Legal
MarketHand · markethand.ch
Effective date: 24 March 2026 · Last updated: 24 March 2026
Welcome to MarketHand ("we", "our", or "us"). MarketHand is an AI-powered financial literacy application — a trading card game that transforms investment education into an engaging, measurable journey.
This Privacy Policy describes how we collect, use, store, and share your personal data when you use the MarketHand mobile application ("App"), visit our website at markethand.ch, or interact with any of our services (collectively, the "Services").
We are committed to protecting your privacy and processing your personal data in compliance with the General Data Protection Regulation (GDPR) (EU) 2016/679, the Swiss Federal Act on Data Protection (nFADP / revDSG), and all other applicable data protection laws.
Please read this policy carefully. By using our Services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with any part of this policy, you must discontinue use of our Services.
The data controller responsible for processing your personal data is:
For all questions relating to the processing of your personal data, or to exercise your rights, please contact us at the address above.
We collect personal data that you provide directly to us, data generated automatically through your use of the Services, and data received from third-party service providers.
When you create a MarketHand account, we collect the following information:
To keep you securely signed in, we generate and process:
The core purpose of MarketHand is to build your investor intuition through gameplay. To do this, we record detailed information about your in-game decisions:
We track your progression through the game's educational framework:
When you reach in-game milestones, we record:
If you participate in real-time multiplayer arena games, we process:
MarketHand features AI-powered companion characters. When you chat with a companion, the following context is sent to our AI provider to generate a relevant response:
See Section 6 for more details on the third-party AI provider used.
If you submit our website contact form, we collect:
Our website uses Vercel Analytics to collect aggregated, anonymised data about how visitors interact with our landing page. This may include:
Vercel Analytics is designed to be privacy-friendly and does not use cookies or persistent cross-site identifiers.
We process your personal data only where we have a lawful basis to do so under Article 6 of the GDPR. The table below sets out each purpose of processing and the corresponding legal basis.
| Purpose | Legal Basis (GDPR Art. 6) |
|---|---|
| Creating and managing your account | Art. 6(1)(b) — Performance of a contract |
| Authenticating your identity and securing your session | Art. 6(1)(b) — Performance of a contract |
| Delivering core gameplay and personalisation via the AI Persona Engine | Art. 6(1)(b) — Performance of a contract |
| Tracking your learning progress, topic mastery, and achievement milestones | Art. 6(1)(b) — Performance of a contract |
| Powering real-time multiplayer arena games | Art. 6(1)(b) — Performance of a contract |
| Generating AI companion responses using your in-game context | Art. 6(1)(b) — Performance of a contract |
| Sending account-related transactional emails (verification, password reset) | Art. 6(1)(b) — Performance of a contract |
| Displaying leaderboards and competitive rankings | Art. 6(1)(f) — Legitimate interests (community competition features) |
| Conducting aggregated analytics to improve the Services | Art. 6(1)(f) — Legitimate interests (product improvement) |
| Responding to contact form enquiries | Art. 6(1)(f) — Legitimate interests (handling communications) |
| Fraud prevention and security monitoring | Art. 6(1)(f) — Legitimate interests (security and integrity) |
| Complying with legal obligations | Art. 6(1)(c) — Legal obligation |
Where we rely on legitimate interests, we have conducted a balancing test to ensure that our interests do not override your fundamental rights and freedoms. You may object to processing carried out on this basis at any time (see Section 10).
We retain your personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law.
We engage the following categories of third-party service providers who may process personal data on our behalf as data processors, or in their own right as independent data controllers. We only share data that is necessary for the specific service and have entered into appropriate data processing agreements where required by law.
When you interact with an AI companion, the text of your message and relevant in-game context (current card, portfolio state, market state, recent news) are sent to OpenAI, L.L.C. via its API to generate a contextually relevant response. OpenAI processes this data as a data processor under our instructions. OpenAI may be headquartered in the United States. Data transfers are conducted pursuant to appropriate safeguards.
To surface relevant financial news for companion interactions, we use the Google Custom Search JSON API. Queries are sent to Google's servers. No personal user data is transmitted to Google in these requests — only the news search query.
Our landing website is hosted on Vercel, Inc. Vercel provides infrastructure and edge network services. Vercel Analytics collects the anonymised, aggregate usage data described in Section 3.9. Vercel is headquartered in the United States and processes data under its Data Processing Agreement and Standard Contractual Clauses.
Our contact form is protected by hCaptcha (provided by Intuition Machines, Inc.). hCaptcha processes information necessary to verify that form submissions are made by a human.
We use an SMTP email service to send transactional emails (account verification and password reset links). Only your email address and the content of the transactional email are transmitted.
We do not sell, rent, or trade your personal data to any third party for their own marketing or commercial purposes. Personal data is shared with third parties only to the extent necessary to provide the Services to you, or as described in this policy.
We may disclose your personal data if we are required to do so by applicable law, regulation, judicial order, or governmental authority, or where we have a good-faith belief that such disclosure is necessary to protect the rights, property, or safety of MarketHand, our users, or the public.
