Privacy

Welcome. This policy explains which personal data we process when you visit marketzeitgeist.com and cyclesiq.com, including their subdomains, and when you use Cycles IQ, for which purposes, on which legal basis, and which rights you have. It applies to the website, to Cycles IQ (the app at app.cyclesiq.com, the API and the MCP connector at api.cyclesiq.com, the sign-in at auth.cyclesiq.com), to the onboarding at cyclesiq.marketzeitgeist.com and to contact by e-mail. The research newsletter on Substack is covered in section 10.

1. Controller

WhenToTrade, owner Lars von Thienen
Bredbeekskoppel 6
21266 Jesteburg, Germany
E-mail: service@marketzeitgeist.com

Cycles IQ is a product of Lars von Thienen; WhenToTrade is his registered sole proprietorship. No data protection officer is appointed, as none is required by law.

2. Your rights

You have the right to obtain confirmation whether we process personal data about you and, if so, access to that data (Art. 15 GDPR); to rectification (Art. 16); to erasure (Art. 17); to restriction of processing (Art. 18); to data portability (Art. 20); to object to processing based on legitimate interests (Art. 21); and to withdraw consent at any time with effect for the future (Art. 7 (3)). You may exercise these rights free of charge by e-mail to the address above. You also have the right to lodge a complaint with a supervisory authority (Art. 77), for example the one responsible for us: Die Landesbeauftragte für den Datenschutz Niedersachsen, Prinzenstraße 5, 30159 Hannover, Germany, lfd.niedersachsen.de.

3. Data security

All pages are delivered over HTTPS. Data is stored on Microsoft Azure in the EU (region West Europe) with access restricted to the controller. We take technical and organisational measures appropriate to the risk to protect your data against loss, misuse and unauthorised access.

4. Automated decision-making

We do not use automated decision-making or profiling within the meaning of Art. 22 GDPR.

5. Visiting the website: hosting and server logs

The website is hosted on Microsoft Azure Static Web Apps (Microsoft Ireland Operations Ltd., One Microsoft Place, Dublin 18, Ireland). When you access a page, the platform processes the data your browser transmits: IP address, date and time, requested page, referrer, browser and operating system. This is technically necessary to deliver the page and to keep the service secure. Legal basis: Art. 6 (1) f GDPR (legitimate interest in a functioning, secure website). Platform logs are retained by Microsoft for a short period for security purposes; we do not evaluate them personally. Fonts are served from our own server; no request is made to Google or other font providers.

6. Cookies and analytics

The website marketzeitgeist.com sets no cookies of its own and uses no analytics or tracking services. The Cycles IQ app sets one strictly necessary cookie for your sign-in; it is not used for tracking. Where a page uses browser storage for your convenience (for example to remember your position in the onboarding questionnaire), this stays in your browser and is not transmitted to us.

7. DNS and edge services: Cloudflare

Our domains use the DNS service of Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. For some hostnames Cloudflare also acts as a reverse proxy and protects against attacks; in that case your requests pass through Cloudflare's network, which processes your IP address and request data for security and delivery. Legal basis: Art. 6 (1) f GDPR. Cloudflare is certified under the EU-US Data Privacy Framework; transfers rely on Art. 45 GDPR.

8. Cycles IQ introduction requests and onboarding questionnaire

Visitors without an invitation link can request an introduction at cyclesiq.marketzeitgeist.com. We process the data you enter in that form (name, e-mail address, optionally firm and role, and your message), the page you came from, and technical data (IP address, browser) to answer your request and, where it fits, to send you a personal invitation link. Legal basis: Art. 6 (1) b GDPR (pre-contractual measures at your request). The request is stored in Microsoft Azure Table Storage in the EU and is deleted at the latest twelve months after the last contact if no membership follows.

Prospects who receive a personal invitation link can answer a questionnaire at cyclesiq.marketzeitgeist.com. We process the data you enter (name, e-mail address, your answers, whether you agree to sign an NDA), the invitation source, and technical data (IP address, browser) to prepare an individual Cycles IQ offer and to arrange an introductory call. Legal basis: Art. 6 (1) b GDPR (pre-contractual measures at your request). The data is stored in Microsoft Azure Table Storage in the EU and is deleted at the latest twelve months after the last contact if no membership follows, or as required by statutory retention periods if it does. The following services are involved:

Cloudflare Turnstile protects the form against automated submissions. It processes technical browser data and your IP address to distinguish humans from bots, without tracking you across sites. Legal basis: Art. 6 (1) f GDPR.
Calendly (Calendly LLC, 271 17th St NW, Atlanta, GA 30363, USA) is embedded to book the introductory call. When you book, Calendly processes your name, e-mail address and the chosen time under its own privacy policy. Calendly is certified under the EU-US Data Privacy Framework. Legal basis: Art. 6 (1) b GDPR.
Microsoft 365 sends the notification and confirmation e-mails from our mailbox and hosts the introductory call on Microsoft Teams. Legal basis: Art. 6 (1) b GDPR.

