Option Panel is in Beta. Free for every beta tester. Learn more

Privacy Policy

How we collect, process and protect your personal data.

OPTION PANEL S.L is committed to respecting users' privacy and to protecting and securing their personal data. Therefore, in accordance with current data protection regulations (Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016, the "GDPR", and Spanish Organic Law 3/2018 of 5 December on the Protection of Personal Data and the guarantee of digital rights), OPTION PANEL S.L sets out in this data protection policy how it collects and processes the personal data of users on the website www.optionpanel.com (hereinafter, the "Website").

The aforementioned regulations apply regardless of the user's place of residence. Should the user be located outside the European Economic Area, their personal data will be processed in accordance with European data protection regulations, ensuring a level of protection equivalent to that required by the GDPR.

Identification of the data controller

The controller of the personal data is OPTION PANEL, S.L. (hereinafter "OPTION PANEL" or the "Platform" interchangeably), with tax ID (CIF) number B26653147 and registered office at Plaza de la Estación, 4 - Bajo Izquierda, 46183 L'Eliana (Valencia), Spain.

Information on the purposes of processing

The controller will carry out the following data processing operations through the Website, using an appropriate legal basis for each one and respecting the rights and freedoms of the data subjects.

Management of the early-access form

  • Purpose: to manage your registration on the waiting list to take part in the Platform's testing phase.
  • Legal basis: performance of the contractual relationship.
  • Type of data: contact data (email address).

Management of registration for the OPTION PANEL Platform

  • Purpose: to manage your registration as an OPTION PANEL user and to enable access to and use of the Platform.
  • Legal basis: performance of the contractual relationship.
  • Type of data: identifying data and contact data.

Use of the Platform: your trading records and your trade journal

  • Purpose: to provide the Platform's own functionality: to record and analyse your options positions, to connect the broker accounts you choose so that your executions can be imported and the instructions you give can be transmitted, to import the executions contained in the files you export from your broker and choose to add, and to keep the notes you write in the trade journal of each trade together with any images you attach to them.
  • Legal basis: performance of the contractual relationship.
  • Type of data: the trades, executions, positions and results you record, or that are imported from the broker account you connected at your request or from the files you choose to import; the identification of those broker accounts and the access credentials for them, which are stored encrypted; and the content of your journal notes, including any images you attach to them.
  • About the content you attach: what a note or an image contains is chosen by you, and an image may be a screenshot showing, for example, an account number, a balance or a name. OPTION PANEL does not inspect that content. It is stored for the sole purpose of showing it back to you in your own journal: images are not public, are served only to the account that owns them and only in response to an authenticated request, and are re-encoded when you upload them, which removes any metadata the file carried (such as camera or location information).
  • About the videos you link: a journal note may also carry a link to a video hosted by a third party (currently YouTube or Vimeo). OPTION PANEL stores only the reference to that video, and nothing at all is requested from the third party while you read the note: the card you see is drawn by OPTION PANEL, with no image or script loaded from the provider. Only when you choose to play the video is the player loaded from the provider, because you ask to watch it as part of the service you contracted, and from that moment the provider receives your IP address and whatever data it collects by itself under its own privacy policy. Its player may also store on your device what it needs to play the video and keep its settings: YouTube's player, which OPTION PANEL loads in its privacy-enhanced mode, sets no cookies, and Vimeo's, which OPTION PANEL loads with its analytics disabled, sets only the security cookies of its network provider. OPTION PANEL is responsible only for loading the player when you press play; what the provider does with your data afterwards is its own responsibility, as an independent controller. YouTube is provided in the European Economic Area and Switzerland by Google Ireland Limited, and elsewhere by Google LLC, in the United States, and the journal plays its videos through the YouTube API Services (Google Privacy Policy). Vimeo is provided by Vimeo.com, Inc., in the United States (Vimeo Privacy Policy).
  • About the files you import: importing executions from a file is optional and happens only when you add a file. The file is read in your browser and is never sent to OPTION PANEL or stored by it: only the executions read from it, the number of the broker account they belong to and the technical details described below reach our servers. That account number is not stored: OPTION PANEL keeps only a fingerprint of it, computed with a secret key (a keyed hash), so that the next file of the same account can be recognised, and its last four digits, so that you can tell your accounts apart. With the account into which you import, OPTION PANEL also keeps the name the file gives that account, if it gives one, the broker's name if you type it yourself, and the time zone you choose for reading the file's times. For each import it keeps a record of when it was made, into which account and how many executions it added or left out, and, for each file read, the format recognised and a fingerprint of its content, never the file's name, so that the same file is not imported twice and so that you can undo that import. Executions imported from a file are marked as such, because they have not been verified with the broker. Undoing an import deletes its executions; the record of the import is kept, marked as undone.