MarketHand is based in Switzerland. Some of our third-party service providers (including OpenAI and Vercel) operate from the United States and other countries outside of the European Economic Area (EEA) and Switzerland, which may not offer the same level of data protection as your home jurisdiction.
Where we transfer personal data to countries outside the EEA or Switzerland, we ensure that appropriate safeguards are in place, including:
You may request a copy of the safeguards we have put in place for international transfers by contacting us.
Our landing website (markethand.ch) does not use persistent tracking cookies. Vercel Analytics operates without cookies or cross-site tracking identifiers.
The MarketHand mobile application does not use browser cookies. Authentication state is maintained using JWT tokens stored securely on your device.
The hCaptcha widget used on our contact form may use session-scoped technical mechanisms to verify bot prevention challenges. These are strictly necessary for form functionality and do not track you across other websites.
We take the security of your personal data seriously and implement a range of technical and organisational measures to protect it against unauthorised access, accidental loss, destruction, or alteration:
While we strive to use commercially acceptable means to protect your personal data, no method of transmission over the internet or method of electronic storage is 100% secure. In the event of a personal data breach that is likely to result in a high risk to your rights and freedoms, we will notify you without undue delay in accordance with Article 34 GDPR.
Under the GDPR and applicable Swiss data protection law, you have the following rights with respect to your personal data. We will respond to all requests within one calendar month of receipt.
Right of Access (Art. 15 GDPR)
You have the right to request a copy of the personal data we hold about you, along with information about how and why we process it.
Right to Rectification (Art. 16 GDPR)
You have the right to request that we correct any inaccurate or incomplete personal data we hold about you.
Right to Erasure / "Right to Be Forgotten" (Art. 17 GDPR)
You have the right to request the deletion of your personal data where it is no longer necessary for the purposes for which it was collected, where you withdraw consent, where you object to processing and there are no overriding legitimate grounds, or where the data has been unlawfully processed.
Right to Restriction of Processing (Art. 18 GDPR)
You have the right to request that we restrict the processing of your personal data in certain circumstances — for example, while we verify the accuracy of data you have contested.
Right to Data Portability (Art. 20 GDPR)
Where processing is based on your consent or a contract and carried out by automated means, you have the right to receive your personal data in a structured, commonly used, machine-readable format (e.g. JSON), and to transmit it to another data controller.
Right to Object (Art. 21 GDPR)
You have the right to object to processing carried out on the basis of our legitimate interests. We will cease such processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms.
Rights Related to Automated Decision-Making and Profiling (Art. 22 GDPR)
MarketHand's AI Persona Engine makes automated inferences about your investor personality for the purpose of personalising your gameplay experience. This profiling does not produce legal or similarly significant effects on you. You have the right to request human review of any automated assessment that you believe has a meaningful impact on you.
Right to Withdraw Consent
Where we rely on your consent as the legal basis for processing, you have the right to withdraw that consent at any time without affecting the lawfulness of prior processing.
Right to Lodge a Complaint
You have the right to lodge a complaint with a supervisory authority. In Switzerland, this is the Federal Data Protection and Information Commissioner (FDPIC). If you are in the EU/EEA, you may also lodge a complaint with the data protection authority in your country of residence.
To exercise any of these rights, please contact us at hello@markethand.ch with the subject line "Data Protection Request". We may need to verify your identity before processing your request. Exercising your rights is free of charge.
MarketHand is not directed at, and we do not knowingly collect personal data from, children under the age of 16 years (or the applicable minimum age in your jurisdiction). If you are under 16, please do not use the Services or provide any personal data to us.
If we become aware that we have inadvertently collected personal data from a child under the applicable age threshold without verifiable parental consent, we will take steps to delete that data promptly. If you believe we may have such data, please contact us immediately.
Our Services may contain links to third-party websites, services, or resources. This Privacy Policy applies only to our Services. We have no control over, and are not responsible for, the content, privacy policies, or practices of any third-party sites or services.
We encourage you to review the privacy policies of any third-party services you visit.
We reserve the right to update or modify this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors.
We will notify you of material changes by:
Your continued use of the Services after the effective date of the revised policy constitutes your acceptance of the changes. If you do not agree with the revised policy, please discontinue use of the Services and delete your account.
This Privacy Policy is governed by and construed in accordance with the laws of Switzerland, in particular the Swiss Federal Act on Data Protection (nFADP / revDSG), without prejudice to your rights under the GDPR where applicable.
For users located in the European Economic Area, please note that the GDPR applies to our processing of your personal data where we offer goods or services to you in the EU/EEA, or monitor your behaviour within the EU/EEA.
If you have any questions, concerns, or complaints about this Privacy Policy or our data processing practices, or if you wish to exercise any of your rights, please contact our data protection point of contact:
We are committed to working with you to resolve any concerns you may have. If you are not satisfied with our response, you have the right to lodge a complaint with the competent supervisory authority: