Privacy policy

Last updated: 3 November 2026

This privacy policy describes which personal data Critivest processes, for what purposes and on which legal basis, as Article 13 of the General Data Protection Regulation (GDPR) requires. We only process the data needed to run the service. Critivest uses no analytics or advertising services, and your browser loads no content from other servers for its pages. If you enable device notifications, your browser connects to its push service as described below.

Controller

Bayer & Szell OG
Ludwig Kaiserstraße 12/1/15
3021 Pressbaum
Austria
Email: critivest@critivest.com

Visiting the website

For every request, the web server records the IP address, the date and time, the requested address, the status code, the amount of data transferred, the previously visited page and the browser identification. We need this data to deliver the website, fend off attacks and find errors. The legal basis is our legitimate interest in running the service securely (Article 6(1)(f) GDPR). The logs are deleted after 14 days at the latest.

Transport encryption

Your data is transmitted between your browser and our server exclusively encrypted via HTTPS with TLS according to the state of the art. This protects the confidentiality and integrity of your data during transmission (Article 32 GDPR).

Account

For an account, we store your email address, your password if you set one (only as an irreversible hash), your language, whether you have confirmed your email address, a new address until you confirm it, and your settings for strategy emails. In addition, we store the content you create: your watchlist, your criteria and strategies, the observed changes of their results and your progress through the introduction.

We process this data to provide Critivest as agreed (Article 6(1)(b) GDPR). We cannot create an account without an email address and either a password or Google sign-in. You can use the shared demo account without providing any data. You can delete your account at any time in the account settings. We then delete this data immediately; backups of the database keep it until we delete them, after 30 days at the latest.

Optional Google sign-in

If you choose Google sign-in, your browser is redirected to Google to authenticate you. Google receives connection data, such as your IP address and browser information, and learns that you use Google to sign in to Critivest. Google sends us a stable account identifier, your email address and whether Google has verified that address. We store the identifier with your account to recognize you on later sign-ins and when you confirm account changes with Google. Google authentication tokens are discarded once sign-in succeeds. We use this data to create and provide your account under the account purpose and retention periods above. We do not request access to Gmail, Drive or other Google account content.

Google sign-in creates a new account automatically if your email address is available. It does not automatically connect to an existing Critivest account with the same email address. When you register a new account through Google with an @gmail.com address that Google has verified, we accept that confirmation and send no separate confirmation email. Other Google email domains, including Google Workspace domains, still require our own email confirmation. Registering with a password also requires our confirmation, even for Gmail addresses. Strategy emails still require your explicit opt-in. The email address of a Google-linked account cannot be changed in Critivest, even if you set a local password or Google sign-in is disabled. Without a local password, you confirm deletion of your account by choosing your Google account again; you can optionally set a password using the password-reset email.

Google processes use of its sign-in service under its own privacy policy, which also explains processing outside the European Economic Area. You can manage the permission granted to Critivest in your Google account. Revoking that permission does not delete your Critivest account; you can delete it in the account settings.

Shared demo account

Everyone exploring the demo account sees the same watchlist, strategies and criteria. These cannot be changed. We store no information about you for the demo account.

Shared stocks

If you share a stock from its page, we store a random link for it and when you created the link. Anyone you pass the link on to sees the stock analyzed with your current strategies, including their names, criteria and results, but neither your email address nor your other stocks. When you stop sharing the stock, remove it from your watchlist or delete your account, we delete the link and it stops working. The legal basis is providing your account (Article 6(1)(b) GDPR).

Emails

We send you the emails that belong to your account: a link to confirm your email address, a link to reset your password (valid for one hour) and a notice to your previous address when you change it. You only receive strategy emails with the changes of your strategy results if you turn them on in the account settings, and you can turn them off there at any time. The legal basis is providing your account (Article 6(1)(b) GDPR).

Contact enquiries

When you use the contact form in the imprint, your name, email address, subject and message are sent by email to critivest@critivest.com so we can process and respond to your enquiry. The form does not create an account.

Device notifications

If you enable notifications on a device, we store its browser push address, encryption keys and a hashed device identifier against your account. The browser keeps the corresponding identifier in the critivest_push_device cookie for up to one year. The subscription expires after one year unless you explicitly enable it again. Notifications are independent of your email summary preference.

Our server sends encrypted notifications through the push service used by your browser, such as Apple, Google, Mozilla or Microsoft. That service receives delivery metadata; notification contents are encrypted for your browser. Notifications contain the number of strategy changes and affected stocks, without stock names, strategy names or account details. Opening Critivest shows your details after you sign in.

We keep the last observed strategy results for each subscribed device and delivery records to send and troubleshoot notifications. We also store which changes belong to each notification and which you have marked as seen, to display these changes in your watchlist. Unsent alerts expire after 24 hours; sent or cancelled delivery records and notification groupings are deleted after 30 days. Disabling notifications or signing out removes this device's subscription and history. Changing your password removes the subscriptions and history of your other devices; resetting it removes those of all devices. An account keeps at most 10 devices; enabling another one removes the device enabled longest ago. Deleting your account removes all its device subscriptions and history. You can also revoke the browser's notification permission in its settings.

Cookies and browser storage

Critivest only stores what the features you use need:

• a session cookie for your visit, which your browser deletes when you close it;
• after you log in, the REMEMBERME cookie that keeps you logged in, also after you close your browser, until you log out or do not visit Critivest for 30 days;
• short-lived cookies that protect forms against forgery and are deleted when you submit them;
• the critivest_push_device cookie linking this browser to your device notification setting, for up to one year;
• the app_locale cookie with the language you choose in the menu, for one year;
• the critivest-theme entry in your browser's local storage with the light or dark mode for one year. Once it expires, we stop using the selection and delete it the next time you visit the website. You can clear it in your browser at any time before then.
• a public offline page in the service worker cache, so the installed app can explain when there is no connection. This cache contains no account data, watchlists or stock prices. Old versions are removed when an updated service worker activates. You can remove the cache at any time by clearing this website's data in your browser.

These are strictly necessary for the features you request, so they need no consent (section 165(3) of the Austrian Telecommunications Act 2021). We set no cookies for analytics or advertising.

Stock data

Our server retrieves price and financial data from data providers. No data about you is transmitted, and your browser does not connect to these providers.

Recipients

These service providers process data on our behalf and on our instructions (Article 28 GDPR):

• Hosting of the website and the database: netcup GmbH, Emmy-Noether-Straße 10, D-76131 Karlsruhe
• Sending emails: netcup GmbH, Emmy-Noether-Straße 10, D-76131 Karlsruhe

For Google's processing when you choose Google sign-in, including international processing, see the section above.

No automated decisions

The results of your strategies are calculations based on your own criteria. We do not use them to make decisions about you within the meaning of Article 22 GDPR.

Your rights

You have the right of access (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18) and data portability (Article 20). To exercise these rights, write to the email address above.

Your right to object (Article 21 GDPR)

You can object to processing based on our legitimate interest on grounds relating to your particular situation. To do so, write to critivest@critivest.com.

If you believe we process your data unlawfully, you can lodge a complaint with the Austrian Data Protection Authority (Barichgasse 40–42, 1030 Vienna, www.dsb.gv.at) or with the supervisory authority of the EU country where you live.