Management of subscriptions, billing and payments

  • Purpose: to manage your subscription to the Platform, to charge for it and to issue the corresponding invoices.
  • Legal basis: performance of the contractual relationship and compliance with the tax and accounting obligations to which OPTION PANEL is subject.
  • Type of data: identifying and billing data, tax identification number, country, and the data needed to identify the payment method used (such as its brand and last four digits). Card details are entered directly with our payment provider and are neither received nor stored by OPTION PANEL.

Management of electronic commercial communications

  • Purpose: to manage the sending of commercial communications relating to the services offered by the OPTION PANEL Platform by electronic means. In any case, the user may withdraw their consent and unsubscribe at any time through the "User settings" section provided for that purpose within the Platform itself.

Management of the contact form

  • Purpose: to manage and respond to enquiries and/or requests related to the OPTION PANEL Platform.
  • Legal basis: performance of the contractual or, where applicable, pre-contractual relationship.
  • Type of data: contact data (email address).

Management of support requests made from within the Platform

  • Purpose: to receive, track and respond to the reports, suggestions and support requests you send from the Platform's feedback section.
  • Legal basis: performance of the contractual relationship.
  • Type of data: contact data and the content you write, together with any file you attach to the request.

Measurement of the effectiveness of our acquisition channels

  • Purpose: when you register, to record the origin of your visit (for example, the advertising campaign, source, medium or click identifier contained in the link you followed) and to analyse it, both individually and in aggregate, in order to understand which channels bring us users and to measure the cost and quality of each channel, including how active those users become on the Platform.
  • Legal basis: our legitimate interest in measuring and improving the effectiveness of our marketing, balanced against the rights and freedoms of the data subject. You may object to this processing at any time (see "Exercising your data protection rights").
  • Type of data: acquisition source, campaign, medium and advertising click identifiers, linked to your account. This information is deleted or anonymised when your account is deleted or anonymised.

Audience measurement

  • Purpose: to count the visits to the Website and to the Platform and to know which pages are read, in aggregate. We use Umami for this, an open-source statistics tool that OPTION PANEL runs on its own servers: the data is not shared with any third party and is used for nothing but counting visits. It is independent of the Google Analytics measurement described below and of the choices you make in the cookie settings panel, because it uses no cookies.
  • Legal basis: our legitimate interest in understanding the use of our own Website and Platform (art. 6.1.f GDPR). You may object to this processing at any time (see "Exercising your data protection rights"). If your browser sends the Do Not Track signal, the visit is not recorded.
  • Type of data: for each page you open, its address without the query string, its title, the page you came from if any, your screen size and your browser language are sent to the same domain you are visiting. From your IP address and the details your browser sends with every request, our server works out your approximate country, region and city, your browser, operating system and type of device, and computes a visit identifier that changes every month and is different on the Website and on the Platform. The statistics do not store your IP address and are not linked to your account, and that identifier cannot recognise you from one month to the next or follow you to other websites.
  • On the Platform: the address is sent with any identifier in it replaced by a placeholder (for example, the number of a trade), and the page title is not sent.
  • On your device: no cookies are used and nothing is stored on your device. The script only checks whether your browser holds the flag that switches the measurement off (umami.disabled), which OPTION PANEL never creates. This meets the conditions the Spanish Data Protection Agency (AEPD) sets for audience measurement to need no consent.

