you chose the light or dark theme.How long: Until you clear it
osa_home_guide_hiddenLocal storage- Remembers that you hid the guide on your home page.How long: Until you clear it
osa_device_idLocal storage- A random id for this browser, sent when you open your watchlist, so a list this browser saved before you signed in joins your account once.How long: Until you clear it
osa_lvSession storage- Marks that this tab’s visit to our home page was counted, so a reload is not counted again.How long: Until you close the tab
Your browser’s settings let you delete or block cookies and site data. If you block the sign-in cookie, you cannot sign in. Clearing site data resets your theme and the home page guide.
6 Who processes data for us
- Supabase: sign-in and our database, which holds your account, your watchlist, usage records and Vera’s answer cache. It stores our data in Zurich, Switzerland.
- The email service that sends the emails confirming your address, which receives your email address.
- Microsoft Azure: runs our website and app servers, keeps their logs and stores our research reports (which hold no personal data), in its Switzerland North region.
- Google: its Gemini AI writes Vera’s answers, with Google Search for some of them, and much of the research text. If you choose “Continue with Google”, Google is also your sign-in provider, under its own privacy policy.
- Authorities, when the law requires us to share data.
- A company that takes over OrderSendAI, which would have to keep to this notice.
7 Data outside Switzerland
Our app and database are hosted in Switzerland. Some data can be accessed or processed in other countries:
- Supabase staff and the companies that support Supabase may access data from the United States and other countries. The safeguard is the EU Standard Contractual Clauses, with the Swiss addendum, in Supabase’s data processing agreement.
- Google may process Vera’s requests in any country where it operates, including the United States. Google is certified under the Swiss-US and EU-US Data Privacy Frameworks.
- Microsoft may access data from other countries to support Azure, including the United States. Microsoft is certified under the Swiss-US and EU-US Data Privacy Frameworks.
The EU and the UK recognise that Switzerland protects personal data adequately, so data can come to us from there.
8 How long we keep data
| Data | How long |
|---|---|
| Your account, customer record, watchlist and acceptance of the Terms | Until your account is deleted |
| Usage records | 180 days |
| Vera’s cached answers | 24 hours to 7 days |
| Vera’s requests at Google | A limited time to detect abuse; 30 days for requests that used Google Search |
| Records of changes we make to your plan or limits | No fixed deletion date yet |
| Logs kept by our hosting and sign-in providers | Under the providers’ settings |
| Emails you send us | As long as we need to deal with your request |
9 Security
- Connections to OrderSendAI are encrypted.
- We never see or store your password. Supabase keeps it only in scrambled form.
- Only named administrators can open our admin tools, where they can see each account’s record, watchlist and recent usage records.
- The programs that write the research never read account data.
- No system is completely secure. If a breach puts you at risk, we will tell you and the authorities as the law requires.
10 Your rights
You can ask us to:
- show you the personal data we hold about you, and give you a copy in a common format;
- correct it;
- delete it, together with your account;
- stop or limit using it, including objecting to usage records;
- where we rely on your consent, withdraw it.
Email us at Info@ticklestrading.com from the address on your account. We answer within 30 days and may ask you to confirm that the request comes from you.
You can also complain to a data protection authority: in Switzerland, the Federal Data Protection and Information Commissioner (opens in a new tab); in the EU, the authority in your country; in the UK, the Information Commissioner’s Office (opens in a new tab).
If you live in the United States, you can make the same requests by email. We do not sell or share personal information, and we do not use sensitive personal information.
You need an email address to have an account. Everything else in section 2 comes from using the app.
11 Children
OrderSendAI is for adults 18 and over. If we learn that someone under 18 has an account, we delete it.
12 Changes to this notice
When we change this notice, we update the version and the date at the top.
13 Contact us
For questions about your personal data, write to us:
Tickles Trading Technologies GmbHBaarerstrasse 826300 ZugSwitzerlandEmail: Info@ticklestrading.com