IB Lab.

IB Lab. Legal

Privacy and Cookie Policy

Effective from 17 October 2026

This English version is a courtesy translation. If it differs from the Czech original, the Czech version prevails.

1. Controller and Contact

The controller of your personal data is Desmond Akahomen, Company ID (IČO) 08113912, with registered office at Chrudimská 1575/6, 130 00 Praha 3, the operator of the IB Lab platform at iblab.io (“we” or “IB Lab”). We have not appointed a data protection officer.

Contact for all questions and requests concerning personal data: support@iblab.io.

This document supplements the Terms and Conditions and the Recurring Payment Terms. It describes what data we process about you, why, who we share it with, how long we keep it and what rights you have. It also serves as our information on cookies and similar technologies.

2. What Data We Process

Depending on how you use the service, we process the following categories of data:

  • Account data: e-mail, password (we store only its hash), name (derived from the part of the e-mail before the @), the e-mail verification flag and time, interface language, role, status and reason of any account ban (set by an administrator), the IP address and browser user agent from the time of registration, the partner code used at registration, masterclass video preferences and click counter, and the dates the account was created and last changed.
  • Sessions: session token, IP address, user agent and expiry time. A session lasts 30 days and may be extended as you use the app.
  • Subscription and payments: customer and subscription identifiers at the payment service provider (so far Stripe Payments Europe, Ltd.; now GoPay s.r.o.), plan, status, period, currency and cancellation flags, a log of events from the payment gateway, checkout attempts and a list of accounts from the time the account at the previous payment service provider was closed, kept for a subscription-renewal offer. We never store payment card numbers; you enter them directly at the payment service provider.
  • Records against duplicate accounts: from the data the payment gateway passes to us, we keep a payment method fingerprint, the wallet e-mail, the billing name, address, phone number and tax ID, where the payment includes them. They serve to prevent duplicate accounts and abuse of the trial period (see clause 6.8 of the Terms and Conditions). Such cases are reviewed by a person, an administrator. No decision is made automatically.
  • Trade journal: your own records, see section 10.
  • Discord link: if you start it yourself, see section 9.
  • Usage data: product analytics events (page views, feature events such as checkout_started or landing_cta_click), clicks on masterclass videos and session recordings (session replay), see section 7.
  • Error and diagnostic logs: server errors, errors captured in the browser and hosting runtime logs, see section 4.
  • E-mails: a record of the e-mails sent (including the message identifier at the e-mail provider), the registry of opt-outs from marketing e-mails and, for the earlier form on the landing page (waitlist), the e-mail you entered, see section 8.
  • Partner programme: the partner's code, the accounts registered through that code and payout requests (amount, currency, status, times). We do not store bank details in the app.

The service is not intended for persons under 18 and we do not knowingly process data about them.

3. Purposes and Legal Bases

  • Performance of a contract (Art. 6(1)(b) GDPR): creating and managing your account, login, providing the service including the trade journal, personalisation (for example the interface language), subscription and payments, and the Discord link that you start yourself.
  • Legal obligation (Art. 6(1)(c) GDPR): keeping accounting and tax records.
  • Legitimate interest (Art. 6(1)(f) GDPR): security and abuse prevention (IP address and user agent at registration and in sessions), preventing duplicate accounts and abuse of the trial period, product analytics and improving the service, diagnosing and fixing errors, defence of legal claims, and business communications to existing customers with the option to refuse them at any time (see section 8).
  • Consent (Art. 6(1)(a) GDPR): the e-mail entered in the earlier form on the landing page (waitlist). You can withdraw consent at any time; withdrawal does not affect the lawfulness of processing before it.

Administrators also have access to the data, see section 11. Cookies and similar technologies are described in section 7, including the fact that we do not use a cookie banner today.