Website usage analytics

  • Purpose: to analyse, in aggregate, how visitors use our website — which pages are viewed, how visitors arrive and where they leave — in order to improve its content and structure. We use Google Analytics 4 for this. It is a separate purpose from the advertising measurement described below: analytics data is not used to build advertising audiences and is not imported into our advertising accounts as a conversion.
  • Legal basis: in regions where the law permits (currently the United States), our legitimate interest in understanding and improving our website, with these cookies set by default and an opt-out available at any time (the cookie settings panel and the browser's Global Privacy Control signal); everywhere else, including the European Economic Area and the United Kingdom, your consent, given through the cookie banner (analytics category), which you may withdraw at any time from the cookie settings panel.
  • Type of data: online identifiers and browsing data (pages viewed, approximate location, device and browser characteristics, and the source that referred the visit).

Advertising and conversion measurement on third-party platforms

  • Purpose: to measure the effectiveness of our advertising campaigns on third-party platforms (Reddit and Google Ads), including whether a visit originating from an advertisement results in a registration, by means of advertising cookies/pixels and equivalent server-to-server conversion measurement.
  • Legal basis: in regions where the law permits (currently the United States), our legitimate interest in measuring the effectiveness of our advertising, with these cookies and pixels set by default and an opt-out available at any time (the cookie settings panel and the browser's Global Privacy Control signal); everywhere else, including the European Economic Area and the United Kingdom, your consent, given through the cookie banner (marketing category), which you may withdraw at any time from the cookie settings panel.
  • Type of data: online identifiers, advertising click identifiers and conversion event data.

Recipients of the personal data

Disclosure of data to third parties

As a general rule, the personal data collected through the website will not be disclosed to third parties except where required by law. In addition, where advertising cookies (marketing category) are enabled — set by default in regions where the law permits (currently the United States, subject to opt-out via the cookie settings panel and the Global Privacy Control signal), and enabled with your consent everywhere else, including the European Economic Area and the United Kingdom — data relating to advertising conversions is shared with the advertising platforms Reddit (Reddit, Inc. and, where applicable, Reddit Ireland Ltd.) and Google (Google Ireland Ltd. / Google LLC) for the sole purpose of measuring the effectiveness of our campaigns, in accordance with their respective terms and privacy policies. Separately, where analytics cookies (analytics category) are enabled on the same terms, website usage data is shared with Google (Google Ireland Ltd. / Google LLC) as the provider of Google Analytics, for the sole purpose of producing the aggregate usage statistics described above. Google Ads and Google Analytics are the same company but distinct services with distinct purposes, and accepting one category does not enable the other. Separately, when you connect a broker account to the Platform and give an instruction through it (for example, sending, amending or cancelling an order), the data strictly necessary to carry out that instruction is transmitted to the broker you chose, which acts as an independent controller under its own terms and privacy policy; OPTION PANEL transmits it only at your request and only to the broker you connected. Separately, when you press play on a video linked in a journal note, your browser sends your IP address to the provider of that video (YouTube or Vimeo), as described under the trade journal above.

Data processors

Notwithstanding the above, the data of Website users may be processed by suitable service providers engaged by OPTION PANEL acting as data processors. Such service providers will only process the data for the purposes established by the controller and in accordance with its instructions, as provided in art. 28 GDPR. The providers currently engaged are Amazon Web Services (hosting of the Platform, management of user identity and storage of the files you attach), Stripe (processing of payments and subscriptions; in respect of payment data Stripe also acts, under its own terms, as an independent controller in order to comply with its own legal obligations and to prevent fraud), Postmark (delivery of transactional email), Brevo (delivery of commercial and lifecycle email), Tally (collection of your answers to the surveys we send you) and Atlassian (management of the support requests described above).

