TEMPLATE — NEEDS LEGAL REVIEW. Placeholder template text only; not legal advice. Data-controller identity, retention periods, and regional rights (GDPR/CCPA) wording must be completed and reviewed by a qualified lawyer before any public launch.

Privacy Policy

Effective date: [TO BE SET AT LAUNCH] · Controller: [LEGAL ENTITY NAME — TO BE COMPLETED]

What we collect

Account data: your email address and a salted, hashed password (we never store plaintext passwords).
Usage data you create: watchlists, alert rules, and daily snapshots of contracts you track, stored under your account.
Billing data: payments are processed by Stripe. We store your Stripe customer/subscription identifiers and plan status; we never see or store your full card number.
Technical data: basic server logs (IP address, timestamps, requested pages) for security and rate limiting.
Broker connections (BYOD, if enabled): if you connect a brokerage account, API tokens are stored encrypted at rest and used only to fetch market data on your behalf. [TO BE FINALISED WITH THE BYOD IMPLEMENTATION.]

What we do not do

We do not sell your personal data. We do not use your watchlists or alerts for advertising profiling. We do not ask for your brokerage password — broker connections use official API/OAuth mechanisms only.

How we use data

To operate your account, compute the analyses you request, send alert notifications you configured, process billing, prevent abuse, and comply with legal obligations.

Cookies

We use one essential cookie: a signed session cookie that keeps you logged in. It contains no personal data beyond an account identifier and an expiry time. [Analytics cookies, if ever added, will be disclosed here first.]

Your rights — PLACEHOLDER

[PLACEHOLDER: access, correction, deletion, export, and objection rights, contact address, and response timelines to be completed per applicable law (e.g. GDPR for EU users, CCPA/CPRA for California users).]

Retention and deletion

Account data is kept while your account is active. You may request deletion of your account and associated watchlists/alerts/snapshots at [CONTACT — TO BE COMPLETED]; billing records may be retained where tax law requires.

Security

Passwords are hashed with scrypt and a per-user salt; sessions are HMAC-signed, HttpOnly cookies; broker tokens (if any) are encrypted at rest. No system is perfectly secure.