Draft – have it reviewed before publishing and fill in the details in [square brackets].

Privacy policy

1. Controller

[Name, address, email of the operator]

2. What we store

  • Account: email address, optional name, password (only as a one-way hash, never in plain text), role, plan, date of registration and of the last sign-in, whether the account is locked.
  • Two-factor sign-in (optional): the key of your authenticator app, stored encrypted.
  • Your settings: watchlist, notification settings and view preferences.
  • Alerts sent: which filings we have already emailed to you and when (so you do not get them twice).

The insider filings themselves are public data from the supervisory authorities (SEC, Finansinspektionen, AFM, FSMA) and are not personal data about you.

3. Purpose and legal basis

We process this data only to provide the service you signed up for – sign-in, watchlist and email alerts (Art. 6(1)(b) GDPR). Protection against misuse (e.g. limiting failed sign-ins) is based on our legitimate interest (Art. 6(1)(f) GDPR). There is no advertising, tracking or profiling, and data is not sold.

4. Cookies and local storage

Only technically necessary: a session cookie for sign-in. Light/dark mode and some view settings are stored in your browser only (local storage). No analytics or third-party cookies.

5. Recipients

  • Email delivery: alerts are sent via Brevo (Sendinblue SAS, 106 boulevard Haussmann, 75008 Paris, France), servers in the EU, under a data processing agreement. Brevo receives your email address and the content of the alert and logs the delivery (delivered / bounced). Opens and clicks are counted anonymously at most and are not linked to individual recipients.
  • [Hosting provider, if the service runs on a rented server – with a data processing agreement]
  • [Payment provider, once paid plans exist]

6. Storage period

As long as your account exists. When you delete your account, all associated data is deleted immediately; daily backups are kept for at most 30 days and then deleted automatically.

7. Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and objection. You can download your data and delete your account yourself under Notifications → Account and data. You can also lodge a complaint with a data protection supervisory authority.

8. Security

Passwords are stored only as a hash (scrypt), two-factor keys and the mail password are encrypted, and repeated failed sign-ins are blocked. [Encrypted connection (HTTPS) once the service is online.]

Last updated: [date]