International data transfers

The Platform and the data it holds are hosted on Amazon Web Services (AWS) servers located in the United States, and Postmark, which delivers our transactional email, processes your email address and those messages in the United States as well. Both providers are certified under the EU-U.S. Data Privacy Framework, which the European Commission recognised as ensuring an adequate level of protection by its adequacy decision of 10 July 2023 (Implementing Decision (EU) 2023/1795), so these transfers rest on article 45 GDPR. The contracts of both providers also include the standard contractual clauses approved by the European Commission (article 46 GDPR), which would govern these transfers should that decision cease to apply. Brevo and Tally host the data they process on our behalf in the European Union; where Brevo's own sub-processors outside the European Union take part, its data processing agreement covers them with the standard contractual clauses or the EU-U.S. Data Privacy Framework. Where advertising cookies are enabled, data shared with Reddit and Google for conversion measurement may also be transferred to the United States; such transfers are covered by those providers' adherence to the EU-U.S. Data Privacy Framework and/or the corresponding standard contractual clauses. When you play a Vimeo video, or a YouTube video from outside the European Economic Area and Switzerland, your IP address reaches Vimeo.com, Inc. or Google LLC in the United States, both certified under the EU-U.S. Data Privacy Framework, so that transfer rests on the same adequacy decision (article 45 GDPR).

Retention periods

OPTION PANEL will retain users' personal data for as long as necessary to fulfil the purpose for which it is processed or until the data subject requests the erasure of their personal data. In any case, the retention period for your data will depend on the purposes for which OPTION PANEL processes it, as detailed below:

  • Data relating to the contact form: retained for as long as necessary to handle the enquiry.
  • Data used to process and manage your account on the Website: processed for as long as you remain a registered user or until you request the erasure of your data.
  • Data used to process your registration on the Platform: processed for as long as necessary to provide the contracted service, including any complaints or claims relating to the service, and in any case retained for a period of five (5) years.
  • With regard to the use of your data to send electronic commercial communications, it will be processed for that purpose until you unsubscribe from commercial communications through the section provided for that purpose within the Platform and, in any case, until you exercise your right to erasure.
  • Audience measurement data: deleted after twenty-five (25) months.
  • Data relating to your use of the Platform (the trades, executions and positions you record or import, the record of each import and the account number fingerprints and last four digits described above, and the journal notes you write together with any images attached to them): processed for as long as you remain a registered user. A note or an image that you delete is removed from our systems; the copies kept by the storage service's versioning, which exist so that an accidental deletion can be undone, are erased within seven (7) days.
  • Records of the instructions given through the Platform, in particular the sending, amendment or cancellation of orders: retained for seven (7) years from the date of the instruction, so that the activity carried out through the Platform can be traced and so that any claim relating to it may be established, exercised or defended.
  • Records of each execution recorded on the Platform, whether received from a connected broker, imported from a file or entered by hand, of every change, move or deletion of an execution, including the undoing of an import, and of each broker account you add or change, together with the IP address and browser from which you did it: retained for seven (7) years from the date of each record, even if the execution or the account is later deleted or you close your account, on the basis of our legitimate interest in being able to trace the activity recorded on the Platform and to establish, exercise or defend any claim relating to it.
  • If you close your account: your data is kept for ninety (90) days from your request, so that the closure can still be revoked, and is then anonymised, after which the remaining record no longer identifies you. The records of instructions and executions described in the two previous points are kept for the period stated there. Invoices already issued are retained for the period required by tax and accounting legislation.

Exercising your data protection rights

At any time, the user may exercise their rights of access, rectification, erasure, objection, restriction and portability of their data by sending an email to the following address: info@optionpanel.com, identifying the right they wish to exercise. The user is also informed that, should they consider that the exercise of their rights has not been satisfactorily addressed, they may lodge a complaint with the Spanish Data Protection Agency. More information at www.aepd.es.

Security measures

OPTION PANEL adopts the necessary measures, as well as appropriate security procedures, aimed at implementing technical and organizational measures to detect potential risks and minimize them, regularly reviewing and updating these measures in order to comply at all times with data protection regulations. In particular, communications with the Platform travel over encrypted channels; the credentials of the broker accounts you connect are stored encrypted; the files you import from your broker are read in your browser and are never uploaded, and the account numbers they name are kept only as a fingerprint computed with a secret key held apart from the database, together with their last four digits; and the images attached to your journal notes are held in a private repository that is not publicly accessible, encrypted at rest with a key dedicated to that purpose, and served only to the account that owns them and only in response to an authenticated request.

Updates

The organization reserves the right to modify the content of this Website at any time, and may add new features as well as amend this policy. In that case, the corresponding update will be published on the Website so that the user is aware of any changes.

October 2026