Privacy policy

Last updated: 5 September 2026.

1. Controller

Athanasios Karantonis, acting as a sole proprietor under the name "InvestBeacon" (see legal notice).
Geographic business address: Sigis 11, Thessaloniki, Greece, ZIP CODE: 55438
VAT identification number: EL168282006
Email: compliance@investbeacon.eu

2. Hosting and delivery

The website is hosted on the Lovable platform and served through the global edge network of Cloudflare, Inc. (Cloudflare Workers). These providers process connection data (including IP address, user-agent and requested URL) to deliver the site, keep it secure, and prevent abuse. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in reliable, secure delivery).

3. Server, security and abuse-prevention logs

Connection logs used for security and troubleshooting are typically retained for 90 days and are then deleted or aggregated.

4. Google Analytics 4 and Microsoft Clarity — only after consent

Google Analytics 4 (Google Ireland Limited) and Microsoft Clarity (Microsoft Ireland Operations Ltd.) are loaded only after you actively accept the "Analytics" category. They process pseudonymous event data such as page views, clicks and device characteristics. Legal basis: Art. 6(1)(a) GDPR. You can withdraw consent at any time via cookie settings.

Google receives the IP address as part of the network request and may use it to derive coarse geographic information. According to Google, GA4 does not log or store individual IP addresses.

Retention: Google Analytics user-level and event-level data is retained for 2 months according to the configured GA4 retention setting.

5. Email contact

When you contact us by email at compliance@investbeacon.eu, we process your email address, the content of your message and any information you voluntarily include in order to review and respond to your request. Depending on the nature of the communication, the legal basis is Article 6(1)(b), Article 6(1)(c) or Article 6(1)(f) GDPR. Closed correspondence is normally retained for 24 months unless a longer statutory retention period or the establishment, exercise or defence of legal claims requires otherwise. This website has no contact form; messages reach us by email only.

6. Cookie-consent record

Your choice is stored as a single first-party record (cookie and localStorage key investbeacon_consent, version 2) containing the three independent categories — Necessary, Analytics and Marketing — the version and the timestamp of your decision. The record is valid for 182 days (about 6 months); afterwards the banner asks again. Nothing optional is loaded before you decide. Google Consent Mode v2 signals are set to denied by default and updated only to reflect your choice; advertising personalization is always signalled as denied. You can change or withdraw your choice at any time via cookie settings. Legal basis: Art. 6(1)(c) and Art. 6(1)(f) GDPR (documenting consent). Retention: 182 days (about 6 months).

7. Broker affiliate links and the /go/<broker> redirect

Broker and account-opening links pass through an internal /go/<broker> redirect before you reach the broker or affiliate partner. Measurement of these links works in two clearly separated layers.

7.1 Layer A — consent-free aggregate counting

Every redirect increments a counter. A counter row holds only the date, the broker, the site language, the type of page and the position of the button, plus the number of clicks. It contains no visitor, click or device identifier, no IP address, no user-agent, no referrer and no time of the individual click. Nothing is stored on your device, and no identifier is added to the partner link. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in knowing which editorial content works). Retention: 25 months. The same consent-free mechanism counts page views: those rows hold only the date, the page path and the number of views — again no visitor or device identifier, no IP address and no time of the individual view.

7.2 Layer B — click measurement with Marketing consent

Only if you have accepted the "Marketing" category do we create an internal pseudonymous click identifier, append it to the parameter the partner expects, and store one click record. That record contains: the internal click identifier, the broker, the site language, the type of page and the position of the button, the recorded consent state and consent version, the attribution channel, sanitised campaign values, advertising click identifiers where present, the time of the click and a test flag. The coarse country code supplied by our network provider is stored on the basis of your Marketing consent. Coarse device, browser, operating system, viewport, theme, click-sequence, time-on-page, scroll-depth, quiz-result and experiment-variant information is stored only if you also accepted "Analytics". We do not store your IP address, your raw user-agent string, the full referring URL or the full destination URL. Legal basis: Art. 6(1)(a) GDPR. Retention: click records that never lead to a conversion are deleted after 13 months; advertising click identifiers inside them are erased after 90 days.

7.3 Advertising identifiers stored on your device

With Marketing consent, advertising click identifiers (gclid, gbraid, wbraid, msclkid, fbclid, ttclid) and the five UTM campaign values are kept in the localStorage key ib_attribution_v2 as a first-touch and a last-touch entry for 90 days, after which they are deleted automatically. Withdrawing Marketing consent deletes them immediately. Without Marketing consent these values are removed from the address bar before any analytics tag can read them and are not retained anywhere. Legal basis: Art. 6(1)(a) GDPR.

7.4 Affiliate-network callbacks

When a referral qualifies, the broker or affiliate network notifies us server-to-server. We store only an allowlisted, normalised set: the network, the partner's conversion identifier, the status, the broker, the matched internal click identifier where one exists, the amount, the currency, timestamps and a test flag. The callback URL, request body, headers, IP address and user-agent are not stored; a sanitised technical payload may be kept for troubleshooting for at most 30 days. Legal basis: Art. 6(1)(b) and Art. 6(1)(f) GDPR (commission accounting). Retention: 13 months.