4. Recipients and Processors

The following providers process data for us, each only within the scope of its role:

  • Vercel Inc. (USA): hosting, CDN and server functions (Frankfurt region), runtime logs.
  • Supabase (PostgreSQL database on AWS infrastructure in Frankfurt, eu-central-1; a US company): storage of all application data.
  • PostHog (EU Cloud, Frankfurt): product analytics, session recordings and error capture in the browser.
  • Resend, Inc. (USA): sending transactional and marketing e-mails.
  • Functional Software, Inc. (Sentry, USA): server error reporting (without performance tracing, with context such as the user identifier).
  • Discord Inc. (USA): only if you link your account with Discord, see section 9.
  • Google LLC: YouTube videos embedded on the website (landing page, statistics, masterclass), see section 7.
  • TradingView: TradingView chart snapshots that you add to the journal yourself are loaded from its servers, see section 7.
  • Payment service provider: Stripe Payments Europe, Ltd. (previous) and GoPay s.r.o. (new). It processes payments; you enter your card details directly with it.

The data is also visible to the owner of IB Lab and to users with the administrator role, see section 11.

5. Transfers Outside the EEA

Our database and hosting are in Frankfurt, but some of our providers are US companies or have US parent companies. This concerns in particular Vercel, Supabase, PostHog, Resend, Sentry, Discord, Google and Stripe. Transfers of data outside the European Economic Area to them rely on the EU-US Data Privacy Framework or on the European Commission's standard contractual clauses.

6. Retention Periods

  • Account data: for the life of the account and up to 1 year after you ask for it to be deleted (backups and defence of legal claims).
  • Billing and accounting records: 10 years (accounting and tax law).
  • Sessions: a login lasts 30 days and may be extended as you use the app; we keep session records at most as long as the account data.
  • Registry of e-mail opt-outs: indefinitely, so that we always honour your opt-out.
  • Records on duplicate accounts and abuse: for the life of the account and up to 1 year after.
  • Session recordings in PostHog: 30 days.
  • Analytics events: according to the retention period set in our PostHog project.
  • Server logs: according to the retention period at Vercel and Sentry, usually 90 days.

When the period ends, we delete the data unless the law requires us to keep it longer.

7. Cookies and Similar Technologies

There is no cookie banner at the moment. We need essential cookies for login to work. Analytics tools (PostHog and the lp_ab cookie) are currently set without prior consent. You can limit non-essential cookies in your browser settings; the app does not yet have a separate switch that would turn off PostHog analytics.

We set all the cookies below ourselves (first-party) unless stated otherwise.

Essential:

  • __Secure-better-auth.session_token: login session. Valid for 30 days, may be extended as you use the app.
  • __Secure-better-auth.session_data: a short (5-minute) cache of the login session, so that the app does not have to query the database on every request.
  • ib_app: a flag that you have a session in the app, used by the website to redirect you to the app. Valid for 30 days.
  • __Secure-better-auth.state: protects the Discord link against a forged request. Set only while you link Discord, valid for 5 minutes.

Preferences and partners:

  • NEXT_LOCALE: the chosen language. Valid for 1 year.
  • IB_CURRENCY: the displayed currency. Valid for 1 year.
  • ib_ref: attribution of a partner referral, if you arrive through a partner link. Valid for 30 days.

Analytics (non-essential):

  • lp_ab: the landing page variant in an A/B test. Valid for 1 year.
  • ph_* (cookie and localStorage of PostHog): product analytics, session recordings and error capture in the browser. In session recordings all form fields are masked, the e-mail fields on login and registration are not recorded at all, and request headers and bodies are not captured. A person profile (user identifier, e-mail and name) is created only after you log in. The lifetime is governed by the PostHog library settings. The data goes through our own domain (the /ingest path) to PostHog EU Cloud in Frankfurt. Some events (for example from the payment gateway, from e-mail verification and from sending e-mails) we send to PostHog directly from the server, without cookies; they are tied to your account identifier and your browser settings do not affect them.
  • Vercel Web Analytics and Speed Insights: traffic and speed measurement without cookies.

