Privacy policy

Last updated: 7 August 2026.

1. Controller

Athanasios Karantonis, acting as a sole proprietor under the name "InvestBeacon" (see legal notice).
Geographic business address: Sigis 11, Thessaloniki, Greece, ZIP CODE: 55438
VAT identification number: EL168282006
Email: compliance@investbeacon.eu

2. Hosting and delivery

The website is hosted on the Lovable platform and served through the global edge network of Cloudflare, Inc. (Cloudflare Workers). These providers process connection data (including IP address, user-agent and requested URL) to deliver the site, keep it secure, and prevent abuse. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in reliable, secure delivery).

3. Server, security and abuse-prevention logs

Connection logs used for security and troubleshooting are typically retained for 90 days and are then deleted or aggregated.

4. Google Analytics 4 and Microsoft Clarity — only after consent

Google Analytics 4 (Google Ireland Limited) and Microsoft Clarity (Microsoft Ireland Operations Ltd.) are loaded only after you actively accept the "Analytics" category. They process pseudonymous event data such as page views, clicks and device characteristics. Legal basis: Art. 6(1)(a) GDPR. You can withdraw consent at any time via cookie settings.

Google receives the IP address as part of the network request and may use it to derive coarse geographic information. According to Google, GA4 does not log or store individual IP addresses.

Retention: Google Analytics user-level and event-level data is retained for 2 months according to the configured GA4 retention setting.

5. Email contact

When you contact us by email at compliance@investbeacon.eu, we process your email address, the content of your message and any information you voluntarily include in order to review and respond to your request. Depending on the nature of the communication, the legal basis is Article 6(1)(b), Article 6(1)(c) or Article 6(1)(f) GDPR. Closed correspondence is normally retained for 24 months unless a longer statutory retention period or the establishment, exercise or defence of legal claims requires otherwise. This website has no contact form; messages reach us by email only.

6. Cookie-consent records

Your cookie choice is stored as a first-party record (cookie and localStorage key investbeacon_consent). Retention: 5 years.

7. Broker affiliate links and the /go/<broker> redirect

Broker and account-opening links may first pass through an internal /go/<broker> redirect before sending you to the relevant broker or affiliate partner. This redirect allows InvestBeacon to route links correctly and measure aggregate affiliate referrals. The redirect may process technical request data normally transmitted during web navigation, such as the selected broker, timestamp, referring page, locale, IP address and user-agent, through server or security logs.

Where Marketing consent has not been granted, InvestBeacon does not create or store optional advertising identifiers, affiliate click IDs or marketing-attribution records: no click identifier is appended to the partner URL, no click record is written to our database, and nothing is stored on your device. Strictly necessary server and security processing may still occur where required to complete the requested redirect, maintain security and prevent abuse.

Where Marketing consent has been granted, we use a pseudonymous click identifier and available advertising click parameters (gclid, gbraid, wbraid) for affiliate and advertising attribution. The localStorage key ib_ad_click_ids is stored in your browser for 90 days. Server-side we record, for each click: the broker, the pseudonymous click identifier, the locale, UTM parameters, the referring page, the destination URL, the user-agent and the country code supplied by Cloudflare. Your IP address is not stored in that record. Retention of that record: up to 36 months. Legal basis: Art. 6(1)(a) GDPR.

The destination affiliate URL may contain a partner identifier supplied by the broker or affiliate network so that the referral can be attributed. This identifier forms part of the destination link and is not created by InvestBeacon. Without Marketing consent, InvestBeacon does not add its own pseudonymous click identifier, advertising identifiers such as gclid, gbraid or wbraid, or store an optional marketing-attribution record. The strictly necessary /go/<broker> redirect may still process the technical information required to complete the user-requested navigation, maintain security and prevent abuse. After the redirect, the broker or affiliate partner processes the visit under its own privacy and cookie policies.

8. Categories of processors and recipients

• Hosting platform (Lovable) and CDN (Cloudflare).
• Analytics (after consent): Google Analytics 4, Microsoft Clarity.
• Affiliate networks or brokers that receive redirect traffic.
• Email provider used to process inbound messages.

9. International transfers

Where recipients are located outside the EEA (including Cloudflare, Google and Microsoft), transfers may rely on an applicable European Commission adequacy decision — including the EU-US Data Privacy Framework where the relevant US entity is certified — or on the European Commission's Standard Contractual Clauses where applicable. Provider information:

• Google
• Microsoft
• Cloudflare
• Lovable

You can contact compliance@investbeacon.eu for further information about the safeguards that apply.

10. Retention periods

• Routine server and security logs: 90 days.
• Advertising click IDs stored in your browser (ib_ad_click_ids): 90 days.
• Server-side affiliate click records and the aggregated affiliate reports derived from them: up to 36 months.
• Closed email correspondence: 24 months.
• Cookie-consent records: 5 years.
• Google Analytics user-level and event-level data: 2 months.
• Accounting or legally required records: the applicable statutory retention period.

The advertising click IDs stored in your browser and the server-side affiliate click records are separate datasets with separate retention periods.

11. Your rights

You have the rights of access, rectification, erasure, restriction, portability and objection under Articles 15–22 GDPR, and the right to withdraw any given consent at any time with effect for the future.

12. Right to lodge a complaint

You may lodge a complaint with a supervisory authority, in particular the competent authority in Greece: the Hellenic Data Protection Authority (Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα).

13. Updates

We update this policy when processing activities or the legal framework change. Material changes are marked with a new date at the top of this page.