7.5 Google Ads conversion uploads

Where a conversion can be matched to a click that carries a Google advertising identifier and a recorded Marketing consent, we transmit to Google Ads (Google Ireland Limited) the advertising click identifier, the conversion time, the value, the currency and the corresponding consent signals. No name, email address, telephone number or other contact identifier — hashed or otherwise — is transmitted. Legal basis: Art. 6(1)(a) GDPR. This upload is currently switched off and will only operate on clicks recorded with Marketing consent. Retention of the upload log: 13 months.

7.6 Partner identifiers in the destination link

The destination URL may contain a partner identifier supplied by the broker or affiliate network so the referral can be attributed: it forms part of the partner link and is not created by InvestBeacon. After the redirect, the broker or partner processes your visit under its own privacy and cookie policies.

8. Processing activities at a glance

• Site delivery and security logs — purpose: deliver the site, keep it secure. Legal basis: Art. 6(1)(f). Recipients: Lovable, Cloudflare. Transfers: adequacy decision or Standard Contractual Clauses. Retention: 90 days. Withdrawal: not applicable (no consent involved).
• Analytics — purpose: audience measurement. Legal basis: Art. 6(1)(a). Recipients: Google, Microsoft. Transfers: adequacy decision or Standard Contractual Clauses. Retention: 2 months. Withdrawal: at any time in cookie settings.
• Email contact — purpose: answering your message. Legal basis: Art. 6(1)(b), (c) or (f). Recipients: our email provider. Transfers: as above where applicable. Retention: 24 months. Withdrawal: not applicable.
• Consent record — purpose: proving and honouring your choice. Legal basis: Art. 6(1)(c) and (f). Recipients: none. Transfers: none. Retention: 182 days (about 6 months). Withdrawal: change your choice at any time.
• Aggregate affiliate counting — purpose: knowing which content works. Legal basis: Art. 6(1)(f). Recipients: none. Transfers: none. Retention: 25 months. Withdrawal: not applicable — these counters hold no visitor, click or device identifier, no IP address, no user-agent and no referrer, nothing is stored on your device and no identifier is added to the partner link.
• Consented click measurement and device attribution — purpose: affiliate and advertising attribution. Legal basis: Art. 6(1)(a). Recipients: none beyond our hosting providers. Transfers: adequacy decision or Standard Contractual Clauses. Retention: 13 months (advertising identifiers 90 days). Withdrawal: at any time in cookie settings; stored advertising identifiers are deleted immediately.
• Partner callbacks and Google Ads conversion uploads — purpose: commission accounting and advertising measurement. Legal basis: Art. 6(1)(b) and (f) for the commission record, Art. 6(1)(a) for the upload. Recipients: affiliate networks, Google Ireland Limited. Transfers: adequacy decision or Standard Contractual Clauses. Retention: 13 months. Withdrawal: at any time; without Marketing consent no upload takes place.

9. Categories of processors and recipients

• Hosting platform (Lovable) and CDN (Cloudflare).
• Analytics (after consent): Google Analytics 4, Microsoft Clarity.
• Affiliate networks or brokers that receive redirect traffic.
• Email provider used to process inbound messages.

10. International transfers

Where recipients are located outside the EEA (including Cloudflare, Google and Microsoft), transfers may rely on an applicable European Commission adequacy decision — including the EU-US Data Privacy Framework where the relevant US entity is certified — or on the European Commission's Standard Contractual Clauses where applicable. Provider information:

• Google
• Microsoft
• Cloudflare
• Lovable

You can contact compliance@investbeacon.eu for further information about the safeguards that apply.

11. Retention periods

• Routine server and security logs: 90 days.
• Cookie-consent record: 182 days (about 6 months).
• Google Analytics user-level and event-level data: 2 months.
• Aggregate affiliate counters (no personal data): 25 months.
• Affiliate click records recorded with Marketing consent that never lead to a conversion: 13 months.
• Advertising click identifiers — inside those records and in the browser key ib_attribution_v2: 90 days.
• Sanitised technical callback payload kept for troubleshooting: 30 days.
• Completed conversion-upload log: 13 months.
• Closed email correspondence: 24 months.
• Accounting or legally required records: the applicable statutory retention period.

The aggregate counters, the consented click records and the advertising identifiers stored in your browser are separate datasets with separate retention periods. The cleanup runs on a schedule and is logged as counts only.

12. Your rights

You have the rights of access, rectification, erasure, restriction, portability and objection under Articles 15–22 GDPR, and the right to withdraw any given consent at any time with effect for the future.

13. Right to lodge a complaint

You may lodge a complaint with a supervisory authority, in particular the competent authority in Greece: the Hellenic Data Protection Authority (Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα).

14. Updates

We update this policy when processing activities or the legal framework change. Material changes are marked with a new date at the top of this page.