9. Contact by e-mail

If you contact us by e-mail, we process your e-mail address, name and the content of your message to answer your enquiry. Our mailboxes are hosted with Microsoft 365 in the EU. Legal basis: Art. 6 (1) b GDPR for enquiries relating to a contract, otherwise Art. 6 (1) f GDPR. Messages are deleted when the matter is closed, unless statutory retention obligations apply.

10. Research newsletter (Substack)

The research newsletter is published on Substack (Substack Inc., 548 Market St, San Francisco, CA 94104, USA) and reached via research.marketzeitgeist.com. Subscribing, reading and unsubscribing are handled by Substack under its own privacy policy; Substack acts as an independent controller for the subscriber relationship. We receive the e-mail addresses of subscribers to publish the newsletter. Legal basis: Art. 6 (1) a GDPR (your consent when subscribing), revocable at any time via the unsubscribe link.

11. Cycles IQ: app, API and MCP connector

Cycles IQ is offered as an app at app.cyclesiq.com and as an API and an MCP connector for AI assistants such as Claude, ChatGPT, Claude Code and Cursor at api.cyclesiq.com. Use of these services is governed by our Terms of Service.

Sign-in and account. When you create an account or sign in, including when you connect Cycles IQ in an AI assistant, we process your e-mail address, your name, your sign-in identifier and the plan of your account, and we store the API keys you create. The sign-in is provided by Auth0 (Okta, Inc., 100 First Street, San Francisco, CA 94105, USA; EU tenant hosted in the EU) at auth.cyclesiq.com, which processes your sign-in identifier, your password hash or the data of the social login you choose, and technical sign-in data as our processor; Okta is certified under the EU-US Data Privacy Framework. Legal basis: Art. 6 (1) b GDPR.

Usage counts. For every call we count the tool or endpoint, its endpoint group, the day and the channel (app, API key or MCP connector) under your account. We use the counts to apply the limits of your plan, to bill usage and to prevent abuse. Daily counts are deleted after 24 months; the monthly totals of an account remain the basis of its invoices for the statutory retention period. Legal basis: Art. 6 (1) b GDPR.

Stored datasets and streams. Datasets you store or upload and the data of your live streams are kept with your account on Microsoft Azure in the EU until you delete them or your account is closed. They are visible only to you unless you share them. Legal basis: Art. 6 (1) b GDPR.

Server logs. The API records technical request data (time, route, response code, duration) in Microsoft Application Insights in the EU to operate the service and find errors; the client IP address is masked and no user identifier is recorded. The logs are deleted at the latest after 90 days. Legal basis: Art. 6 (1) f GDPR.

No conversation content. When you use Cycles IQ through an AI assistant, the connector receives only the tool calls your assistant sends (the name of the tool and its arguments, for example a data series or the name of one of your stored datasets) and returns the results. It does not receive or store your conversation with the assistant; that conversation is governed by the privacy policy of your AI provider.

E-mails of the services. Service e-mails of the API, such as the welcome e-mail of a new account and inactivity warnings, are sent from our mailbox service@marketzeitgeist.com through Microsoft 365 in the EU. Legal basis: Art. 6 (1) b GDPR.

Questions about your data in Cycles IQ, and requests to close your account: service@marketzeitgeist.com.

12. Recipients and international transfers

We pass personal data to processors only where named above (Auth0 by Okta, Microsoft, Cloudflare, Calendly, Substack), each bound by data processing agreements or acting as independent controllers as stated. Where a provider is located in the USA, the transfer relies on the EU-US Data Privacy Framework (Art. 45 GDPR) or on standard contractual clauses (Art. 46 GDPR). We do not sell personal data and do not pass it to third parties for their own marketing.

13. Retention

We keep personal data only as long as necessary for the purposes stated above or as required by statutory retention periods (in particular commercial and tax law, up to ten years for accounting records). Afterwards the data is deleted or anonymised.

14. Changes

We update this policy when the services or the legal situation change. The version published here applies. Last updated: 1 October 2026.