Browser storage (localStorage) that stays only in your browser:

  • ib-instrument and ib-session: the instrument and session you chose in the app.
  • ib-video-clicks (for a logged-in user, with the account identifier in the name): a helper copy of the masterclass video click counter, which we also store with your account.
  • PostHog's own storage (ph_*), see above.

Third parties:

  • We embed YouTube videos (on the landing page, in the statistics and in the masterclass) through youtube-nocookie.com (privacy-enhanced mode); video thumbnails are loaded from Google's servers (i.ytimg.com). As soon as the embedded player or a thumbnail loads, your IP address and browser details are passed to Google; once you play a video, Google may store further data.
  • TradingView chart snapshots that you add to the journal yourself are loaded, when you open a trade's detail, directly from TradingView's servers (s3.tradingview.com). As soon as a snapshot loads, your IP address and browser details are passed to TradingView.

You can delete or block cookies in your browser settings. If you block the essential cookies, login will not work.

8. Marketing Communications and Unsubscribing

We send you two kinds of e-mails:

  • Transactional e-mails related to the service: e-mail verification, password reset, notices about the trial period, subscription and access, and messages about the Discord link.
  • Marketing e-mails to registered users: automated series of e-mails (for example during the trial period and after the subscription ends) and occasional one-off campaigns.

Every marketing e-mail contains a one-click unsubscribe. After you unsubscribe, we stop sending you marketing e-mails and we record the opt-out in a registry so that we honour it. You can also object to marketing at any time at support@iblab.io.

The legal basis is our legitimate interest and the relationship with an existing customer with the option to refuse (Section 7(3) of Czech Act No. 480/2004 Coll.). We use the e-mail from the earlier form on the landing page (waitlist) on the basis of the consent you gave when submitting it. E-mails are sent through the provider Resend, Inc. (USA).

9. Discord Link

Linking your account with Discord is voluntary and you start it yourself through Discord's login (OAuth). We store your Discord user ID, the access and refresh tokens and the granted scopes. The app then adds you to the IB Lab Discord server, assigns you roles (Trader, IB Trader) and checks once a day that the roles match the status of your access. We also keep aggregated snapshots of the server's state.

The recipient of the data is Discord Inc. (USA). You can unlink in your account settings (/account), or ask us to at any time by e-mail at support@iblab.io.

10. Trade Journal and User Content

In the journal you store your own trades (instrument, direction, prices, result, times, setup, MFE/MAE, notes, tags and custom parameters), links to TradingView chart snapshots that you add yourself, and the journal settings. These records remain yours and we use them to run the journal, that is, to perform the contract. While handling support, an administrator can view them in read-only mode (see section 11).

You can ask for your account and journal data to be deleted by e-mail at support@iblab.io. We do not yet offer self-service account deletion.

11. Security

We store your password only as a hash and we do not store payment card numbers at all. The login cookies carry the __Secure- prefix, so they are sent only over a secure connection. The data is hosted in Frankfurt.

The owner of IB Lab and users with the administrator role have access to account data, subscription status, records on duplicate accounts, e-mail logs and, in read-only mode, the trade journal, solely for support, payment administration and abuse prevention.

12. Your Rights

You have the right of access to your data, to rectification, to erasure, to restriction of processing, to data portability and the right to object to processing (including an objection to marketing, which you can make at any time). Where processing is based on consent, you can withdraw it at any time.

Send your requests to support@iblab.io. We delete an account on request; self-service deletion is not yet possible.

We do not carry out any automated individual decision-making that would have legal or similarly significant effects on you.

If you believe we handle your data contrary to the rules, you can lodge a complaint with the Úřad pro ochranu osobních údajů (Office for Personal Data Protection), Pplk. Sochora 27, 170 00 Praha 7, www.uoou.cz.

13. Chrome Extension

The IB Lab. Journal for TradingView extension for the Chrome browser has its own separate privacy policy, which you can find at /extension-privacy.

14. Changes to This Policy

We may update this policy, for example when the law or the tools we use change. The current version is always published on this page with its effective date. We will inform you of material changes in a reasonable manner.

15. Effective Date

This policy is effective from 17 October 2026.